api

type Deps struct {
	// Authenticator resolves the credentials the surface is presented,
	// behind the login endpoint and the authentication middleware.
	Authenticator authn.Authenticator
	// Operators is the operator domain, behind operator token management.
	Operators *operator.Service
	// Reads is the read model the read endpoints call.
	Reads *readmodel.Reader
	// Authoring is the authored model's write domain, behind the
	// ruleset, rule, service, and address group endpoints.
	Authoring *policy.Authoring
	// Fleet is the fleet write domain, behind label edits, mode
	// changes, the selector preview, the dry run, and the directed
	// reconnect.
	Fleet *fleet.Service
	// Enroll is the enrollment domain, behind provisioning token
	// management.
	Enroll *enroll.Service
	// Site is the label the console header shows; empty when none is
	// configured.
	Site string
	// GatewayAddress is the host:port agents reach the agent gateway at,
	// as the operator configured it for the console's enroll command;
	// empty when none is configured. It is never derived from the bind
	// address or the host's interfaces.
	GatewayAddress string
	// Console is the built console tree served at every path outside the
	// API prefix; nil when this build carries none (ADR-0008).
	Console fs.FS
	// LoginAttempts and LoginWindow configure the login throttle; the
	// defaults apply when zero.
	LoginAttempts int
	LoginWindow   time.Duration
	Log           *slog.Logger
	// Now is the clock; time.Now if nil.
	Now func() time.Time
}

type Finding struct {
	Path    string `json:"path"`
	Rule    string `json:"rule"`
	Message string `json:"message"`
}

type Me struct {
	DisplayName    *string `json:"display_name"`
	Site           string  `json:"site"`
	GatewayAddress *string `json:"gateway_address"`
	Version        string  `json:"version"`
}

type Middleware struct {
	Name string
	Wrap func(http.Handler) http.Handler
}

type Problem struct {
	Type   string `json:"type"`
	Title  string `json:"title"`
	Status int    `json:"status"`
	Detail string `json:"detail,omitempty"`
	// Errors are the admission findings of a validation problem, one per
	// field the caller must fix.
	Errors []Finding `json:"errors,omitempty"`
	// CurrentVersion is the version the resource holds now, on a
	// precondition-failed problem.
	CurrentVersion string `json:"current_version,omitempty"`
	// Expected and Matched are the counts of a match-count problem.
	Expected *int `json:"expected,omitempty"`
	Matched  *int `json:"matched,omitempty"`
	// LastSeenAt is when the agent was last heard from, on an
	// agent-offline problem, where it is always present and null when the
	// agent never was.
	LastSeenAt *nullableInstant `json:"last_seen_at,omitempty"`
	// RetiredAt is when the workload was retired, on a workload-retired
	// problem.
	RetiredAt string `json:"retired_at,omitempty"`
}

type Route struct {
	Method  string
	Pattern string
	Handler http.HandlerFunc
}

type Server struct {
	// contains filtered or unexported fields
}

type Surface struct {
	// Middleware wraps the API routes, outermost first.
	Middleware []Middleware
	// Routes are the endpoints under APIPrefix.
	Routes []Route
	// Console serves every path outside APIPrefix.
	Console http.Handler
}

type Throttle struct {
	// Limit is the number of attempts allowed per window;
	// DefaultLoginAttempts if zero.
	Limit int
	// Window is the fixed window length; DefaultLoginWindow if zero.
	Window time.Duration
	// Now is the clock; time.Now if nil.
	Now func() time.Time
	// contains filtered or unexported fields
}