admin

type Authorizer func(r *http.Request) bool

type Handler interface {
	ServeHTTP(w http.ResponseWriter, r *http.Request)
}

type ManagementApplication struct {
	Name          string               `json:"name"`
	EndpointCount int                  `json:"endpoint_count"`
	Endpoints     []ManagementEndpoint `json:"endpoints"`
}

type ManagementEndpoint struct {
	Name          string                          `json:"name"`
	Route         string                          `json:"route"`
	Mode          string                          `json:"mode"`
	Targets       []string                        `json:"targets"`
	PublishPolicy ManagementEndpointPublishPolicy `json:"publish_policy"`
}

type ManagementEndpointDeleteRequest struct {
	Application  string
	EndpointName string
	Reason       string
	Actor        string
	RequestID    string
}

type ManagementEndpointMutationResult struct {
	Applied bool
	Action  string
	Route   string

	// PostWriteValidate is called after the config file is written but before
	// reload. If non-nil and it returns an error, the file write is rolled back.
	// Used to re-check invariants (e.g. backlog emptiness) after config mutation.
	PostWriteValidate func() error `json:"-"`
}

type ManagementEndpointPublishPolicy struct {
	Enabled        bool `json:"enabled"`
	DirectEnabled  bool `json:"direct_enabled"`
	ManagedEnabled bool `json:"managed_enabled"`
}

type ManagementEndpointUpsertRequest struct {
	Application  string
	EndpointName string
	Route        string
	Reason       string
	Actor        string
	RequestID    string
}

type ManagementModel struct {
	RouteCount       int                     `json:"route_count"`
	ApplicationCount int                     `json:"application_count"`
	EndpointCount    int                     `json:"endpoint_count"`
	Applications     []ManagementApplication `json:"applications"`
}

type ManagementMutationAuditEvent struct {
	At           time.Time
	Operation    string
	Application  string
	EndpointName string
	Route        string
	Target       string
	State        string
	Limit        int
	PreviewOnly  bool
	Matched      int
	Changed      int
	Reason       string
	Actor        string
	RequestID    string
}

type ManagementMutationError struct {
	// contains filtered or unexported fields
}

type PublishResultEvent struct {
	Accepted int
	Rejected int
	Code     string
	Scoped   bool
}

type PullConsumer struct {
	ID            string    `json:"id"`
	Route         string    `json:"route"`
	ConsumerGroup string    `json:"consumer_group,omitempty"`
	Endpoint      string    `json:"endpoint"`
	RemoteAddr    string    `json:"remote_addr"`
	UserAgent     string    `json:"user_agent,omitempty"`
	TokenRef      string    `json:"token_ref,omitempty"`
	ConnectedAt   time.Time `json:"connected_at"`
	MessagesSent  int64     `json:"messages_sent"`
	LastMessageAt time.Time `json:"last_message_at,omitzero"`
}

type SecretLookup func(name string) (SecretPool, bool)

type SecretMutationAuditEvent struct {
	At        time.Time
	Operation string // "add" or "delete"
	PoolName  string
	SecretID  string
	NotBefore time.Time
	NotAfter  time.Time
	Reason    string
	Actor     string
	RequestID string
}

type SecretPool interface {
	Name() string
	Runtime() bool
	// Add inserts a new version into the pool. Implementations must return
	// errors matching ErrSecret{Duplicate,PoolFull,Invalid} so the handler can
	// map them to HTTP responses.
	Add(id string, value []byte, notBefore, notAfter time.Time) error
	Remove(id string) (removed bool)
	ListMetadata() []SecretVersionMetadata
}

type SecretRecord struct {
	PoolName  string
	ID        string
	Sealed    []byte
	NotBefore time.Time
	NotAfter  time.Time
	CreatedAt time.Time
}

type SecretVersionMetadata struct {
	ID        string    `json:"id"`
	NotBefore time.Time `json:"not_before"`
	NotAfter  time.Time `json:"not_after,omitempty"`
}

type Server struct {
	Store                              queue.Store
	Authorize                          Authorizer
	HealthDiagnostics                  func() map[string]any
	ResolveTrendSignalConfig           func() queue.BacklogTrendSignalConfig
	ResolveManaged                     func(application, endpointName string) (route string, targets []string, ok bool)
	ManagedRouteInfoForRoute           func(route string) (application, endpointName string, managed bool, available bool)
	ManagedRouteSet                    func() (routes map[string]struct{}, available bool)
	TargetsForRoute                    func(route string) []string
	ModeForRoute                       func(route string) string
	PublishEnabledForRoute             func(route string) bool
	PublishDirectEnabledForRoute       func(route string) bool
	PublishManagedEnabledForRoute      func(route string) bool
	LimitsForRoute                     func(route string) (maxBodyBytes int64, maxHeaderBytes int)
	ManagementModel                    func() ManagementModel
	PullConsumers                      func() []PullConsumer
	RequireManagementAuditReason       bool
	MaxBodyBytes                       int64
	MaxHeaderBytes                     int
	PublishGlobalDirectEnabled         bool
	PublishScopedManagedEnabled        bool
	PublishAllowPullRoutes             bool
	PublishAllowDeliverRoutes          bool
	PublishRequireAuditActor           bool
	PublishRequireAuditRequestID       bool
	PublishScopedManagedFailClosed     bool
	PublishScopedManagedActorAllowlist []string
	PublishScopedManagedActorPrefixes  []string
	AuditManagementMutation            func(event ManagementMutationAuditEvent)
	ObservePublishResult               func(event PublishResultEvent)
	UpsertManagedEndpoint              func(req ManagementEndpointUpsertRequest) (ManagementEndpointMutationResult, error)
	DeleteManagedEndpoint              func(req ManagementEndpointDeleteRequest) (ManagementEndpointMutationResult, error)

	// Runtime secret rotation (see handle_secrets.go).
	SecretLookup        SecretLookup
	PersistSecret       func(rec SecretRecord) error
	DeleteSecretRecord  func(poolName, id string) (bool, error)
	SealSecret          func(plain []byte) ([]byte, error)
	AuditSecretMutation func(event SecretMutationAuditEvent)
	// contains filtered or unexported fields
}