admin

type AdminAuditEventsResponse struct {
	Events []coreaudit.Event `json:"events"`
	Total  int               `json:"total"`
}

type AdminCreateModelRequest struct {
	Name            string   `json:"name"`
	ProviderType    string   `json:"provider_type"`
	APIURL          string   `json:"api_url"`
	APIKey          string   `json:"api_key"`
	Model           string   `json:"model"`
	ContextWindow   int      `json:"context_window"`
	CallTimeout     int      `json:"call_timeout"`
	MaxTokens       int      `json:"max_tokens"`
	Reasoning       string   `json:"reasoning"`
	CacheMode       string   `json:"cache_mode"`
	CacheTTL        string   `json:"cache_ttl"`
	Currency        string   `json:"currency"`
	InputPrice      string   `json:"input_price"`
	CacheReadPrice  string   `json:"cache_read_price"`
	CacheWritePrice string   `json:"cache_write_price"`
	OutputPrice     string   `json:"output_price"`
	Vision          bool     `json:"vision"`
	Capabilities    []string `json:"capabilities"`
}

type AdminCreateUserRequest struct {
	Email string `json:"email"`
}

type AdminExternalIdentitiesResponse struct {
	Identities []AdminExternalIdentity `json:"identities"`
}

type AdminExternalIdentity struct {
	ID            string     `json:"id"`
	Issuer        string     `json:"issuer"`
	Subject       string     `json:"subject"`
	LastSeenEmail string     `json:"last_seen_email,omitempty"`
	LastSeenName  string     `json:"last_seen_name,omitempty"`
	LastLoginAt   *time.Time `json:"last_login_at,omitempty"`
	CreatedAt     time.Time  `json:"created_at"`
}

type AdminGrant struct {
	coreidentity.SystemGrant
	Email string `json:"email,omitempty"`
}

type AdminGrantRequest struct {
	UserID string `json:"user_id"`
	// Role is optional and defaults to system_admin, which is the only role
	// this build accepts. It is in the body so that adding a second role later
	// is not a new route.
	Role string `json:"role,omitempty"`
}

type AdminGrantsResponse struct {
	Grants []AdminGrant `json:"grants"`
}

type AdminLoginCodeResponse struct {
	Code      string    `json:"code"`
	ExpiresAt time.Time `json:"expires_at"`
}

type AdminMeResponse struct {
	UserID string   `json:"user_id"`
	Roles  []string `json:"roles"`
	// Grants are the caller's own active grants, so the area can show when the
	// authority was given and by whom. Other people's grants are not here;
	// that is GET /api/admin/grants.
	Grants []coreidentity.SystemGrant `json:"grants"`
}

type AdminModel struct {
	coregw.Model
}

type AdminModelsResponse struct {
	Models []AdminModel `json:"models"`
	// DefaultModel is the model name a caller gets when it names none. Empty
	// means llm.default_model was not configured and the first enabled model
	// serves as the default.
	DefaultModel string `json:"default_model,omitempty"`
}

type AdminSession struct {
	SessionID  string    `json:"session_id"`
	Platform   string    `json:"platform,omitempty"`
	AuthMethod string    `json:"auth_method,omitempty"`
	CreatedAt  time.Time `json:"created_at"`
	LastSeenAt time.Time `json:"last_seen_at"`
	ExpiresAt  time.Time `json:"expires_at"`
}

type AdminSessionsResponse struct {
	Sessions []AdminSession `json:"sessions"`
}

type AdminSessionsRevokedResponse struct {
	Revoked int64 `json:"revoked"`
}

type AdminSpace struct {
	ID   string `json:"id"`
	Name string `json:"name"`
	// Personal marks a user's own space rather than a collaborative space.
	Personal    bool      `json:"personal"`
	QuotaTier   string    `json:"quota_tier,omitempty"`
	MemberCount int       `json:"member_count"`
	CreatedBy   string    `json:"created_by,omitempty"`
	CreatedAt   time.Time `json:"created_at"`
}

type AdminSpaceDetail struct {
	AdminSpace
	Members []AdminSpaceMember `json:"members"`
	// Usage is nil when the deployment reports no quota, so a reader can tell
	// "no limits configured" from "using nothing".
	Usage *spaceUsage `json:"usage,omitempty"`
}

type AdminSpaceMember struct {
	UserID string `json:"user_id"`
	Email  string `json:"email,omitempty"`
	Role   string `json:"role"`
}

type AdminSpacesResponse struct {
	Spaces []AdminSpace `json:"spaces"`
	Total  int          `json:"total"`
}

