readmodel

type Counters struct {
	// FlowCount is the number of stored records.
	FlowCount       int64
	ConnectionCount uint64
	ByteCount       uint64
}

type CredentialLifecycle string

type CredentialState string

type CredentialStatus struct {
	State CredentialState
	// Lifecycle is what the control plane will still accept from the
	// credential, and RenewableUntil the instant the renewal grace after
	// its expiry ends.
	Lifecycle      CredentialLifecycle
	RenewableUntil time.Time
	// Serial and ExpiresAt are the credential last issued, which State
	// and Lifecycle judge.
	Serial        string
	ExpiresAt     time.Time
	LastRenewedAt *time.Time
	LastError     string
	// LastLateRenewal is the workload's latest late renewal; nil when it
	// has never renewed late. A later on-time renewal leaves it.
	LastLateRenewal *registry.LateRenewal
	// LastPresented is the credential the workload's most recent sync
	// stream opened on; nil when none has been recorded. It is the one in
	// use only while the sync state says a stream is open, and differs
	// from the issued one while a stream outlives a renewal.
	LastPresented *registry.PresentedCredential
}

type Flow struct {
	ID              int64
	WindowStart     time.Time
	WindowEnd       time.Time
	Peer            PeerRef
	SrcAddress      netip.Addr
	DstAddress      netip.Addr
	Service         Service
	Direction       innerwallv1.Direction
	Verdict         innerwallv1.PolicyDecision
	Rule            *RuleRef
	ConnectionCount uint64
	ByteCount       uint64
	FirstSeen       time.Time
	LastSeen        time.Time
	ProcessName     string
}

type FlowsPage struct {
	Workload   WorkloadRef
	Range      Range
	Flows      []Flow
	NextCursor string
}

type FlowsRequest struct {
	Workload  identity.WorkloadID
	From      time.Time
	To        time.Time
	Verdict   innerwallv1.PolicyDecision
	Direction innerwallv1.Direction
	Peer      string
	Service   *Service
	Cursor    string
	// Limit bounds the page; the store's default and maximum apply.
	Limit int
}

type Gap struct {
	Workload WorkloadRef
	Kind     innerwallv1.EvidenceGapKind
	Source   innerwallv1.EvidenceSource
	From     time.Time
	To       time.Time
	Count    *uint64
}

type Gaps struct {
	Range     Range
	Gaps      []Gap
	Truncated bool
}

type GapsRequest struct {
	From     time.Time
	To       time.Time
	Workload *identity.WorkloadID
	Selector policy.Selector
	Limit    int
}

type GroupKeys struct {
	Rule    *RuleRef
	Peer    *PeerRef
	Src     *PeerRef
	Dst     *WorkloadRef
	Service *Service
}

type Health struct {
	LastSeenAt         *time.Time
	Credential         CredentialStatus
	DroppedFlowRecords uint64
	// SourceOverruns counts the moments the kernel dropped events because
	// one of the agent's flow sources fell behind, since the agent
	// started; each is also an evidence gap with its interval.
	SourceOverruns uint64
	// ClockSkew is the latest flow report whose agent clock was beyond
	// the tolerance, and whether it is still the latest reading; nil when
	// none has been received.
	ClockSkew *registry.ClockSkew
	// OwnedTable is whether the agent's owned firewall table is in the
	// kernel, as its heartbeats last said; unspecified until one that
	// knows has arrived. OwnedTableAbsentSince is when the control plane
	// first heard it was absent, nil unless it is. An absent table means
	// the host enforces and observes nothing, whatever the sync state
	// says of the version the agent acknowledged (issue #64).
	OwnedTable            innerwallv1.OwnedTableState
	OwnedTableAbsentSince *time.Time
	// LastFlowReportAt is when the control plane last received a flow
	// report from the agent; nil when none has been. TelemetryLive says
	// one arrived within TelemetryLiveWindows flow windows of the read: the
	// agent is running and reaching the control plane, whatever its sync
	// stream's state, which travels on another connection (issue #61).
	LastFlowReportAt *time.Time
	TelemetryLive    bool
}

type Lifecycle string

type PeerRef struct {
	Kind   flowstore.PeerKind
	Key    string
	Name   string
	Labels map[string]string
}

type Range struct {
	From time.Time
	To   time.Time
}

type Reader struct {
	Store Store
	Flows flowstore.FlowStore
	// FlowWindow is the flow aggregation window the control plane hands
	// agents; a workload's telemetry is live while a report has arrived
	// within TelemetryLiveWindows of it. Zero judges no telemetry live.
	FlowWindow time.Duration
	// RenewalGrace is the renewal grace the control plane admits expired
	// credentials under, which a workload's credential lifecycle is
	// judged by; enroll.DefaultRenewalGrace if zero. The control plane
	// passes the grace it serves with.
	RenewalGrace time.Duration
	// Now is the clock; time.Now if nil.
	Now func() time.Time
}

type RenderedPolicy struct {
	Workload        WorkloadRef
	Version         uint64
	Mode            innerwallv1.EnforcementMode
	RenderedAt      *time.Time
	TerminalVerdict innerwallv1.PolicyDecision
	Rules           []RenderedRule
}

type RenderedRule struct {
	ID             string
	AuthoredRuleID string
	Ruleset        *RulesetRef
	Description    string
	// CreatedAt and UpdatedAt are the authored rule's own instants; nil
	// when the authored rule no longer exists.
	CreatedAt *time.Time
	UpdatedAt *time.Time
	Protocol  innerwallv1.Protocol
	// Ports is empty when the rule permits every port of the protocol.
	Ports     []policy.PortRange
	PeerCIDRs []string
	Verdict   innerwallv1.PolicyDecision
}

