admin

type Authorizer func(r *http.Request) bool

type Handler interface {
	ServeHTTP(w http.ResponseWriter, r *http.Request)
}

type ManagementApplication struct {
	Name          string               `json:"name"`
	EndpointCount int                  `json:"endpoint_count"`
	Endpoints     []ManagementEndpoint `json:"endpoints"`
}

type ManagementEndpoint struct {
	Name          string                          `json:"name"`
	Route         string                          `json:"route"`
	Mode          string                          `json:"mode"`
	Targets       []string                        `json:"targets"`
	PublishPolicy ManagementEndpointPublishPolicy `json:"publish_policy"`
}

type ManagementEndpointDeleteRequest struct {
	Application  string
	EndpointName string
	Reason       string
	Actor        string
	RequestID    string
}

type ManagementEndpointMutationResult struct {
	Applied bool
	Action  string
	Route   string

	// PostWriteValidate is called after the config file is written but before
	// reload. If non-nil and it returns an error, the file write is rolled back.
	// Used to re-check invariants (e.g. backlog emptiness) after config mutation.
	PostWriteValidate func() error `json:"-"`
}

type ManagementEndpointPublishPolicy struct {
	Enabled        bool `json:"enabled"`
	DirectEnabled  bool `json:"direct_enabled"`
	ManagedEnabled bool `json:"managed_enabled"`
}

type ManagementEndpointUpsertRequest struct {
	Application  string
	EndpointName string
	Route        string
	Reason       string
	Actor        string
	RequestID    string
}

type ManagementModel struct {
	RouteCount       int                     `json:"route_count"`
	ApplicationCount int                     `json:"application_count"`
	EndpointCount    int                     `json:"endpoint_count"`
	Applications     []ManagementApplication `json:"applications"`
}

type ManagementMutationAuditEvent struct {
	At           time.Time
	Operation    string
	Application  string
	EndpointName string
	Route        string
	Target       string
	State        string
	Limit        int
	PreviewOnly  bool
	Matched      int
	Changed      int
	Reason       string
	Actor        string
	RequestID    string
}

type ManagementMutationError struct {
	// contains filtered or unexported fields
}

type PublishResultEvent struct {
	Accepted int
	Rejected int
	Code     string
	Scoped   bool
}

type SecretLookup func(name string) (SecretPool, bool)

type SecretMutationAuditEvent struct {
	At        time.Time
	Operation string // "add" or "delete"
	PoolName  string
	SecretID  string
	NotBefore time.Time
	NotAfter  time.Time
	Reason    string
	Actor     string
	RequestID string
}

type SecretPool interface {
	Name() string
	Runtime() bool
	// Add inserts a new version into the pool. Implementations must return
	// errors matching ErrSecret{Duplicate,PoolFull,Invalid} so the handler can
	// map them to HTTP responses.
	Add(id string, value []byte, notBefore, notAfter time.Time) error
	Remove(id string) (removed bool)
	ListMetadata() []SecretVersionMetadata
}

type SecretRecord struct {
	PoolName  string
	ID        string
	Sealed    []byte
	NotBefore time.Time
	NotAfter  time.Time
	CreatedAt time.Time
}

type SecretVersionMetadata struct {
	ID        string    `json:"id"`
	NotBefore time.Time `json:"not_before"`
	NotAfter  time.Time `json:"not_after,omitempty"`
}

type Server struct {
	Store                              queue.Store
	Authorize                          Authorizer
	HealthDiagnostics                  func() map[string]any
	ResolveTrendSignalConfig           func() queue.BacklogTrendSignalConfig
	ResolveManaged                     func(application, endpointName string) (route string, targets []string, ok bool)
	ManagedRouteInfoForRoute           func(route string) (application, endpointName string, managed bool, available bool)
	ManagedRouteSet                    func() (routes map[string]struct{}, available bool)
	TargetsForRoute                    func(route string) []string
	ModeForRoute                       func(route string) string
	PublishEnabledForRoute             func(route string) bool
	PublishDirectEnabledForRoute       func(route string) bool
	PublishManagedEnabledForRoute      func(route string) bool
	LimitsForRoute                     func(route string) (maxBodyBytes int64, maxHeaderBytes int)
	ManagementModel                    func() ManagementModel
	RequireManagementAuditReason       bool
	MaxBodyBytes                       int64
	MaxHeaderBytes                     int
	PublishGlobalDirectEnabled         bool
	PublishScopedManagedEnabled        bool
	PublishAllowPullRoutes             bool
	PublishAllowDeliverRoutes          bool
	PublishRequireAuditActor           bool
	PublishRequireAuditRequestID       bool
	PublishScopedManagedFailClosed     bool
	PublishScopedManagedActorAllowlist []string
	PublishScopedManagedActorPrefixes  []string
	AuditManagementMutation            func(event ManagementMutationAuditEvent)
	ObservePublishResult               func(event PublishResultEvent)
	UpsertManagedEndpoint              func(req ManagementEndpointUpsertRequest) (ManagementEndpointMutationResult, error)
	DeleteManagedEndpoint              func(req ManagementEndpointDeleteRequest) (ManagementEndpointMutationResult, error)

	// Runtime secret rotation (see handle_secrets.go).
	SecretLookup        SecretLookup
	PersistSecret       func(rec SecretRecord) error
	DeleteSecretRecord  func(poolName, id string) (bool, error)
	SealSecret          func(plain []byte) ([]byte, error)
	AuditSecretMutation func(event SecretMutationAuditEvent)
	// contains filtered or unexported fields
}