usermodel

type Permission struct {
	Metadata PermissionMetadata
	Spec     PermissionSpec
	Status   PermissionStatus
}

type PermissionMetadata struct {
	UID       uuid.UUID
	CreatedAt time.Time
	UpdatedAt time.Time
	DeletedAt *time.Time
}

type PermissionSpec struct {
	Name        string // e.g., "agent:read", "agent:write"
	Description string
	Resource    string // e.g., "agent", "agentgroup", "certificate"
	Action      string // e.g., "read", "write", "delete", "execute"
	IsBuiltIn   bool
}

type PermissionStatus struct {
	Conditions []model.Condition
}

type RBACPolicy struct {
	Metadata RBACPolicyMetadata
	Spec     RBACPolicySpec
	Status   RBACPolicyStatus
}

type RBACPolicyMetadata struct {
	UID       uuid.UUID
	CreatedAt time.Time
	UpdatedAt time.Time
	DeletedAt *time.Time
}

type RBACPolicySpec struct {
	PolicyType string     // "p" (policy) or "g" (grouping/role inheritance)
	Rules      [][]string // Casbin policy rules, e.g., []{"admin", "agent", "write"}
}

type RBACPolicyStatus struct {
	Conditions   []model.Condition
	LastSyncedAt time.Time
}

type Role struct {
	Metadata RoleMetadata
	Spec     RoleSpec
	Status   RoleStatus
}

type RoleBinding struct {
	Metadata RoleBindingMetadata
	Spec     RoleBindingSpec
	Status   RoleBindingStatus
}

type RoleBindingMetadata struct {
	Namespace string
	Name      string
	CreatedAt time.Time
	UpdatedAt time.Time
	DeletedAt *time.Time
}

type RoleBindingSpec struct {
	RoleRef       RoleRef
	LabelSelector map[string]string
}

type RoleBindingStatus struct {
	Conditions []model.Condition
}

type RoleMetadata struct {
	UID       uuid.UUID
	CreatedAt time.Time
	UpdatedAt time.Time
	DeletedAt *time.Time
}

type RoleRef struct {
	Kind string
	Name string
}

type RoleSpec struct {
	DisplayName string
	Description string
	Permissions []string // Permission names (e.g., "agent:read")
	IsBuiltIn   bool
}

type RoleStatus struct {
	Conditions []model.Condition
}

type User struct {
	Metadata UserMetadata
	Spec     UserSpec
	Status   UserStatus
}

type UserIdentity struct {
	Provider       string // e.g., "github", "google", "ldap", "basic"
	ProviderUserID string // unique ID from the external provider
	Email          string // email from this provider (may differ per provider)
	DisplayName    string // display name from this provider
}

type UserMetadata struct {
	UID       uuid.UUID
	CreatedAt time.Time
	UpdatedAt time.Time
	DeletedAt *time.Time
	Labels    map[string]string // arbitrary key/value pairs; used for label-selector based role bindings
}

type UserRole struct {
	Metadata UserRoleMetadata
	Spec     UserRoleSpec
	Status   UserRoleStatus
}

type UserRoleMetadata struct {
	UID       uuid.UUID
	CreatedAt time.Time
	UpdatedAt time.Time
	DeletedAt *time.Time
}

type UserRoleSpec struct {
	UserID     uuid.UUID
	RoleID     uuid.UUID
	Namespace  string // Namespace scope. "*" = all namespaces, otherwise a specific namespace name.
	AssignedAt time.Time
	AssignedBy uuid.UUID // User who assigned the role
}

type UserRoleStatus struct {
	Conditions []model.Condition
}

type UserSpec struct {
	Email      string
	Username   string
	IsActive   bool
	Identities []UserIdentity
}

type UserStatus struct {
	Conditions []model.Condition
	Roles      []string // Role IDs
}