gcpsweep

type AddressSearcher interface {
	// SearchAddress returns every resource in project carrying both
	// labels, all pages read, or an error and no resources, with the same
	// typed errors as [Searcher.Search].
	SearchAddress(ctx context.Context, project, estate, address string) ([]Asset, error)
}

type Asset struct {
	// AssetType is the Cloud Asset type: "compute.googleapis.com/Network".
	AssetType string
	// Name is the full resource name:
	// "//compute.googleapis.com/projects/p/global/networks/n".
	Name string
	// Project is the project the resource is in, as the index spells it:
	// "projects/" and the project NUMBER, never the id the caller searched
	// by.
	Project string
	// Location is the resource's region, zone or "global".
	Location string
	// Labels are the resource's labels, the estate's among them.
	Labels map[string]string
	// CreateTime and UpdateTime are the resource's own timestamps, RFC
	// 3339, or "" for an asset type that reports none.
	CreateTime string
	UpdateTime string
}

type Attrs struct {
	// Credentials is the provider's credentials argument: a path to a
	// service account key or other credentials file, or its JSON contents.
	Credentials string
	// AccessToken is the provider's access_token argument: an OAuth 2.0
	// access token, or a path to a file holding one.
	AccessToken string
	// ImpersonateServiceAccount is the service account email every call is
	// made as, through the base credential, and ImpersonateDelegates its
	// delegation chain.
	ImpersonateServiceAccount string
	ImpersonateDelegates      []string
	// Scopes overrides the provider's default OAuth scopes.
	Scopes []string

	// Project, Region and Zone are the block's defaults. Only Project
	// bears on a sweep: it is the project a client searches when its
	// caller names none ([Client.Project]).
	Project string
	Region  string
	Zone    string

	// BillingProject and UserProjectOverride are how the provider sends a
	// quota project: with the override on, every call carries
	// X-Goog-User-Project, BillingProject's value when set, else the
	// project the call is about.
	BillingProject      string
	UserProjectOverride bool
	// UniverseDomain is the provider's universe_domain, for a sovereign
	// cloud; empty is googleapis.com.
	UniverseDomain string

	// CloudAssetEndpoint is the provider's cloud_asset_custom_endpoint, a
	// base path ending in the API version as the provider writes it
	// ("https://cloudasset.googleapis.com/v1/"); an emulator or a test
	// sets it. IAMCredentialsEndpoint is iam_credentials_custom_endpoint,
	// where an impersonated token is minted.
	CloudAssetEndpoint     string
	IAMCredentialsEndpoint string

	// Endpoints are the *_custom_endpoint arguments of the products the
	// per-type listers call ([TypeList.Endpoint]), by argument name, each
	// a base path as the provider writes it. An unset one is absent.
	Endpoints map[string]string

	// ExternalCredentials is whether the block declares an
	// external_credentials block (workload identity federation through
	// the provider's own exchange). The sweep does not perform that
	// exchange, so [New] refuses such a block rather than search as
	// whatever Application Default Credentials happen to be.
	ExternalCredentials bool

	// Marked names the arguments the block sets to a marked value that
	// [ProviderAttrs] therefore left unread. [New] refuses a client when
	// one of them would change who the sweep authenticates as or which
	// endpoint it calls ([Attrs.refusedMarks]).
	Marked []string
}

type Client struct {
	// contains filtered or unexported fields
}

type Config struct {
	// Markers names the owner and address label keys a search matches.
	Markers markerkeys.Keys
	// HTTPClient carries every call, the Cloud Asset search and each
	// per-type list, already authenticated as the caller decided. Nothing
	// here reads a credentials file, searches for Application Default
	// Credentials or asks the metadata server. [HTTPClient] builds one the
	// way hashicorp/google's provider does; a caller with its own rule
	// passes its own.
	HTTPClient *http.Client
	// Credentials is what diagnostics name the credential as.
	Credentials Credentials
}

type Coverage map[string]Searcher

type CredentialSource string

type Credentials struct {
	Source CredentialSource
	// Impersonate is the service account every call is made as, through
	// Source, or "" when the block impersonates no one.
	Impersonate string
	// Delegates is Impersonate's delegation chain.
	Delegates []string
}

type Endpoint struct {
	Arg     string
	Env     string
	Default string
}

type ListScope struct {
	Project string
	// Location is the region or location the type's list is under, or ""
	// for a type listed per project ([TypeList.Location] is "").
	Location string
	// Collection is a derived type's list path with every variable filled
	// ([TypeList.Scope]), and Query its encoded query, if any. "" for a
	// hand-written type, whose path is filled from Project and Location;
	// for a derived type it is filled the same way when the path needs no
	// other variable.
	Collection string
	Query      string
}

