usermodel

type ExternalIdentity struct {
	Provider       string
	ProviderUserID string
	Email          string
	DisplayName    string
	AvatarURL      string
	Groups         []string          // org/team memberships from provider (e.g., GitHub orgs)
	RawAttributes  map[string]string // provider-specific metadata
}

type OrgRoleMapping struct {
	Metadata OrgRoleMappingMetadata
	Spec     OrgRoleMappingSpec
}

type OrgRoleMappingMetadata struct {
	UID       uuid.UUID
	CreatedAt time.Time
	UpdatedAt time.Time
	DeletedAt *time.Time
}

type OrgRoleMappingSpec struct {
	Provider     string // e.g., "github", "google"
	Organization string // e.g., "my-github-org"
	Team         string // optional: e.g., "platform-team" (empty means entire org)
	RoleID       uuid.UUID
}

type Permission struct {
	Metadata PermissionMetadata
	Spec     PermissionSpec
	Status   PermissionStatus
}

type PermissionMetadata struct {
	UID       uuid.UUID
	CreatedAt time.Time
	UpdatedAt time.Time
	DeletedAt *time.Time
}

type PermissionSpec struct {
	Name        string // e.g., "agent:read", "agent:write"
	Description string
	Resource    string // e.g., "agent", "agentgroup", "certificate"
	Action      string // e.g., "read", "write", "delete", "execute"
	IsBuiltIn   bool
}

type PermissionStatus struct {
	Conditions []model.Condition
}

type RBACPolicy struct {
	Metadata RBACPolicyMetadata
	Spec     RBACPolicySpec
	Status   RBACPolicyStatus
}

type RBACPolicyMetadata struct {
	UID       uuid.UUID
	CreatedAt time.Time
	UpdatedAt time.Time
	DeletedAt *time.Time
}

type RBACPolicySpec struct {
	PolicyType string     // "p" (policy) or "g" (grouping/role inheritance)
	Rules      [][]string // Casbin policy rules, e.g., []{"admin", "agent", "write"}
}

type RBACPolicyStatus struct {
	Conditions   []model.Condition
	LastSyncedAt time.Time
}

type Role struct {
	Metadata RoleMetadata
	Spec     RoleSpec
	Status   RoleStatus
}

type RoleBinding struct {
	Metadata RoleBindingMetadata
	Spec     RoleBindingSpec
	Status   RoleBindingStatus
}

type RoleBindingMetadata struct {
	Namespace string
	Name      string
	CreatedAt time.Time
	UpdatedAt time.Time
	DeletedAt *time.Time
}

type RoleBindingSpec struct {
	RoleRef RoleRef
	Subject Subject
}

type RoleBindingStatus struct {
	Conditions []model.Condition
}

type RoleMetadata struct {
	UID       uuid.UUID
	CreatedAt time.Time
	UpdatedAt time.Time
	DeletedAt *time.Time
}

type RoleRef struct {
	Kind string
	Name string
	UID  uuid.UUID
}

type RoleSpec struct {
	DisplayName string
	Description string
	Permissions []string // Permission names (e.g., "agent:read")
	IsBuiltIn   bool
}

type RoleStatus struct {
	Conditions []model.Condition
}

type Subject struct {
	Kind string
	Name string
	UID  uuid.UUID
}

type User struct {
	Metadata UserMetadata
	Spec     UserSpec
	Status   UserStatus
}

type UserIdentity struct {
	Provider       string // e.g., "github", "google", "ldap", "basic"
	ProviderUserID string // unique ID from the external provider
	Email          string // email from this provider (may differ per provider)
	DisplayName    string // display name from this provider
}

type UserMetadata struct {
	UID       uuid.UUID
	CreatedAt time.Time
	UpdatedAt time.Time
	DeletedAt *time.Time
}

type UserRole struct {
	Metadata UserRoleMetadata
	Spec     UserRoleSpec
	Status   UserRoleStatus
}

type UserRoleMetadata struct {
	UID       uuid.UUID
	CreatedAt time.Time
	UpdatedAt time.Time
	DeletedAt *time.Time
}

type UserRoleSpec struct {
	UserID     uuid.UUID
	RoleID     uuid.UUID
	Namespace  string // Namespace scope. "*" = all namespaces, otherwise a specific namespace name.
	AssignedAt time.Time
	AssignedBy uuid.UUID // User who assigned the role
}

type UserRoleStatus struct {
	Conditions []model.Condition
}

type UserSpec struct {
	Email      string
	Username   string
	IsActive   bool
	Identities []UserIdentity
}

type UserStatus struct {
	Conditions []model.Condition
	Roles      []string // Role IDs
}