type Rollup struct {
	Range         Range
	EffectiveFrom *time.Time
	EffectiveTo   *time.Time
	GroupBy       flowstore.GroupBy
	Groups        []RollupGroup
	GroupCount    int64
	Truncated     bool
	Totals        Counters
}

type RollupGroup struct {
	Keys GroupKeys
	Counters
	WorkloadCount *int64
	FirstSeen     time.Time
	LastSeen      time.Time
}

type RollupRequest struct {
	From      time.Time
	To        time.Time
	GroupBy   flowstore.GroupBy
	Verdict   innerwallv1.PolicyDecision
	Direction innerwallv1.Direction
	Workload  *identity.WorkloadID
	Selector  policy.Selector
	Endpoint  flowstore.Endpoint
	Service   *Service
	Order     flowstore.GroupOrder
	// Limit bounds the groups; the store's default and maximum apply.
	Limit int
}

type RuleRef struct {
	ID             string
	AuthoredRuleID string
	Protocol       innerwallv1.Protocol
}

type RulesetRef struct {
	ID   uuid.UUID
	Name string
}

type Service struct {
	Protocol innerwallv1.Protocol
	Port     uint16
}

type StatusCount struct {
	SyncState innerwallv1.SyncState
	Removed   bool
	Retired   bool
	Workloads int64
}

type Store interface {
	// ListWorkloads returns every workload with its labels and addresses,
	// the registry's view for naming peers and resolving scopes.
	ListWorkloads(ctx context.Context) ([]registry.Workload, error)
	ListAddressGroups(ctx context.Context) ([]policy.AddressGroup, error)
	ListRulesets(ctx context.Context) ([]policy.Ruleset, error)
	// GetWorkloadPolicy returns the persisted rendered policy of a
	// workload with its version, or nil when none has been rendered.
	GetWorkloadPolicy(ctx context.Context, id identity.WorkloadID) (*innerwallv1.WorkloadPolicy, error)
	// ListWorkloadPage returns one page of the fleet in fleet order.
	ListWorkloadPage(ctx context.Context, q WorkloadPageQuery) ([]WorkloadRecord, error)
	// CountWorkloadsByStatus returns how many workloads hold each sync
	// state, split by whether their owned table is recorded absent, read
	// at one instant; a pair no workload holds is absent.
	CountWorkloadsByStatus(ctx context.Context) ([]StatusCount, error)
	// GetWorkloadRecord returns one workload with its latest rendered
	// version and listening services, or registry.ErrWorkloadUnknown.
	GetWorkloadRecord(ctx context.Context, id identity.WorkloadID) (*WorkloadRecord, error)
	// ListWorkloadLabelIndex returns every workload's current labels, for
	// resolving a selector to the workloads in its scope.
	ListWorkloadLabelIndex(ctx context.Context) (map[identity.WorkloadID]map[string]string, error)
}

type SyncStatus struct {
	State            innerwallv1.SyncState
	AppliedVersion   uint64
	LatestVersion    uint64
	LatestRenderedAt *time.Time
	Error            string
	// LastSnapshotSentAt is nil when no snapshot has been recorded. A
	// directed reconnect is observed as this instant advancing.
	LastSnapshotSentAt *time.Time
	// LastAckedAt is when the agent last acknowledged an applied
	// version, and LastApplyFailedAt when it last reported a failed
	// apply; each nil when none has been recorded. A failure instant
	// outlives the failure: State says whether it still stands.
	LastAckedAt       *time.Time
	LastApplyFailedAt *time.Time
}

type Workload struct {
	ID                identity.WorkloadID
	Hostname          string
	Labels            []registry.Label
	Mode              innerwallv1.EnforcementMode
	EnrolledAt        time.Time
	Addresses         []netip.Addr
	Facts             *innerwallv1.HostFacts
	Agent             registry.AgentInfo
	ListeningServices []registry.ListeningService
	Sync              SyncStatus
	Health            Health
	// Lifecycle is active or retired, and RetiredAt when it was retired,
	// nil while it is active.
	Lifecycle Lifecycle
	RetiredAt *time.Time
}

type WorkloadCounts struct {
	Total   int64
	BySync  map[innerwallv1.SyncState]int64
	Removed int64
	Retired int64
}

type WorkloadCursor struct {
	SyncRank int32
	SeenKey  time.Time
	ID       identity.WorkloadID
}

type WorkloadPageQuery struct {
	IDs       []identity.WorkloadID
	Mode      innerwallv1.EnforcementMode
	SyncState innerwallv1.SyncState
	Retired   bool
	After     *WorkloadCursor
	Limit     int
}

type WorkloadRecord struct {
	registry.Workload
	// LastRenewedAt is when the credential was last reissued; nil when
	// the enrollment credential is still the current one.
	LastRenewedAt     *time.Time
	LatestVersion     uint64
	LatestRenderedAt  *time.Time
	ListeningServices []registry.ListeningService
	// SyncRank and SeenKey are the store's sort keys for the fleet order:
	// the attention rank and the last-seen instant with never-seen as the
	// epoch. A cursor carries them.
	SyncRank int32
	SeenKey  time.Time
}

type WorkloadRef struct {
	ID       identity.WorkloadID
	Hostname string
	Labels   map[string]string
}

type WorkloadsPage struct {
	Workloads  []Workload
	NextCursor string
}

type WorkloadsRequest struct {
	Selector  policy.Selector
	Mode      innerwallv1.EnforcementMode
	SyncState innerwallv1.SyncState
	Lifecycle Lifecycle
	Cursor    string
	Limit     int
}