type ListService struct {
	// Host is the service host Asset names carry: "pubsub.googleapis.com".
	Host string
	// Root is the service's REST root with its version, as hashicorp/google
	// 8.6.0's default base path spells it: "https://pubsub.googleapis.com/v1/".
	Root string
	// EndpointArg is the provider block's custom endpoint argument for the
	// service, and EndpointEnv the environment variable the provider reads
	// when the block leaves it unset. The value replaces Root, version
	// included, as the provider reads it; floci-gcp sets it.
	EndpointArg string
	EndpointEnv string
	// Items is the list response's field holding the objects. "" is AIP-132's:
	// the collection's own name ("topics"). Compute Engine and Cloud Storage
	// use "items".
	Items string
	// Consistency is Google's statement of the list's consistency, when it
	// publishes one.
	Consistency string
}

type PartialError struct {
	Project string
	// PagesRead is how many pages arrived before the failure, and
	// ResultsRead how many results they held, for a log line; the results
	// themselves are gone.
	PagesRead   int
	ResultsRead int
	Err         error
}

type PermissionDeniedError struct {
	Project    string
	Permission string
	// Credentials is what the client authenticated with.
	Credentials Credentials
	Err         error
}

type ProjectResult struct {
	Project string
	Assets  []Asset
	Err     error
}

type ProviderScope struct {
	Project string
	Region  string
	Zone    string
}

type Searcher interface {
	// Search returns every resource in project carrying the label
	// tofu-estate=estate, all pages read, or an error and no resources.
	Search(ctx context.Context, project, estate string) ([]Asset, error)
}

type ServiceDisabledError struct {
	// Project is the project the search was for.
	Project string
	// Service is the disabled service the error names, normally [Service].
	Service string
	// ActivationURL is the console link the error's own metadata gives for
	// enabling it, or "" when it gave none.
	ActivationURL string
	// Err is the API's own error.
	Err error
}

type TypeList struct {
	// Type is the google resource type: "google_vertex_ai_index_endpoint".
	Type string
	// Service is the API the list is made on, which is what the project has
	// to have enabled: "aiplatform.googleapis.com".
	Service string
	// AssetType is the Cloud Asset type the same object is indexed as,
	// which a listed [Asset] carries so that it reads like a search hit:
	// "aiplatform.googleapis.com/IndexEndpoint".
	AssetType string
	// Location is the resource argument the type's location comes from
	// ("region" or "location"), or "" for a type listed per project.
	// FixedLocation is the location of a type the API lists under one
	// location only ("global").
	Location      string
	FixedLocation string
	// Path is the list path under the service's base URL, in the
	// provider's ReplaceVars syntax: "projects/{{project}}/locations/{{location}}/indexEndpoints".
	// {{location}} stands for the location whatever the argument is called.
	Path string
	// Field is the list response's array field: "indexEndpoints".
	Field string
	// Filter is whether the list method takes an AIP-160 filter, so the
	// label test is also made server side. The test is always made again
	// on what comes back.
	Filter bool
	// Permission is the IAM permission the list needs.
	Permission string
	// Endpoint is the provider's base path for the type's product.
	Endpoint Endpoint

	// Derived is set for a type listed by the rule in servicelist.go (its
	// Asset name's parent collection, at a service in [Services]) rather
	// than by a row of [typeLists]. Asset is its Asset name template, Query
	// any query parameters its list takes (Cloud Storage's project), and
	// Consistency Google's statement of the list's consistency, if any.
	Derived     bool
	Asset       string
	Query       map[string]string
	Consistency string

	// For a type with no Asset name (handwrittenlist.go): AssetHost is the
	// host its documented Asset name carries when that is not Service
	// (Cloud SQL's is cloudsql.googleapis.com), NameByLocation names each
	// listed object from its own location field (GKE, listed at
	// locations/-), and Import is its import ID's shape, the type's
	// ImportSyntax in pkg/identity.
	AssetHost      string
	NameByLocation bool
	Import         string
}

type TypeLister interface {
	// ListType returns every object of typeName at scope whose tofu-estate
	// label is exactly estate, with the same typed errors as
	// [Searcher.Search]. A type [Covered] does not name is an error.
	ListType(ctx context.Context, typeName string, scope ListScope, estate string) ([]Asset, error)
}

type UncoveredProjectError struct {
	Project string
}