type AdminSystemResponse struct {
	Version string `json:"version"`
	// SchemaMigrations are the steps applied beyond the row structs'
	// additive DDL. It is not a schema version — see the store method.
	SchemaMigrations []adminSchemaMigration `json:"schema_migrations"`
	Dependencies     []adminDependency      `json:"dependencies"`
	// Ready mirrors what /readyz would answer right now.
	Ready              bool           `json:"ready"`
	WorkerRunMode      string         `json:"worker_run_mode,omitempty"`
	WorkerLLMTransport string         `json:"worker_llm_transport,omitempty"`
	SandboxSurface     string         `json:"sandbox_surface,omitempty"`
	AllowSignup        bool           `json:"allow_signup"`
	TaskRuns           map[string]int `json:"task_runs"`
	SystemAdmins       int            `json:"system_admins"`
	ServerTime         time.Time      `json:"server_time"`
	// OIDC is the live SSO provider health. Nil when SSO is not configured. It
	// is separate from Dependencies because a degraded IdP does not make the
	// deployment not-ready — the fetch is retryable.
	OIDC *adminOIDCStatus `json:"oidc,omitempty"`
}

type AdminUser struct {
	ID                string     `json:"id"`
	Email             string     `json:"email"`
	Name              string     `json:"name,omitempty"`
	QuotaTier         string     `json:"quota_tier,omitempty"`
	HasPassword       bool       `json:"has_password"`
	DisabledAt        *time.Time `json:"disabled_at,omitempty"`
	LastLoginAt       *time.Time `json:"last_login_at,omitempty"`
	LastLoginPlatform *string    `json:"last_login_platform,omitempty"`
	CreatedAt         time.Time  `json:"created_at"`
}

type AdminUserDetail struct {
	AdminUser
	Spaces []AdminUserSpace `json:"spaces"`
	// SessionCount counts live login chains, not tokens. It is what "signed in
	// on two machines" means.
	SessionCount int `json:"session_count"`
	// SystemRoles are the deployment-scoped roles this account holds.
	SystemRoles []string `json:"system_roles"`
}

type AdminUserSpace struct {
	SpaceID string `json:"space_id"`
	Name    string `json:"name"`
	Role    string `json:"role"`
}

type AdminUsersResponse struct {
	Users []AdminUser `json:"users"`
	Total int         `json:"total"`
}

type Config struct {
	JWTSecret        string
	DefaultQuotaTier string

	Users              coreidentity.UserStore
	LoginCodes         coreidentity.LoginCodeStore
	RefreshTokens      coreidentity.RefreshTokenStore
	Sessions           coreidentity.AuthSessionStore
	ExternalIdentities coreidentity.ExternalIdentityStore
	Spaces             corespace.Store
	Grants             coreidentity.SystemGrantStore
	Audits             coreaudit.Store
	Models             coregw.ModelStore
	Schema             coreschema.Store
	TaskRuns           coretask.RunStore

	Quota *quota.Service
	// Lifecycle sequences an account disable/enable and its cleanup, and computes
	// the deactivation-impact projection. Nil falls back to setting the gate and
	// revoking sessions inline, which is what a deployment without the wired
	// service has.
	Lifecycle *accountlifecycle.Service
	// SpaceRecovery performs disabled-owner-only ownership recovery. Nil answers
	// the recovery route as not configured.
	SpaceRecovery *spacerecovery.Service
	// Plugins publishes releases and manages catalog entries. Nil is a
	// deployment with no Marketplace, which every route here reports rather
	// than pretending an empty catalog.
	Plugins *pluginsvc.Service
	// Audit records who did what. Nil discards it, which is what a deployment
	// without a database has.
	Audit *audit.Recorder

	Deployment       DeploymentInfo
	DependencyProbes []DependencyProbe
	// RedactedConfig is the operator-facing view of server.yaml, built by
	// internal/config so the decision about which fields may be shown lives
	// next to the struct.
	RedactedConfig any
	// OIDCStatus reports the live SSO provider health for the system view. Nil
	// means SSO is not configured. It is a closure so this package needs no
	// import of the OIDC provider; bootstrap adapts the provider into it. Unlike
	// a dependency probe, a degraded provider does not make the deployment
	// not-ready: an IdP fetch is retryable and must not fail /readyz.
	OIDCStatus OIDCStatusFunc
}

type DependencyProbe struct {
	// Name must be safe to show: "database", not a DSN.
	Name  string
	Probe func(ctx context.Context) error
}

type DeploymentInfo struct {
	// Version is the running binary's version string. It arrives from
	// bootstrap rather than being read here: internal/server must not import
	// internal/config, and a version the handler resolved itself would be a
	// second answer to a question the process already has one for.
	Version string
	// WorkerRunMode is "k8s_job" or the local-process path.
	WorkerRunMode string
	// WorkerLLMTransport is "direct" or "buildmax".
	WorkerLLMTransport string
	AllowSignup        bool
	// SandboxSurface is the execution boundary worker runs resolve to. Empty
	// means this deployment did not report one, which is every deployment
	// today — not that runs are unconfined. See deploymentInfoFor in
	// internal/bootstrap for why the server does not answer for the worker.
	SandboxSurface string
	// DefaultModel is the catalog model a caller gets when it names none.
	// Empty means the first enabled model in the catalog, so the admin view
	// reports what was configured rather than what it resolves to.
	DefaultModel string
}

type Handler struct {
	// contains filtered or unexported fields
}

type OIDCStatusFunc func() (available bool, lastRefresh time.Time, lastError string)