githubpolicy

type Cache struct {
	// contains filtered or unexported fields
}

type Evaluation struct {
	Request      Request
	Result       string // "allow" | "deny"
	ReasonCode   string
	Reason       string
	MatchedRules []MatchedRule
	// DecidingRuleID is the rule that determined the outcome: the first
	// matching deny, or the org-layer allow that anchored an allow. Empty
	// when a layer vetoed by silence.
	DecidingRuleID string
	Mode           string
	Epoch          int
	Hash           string
	// Stale is true when the snapshot used was not confirmed by the cloud on
	// the most recent refresh attempt.
	Stale bool
	// SubjectsResolved is false when no Kontext user/application identity was
	// available, so user/agent-layer rules could not match their subject.
	SubjectsResolved bool
}

type GitContext struct {
	Branch       string
	RemoteByName map[string]string
}

type MatchedRule struct {
	ID      string `json:"id"`
	Layer   string `json:"layer"`
	Effect  string `json:"effect"`
	Decided bool   `json:"decided,omitempty"`
}

type ProviderAction struct {
	// Action is the canonical action name, e.g. "github.pr.write".
	Action string
	// Resource is the repository slug "owner/repo" when derivable.
	Resource string
	// BranchOrRef is the branch or ref when derivable (push refspecs,
	// fetch/pull positionals, current branch fallback).
	BranchOrRef string
}

type Request struct {
	Action        string
	Resource      string
	BranchOrRef   string
	UserID        string
	ApplicationID string
	EndpointID    string
}

type Rule struct {
	ID    string `json:"id"`
	Layer string `json:"layer"`
	// SubjectID is the org id, kontext user id, application id, or endpoint
	// installation id depending on Layer.
	SubjectID string `json:"subjectId"`
	// ResourceID is a repository slug "owner/repo", or nil for any repository.
	ResourceID *string `json:"resourceId"`
	// ActionName is a canonical action name (e.g. "github.pr.write"), or nil
	// for any action.
	ActionName *string `json:"actionName"`
	// BranchOrRef is a branch or ref constraint, or nil for any branch.
	BranchOrRef *string `json:"branchOrRef"`
	Effect      string  `json:"effect"`
	// Specificity is a diagnostic hint the cloud computes for display/sorting.
	// The evaluator does not read it: it derives precedence from the rule's
	// own dimensions and layer (see Evaluate — most-specific-wins).
	Specificity int `json:"specificity"`
}

type Snapshot struct {
	SchemaVersion  string `json:"schemaVersion"`
	OrganizationID string `json:"organizationId"`
	// ProviderID is the GitHub provider id, or nil when the org has no GitHub
	// provider configured.
	ProviderID  *string `json:"providerId"`
	ProviderKey string  `json:"providerKey"`
	Mode        string  `json:"mode"`
	// Epoch is the active policy epoch; 0 when the org has no active policy.
	Epoch int `json:"epoch"`
	// Hash is a stable content hash over {epoch, rules}, independent of
	// GeneratedAt, so an unchanged policy keeps an unchanged hash.
	Hash        string `json:"hash"`
	Rules       []Rule `json:"rules"`
	GeneratedAt string `json:"generatedAt"`
}

type SnapshotProvider interface {
	CurrentSnapshot() (Snapshot, Status, bool)
}

type Status struct {
	// FetchedAt is when the cached snapshot was last confirmed by the cloud
	// (fetch succeeded, whether or not the hash changed).
	FetchedAt time.Time `json:"fetched_at"`
	// Stale is true when the most recent fetch attempt failed and the cache
	// is serving the last known snapshot.
	Stale bool `json:"stale"`
	// LastError holds the most recent fetch failure, if any.
	LastError string `json:"last_error,omitempty"`
}