compiler

type Announcement struct {
	ID      identity.WorkloadID
	Version uint64
}

type Change struct {
	ID      identity.WorkloadID
	Version uint64
	Changes int
}

type Directive struct {
	ID   identity.WorkloadID
	Kind DirectiveKind
}

type DirectiveKind int

type Engine struct {
	Store Store
	Log   *slog.Logger
	// Now is the clock; time.Now if nil.
	Now func() time.Time
}

type Inputs struct {
	Workloads     []registry.Workload
	Rulesets      []policy.Ruleset
	Services      []policy.Service
	AddressGroups []policy.AddressGroup
}

type ModeChange struct {
	From innerwallv1.EnforcementMode
	To   innerwallv1.EnforcementMode
}

type Outcome struct {
	ID identity.WorkloadID
	// Policy is the rendered policy carrying the version it should be
	// persisted at: the previous version when nothing changed, one more
	// when something did.
	Policy *innerwallv1.WorkloadPolicy
	// Changes is the delta from the previously persisted policy. Empty
	// exactly when Changed is false.
	Changes []*innerwallv1.DeltaChange
	// Changed reports whether the version advanced: the rendered output
	// differs from what was persisted, or nothing was persisted yet.
	Changed bool
}

type Report struct {
	// Workloads is how many workloads were rendered: every active one.
	Workloads int
	// Changed lists the workloads whose rendered output changed, and
	// therefore whose version advanced and whose stream is pushed.
	Changed []Change
}

type RuleChange struct {
	Before *innerwallv1.ResolvedRule
	After  *innerwallv1.ResolvedRule
}

type Store interface {
	// RenderTx runs fn in one transaction holding the render lock, so two
	// renders in any two processes never interleave. It commits when fn
	// returns nil and rolls back otherwise.
	RenderTx(ctx context.Context, fn func(ctx context.Context, tx Tx) error) error
}

type Tx interface {
	LoadInputs(ctx context.Context) (*Inputs, error)
	// LoadPolicies returns the persisted policy of every workload that has
	// one, with its version.
	LoadPolicies(ctx context.Context) (map[identity.WorkloadID]*innerwallv1.WorkloadPolicy, error)
	// SavePolicy persists a changed policy at the version it carries and
	// announces the change so the stream holding the workload pushes it
	// once the transaction commits.
	SavePolicy(ctx context.Context, id identity.WorkloadID, policy *innerwallv1.WorkloadPolicy, now time.Time) error
}

type WorkloadDiff struct {
	ID identity.WorkloadID
	// Version is the persisted version the diff is against; zero when no
	// policy has been rendered yet.
	Version uint64
	Mode    *ModeChange
	Added   []*innerwallv1.ResolvedRule
	Removed []*innerwallv1.ResolvedRule
	Changed []RuleChange
}