domain

type AdvanceRecoveryPointParams struct {
	ID            string
	RecoveryPoint string
	StepData      json.RawMessage
}

type AuditActor struct {
	ID           string
	ActorType    constants.ActorType
	Type         string
	IdentityType string
	Name         *string
	Handle       *string
}

type AuditEvent struct {
	ID string

	ActorID      string
	ActorType    string
	IdentityType string
	AccountID    string
	// TargetAccountID is the account the audited mutation was performed against
	// (the OpenMRP-Account targeted by the originating request). Nullable until the backfill + non-null migration land.
	TargetAccountID *string

	Action       constants.AuditAction
	ResourceType constants.ObjectType
	ResourceID   string
	// RootResourceType / RootResourceID identify the root record this entity belongs to (e.g. the sales_order a line/pick/shipment/invoice hangs off of). Empty for top-level records. Backs the root-scoped history query.
	RootResourceType constants.ObjectType
	RootResourceID   string
	Changes          []AuditFieldChange
	Metadata         json.RawMessage

	ServiceName      string
	RequestID        *string
	IdempotencyKeyID *string
	SourceIP         *string

	OccurredAt time.Time
	CreatedAt  time.Time
}

type AuditEventRead struct {
	AuditEvent
	Actor *AuditActor
	// Target account details, resolved from target_account_id for the `account` sub-resource. Nil when the event has no target account (pre-backfill rows).
	AccountName      *string
	AccountCreatedAt *time.Time
	AccountUpdatedAt *time.Time
	IdempotencyKey   *string
}

type AuditEventRepo interface {
	Create(ctx context.Context, event *AuditEvent) *apierror.APIError
	FindByID(ctx context.Context, id, targetAccountID string, includes []string) (*AuditEventRead, *apierror.APIError)
	List(ctx context.Context, targetAccountID string, filter *ListAuditEventsFilter, includes []string) (*ListAuditEventsResult, *apierror.APIError)
	BatchGetResourceCreators(ctx context.Context, callerAccountID, resourceType string, resourceIDs []string) ([]ResourceCreator, *apierror.APIError)
	// ListResourceUserActorIDs returns the distinct user actors that have touched the resource's record tree (events on the resource itself or on children rooted at it). They form the follower set for resource-activity notifications.
	ListResourceUserActorIDs(ctx context.Context, accountID string, resourceType constants.ObjectType, resourceID string) ([]string, *apierror.APIError)
	// GetResourceCreateChanges returns the field changes recorded by the resource's create event (a snapshot of its audited fields at creation), or nil when no create event is on record.
	GetResourceCreateChanges(ctx context.Context, accountID string, resourceType constants.ObjectType, resourceID string) ([]AuditFieldChange, *apierror.APIError)
}

type AuditEventSvc interface {
	// SaveAuditEvent persists a single audit event. It is intended to be invoked by the platform-service's async consumer pipeline.
	SaveAuditEvent(ctx context.Context, event *AuditEvent) *apierror.APIError

	// GetAuditEvent returns a single audit event by ID, scoped to the caller's target account.
	GetAuditEvent(ctx context.Context, id string, includes []string) (*AuditEventRead, *apierror.APIError)

	// ListAuditEvents returns a filtered, cursor-paginated list of audit events scoped to the caller's target account.
	ListAuditEvents(ctx context.Context, filter *ListAuditEventsFilter, includes []string) (*ListAuditEventsResult, *apierror.APIError)

	// ListAuditEventResourceTypes returns the full set of resource types that may appear on audit events.
	ListAuditEventResourceTypes(ctx context.Context) ([]string, *apierror.APIError)

	// BatchGetResourceCreators returns the creating actor for a batch of resources, derived from each resource's `create` audit event, scoped to the caller's target account. Requires only an assigned actor (not the audit read permission) so it can back a `created_by` include.
	BatchGetResourceCreators(ctx context.Context, resourceType string, resourceIDs []string) ([]ResourceCreator, *apierror.APIError)
}

type AuditFieldChange struct {
	Field    string
	OldValue json.RawMessage
	NewValue json.RawMessage
}

type GetRecoveryPointResult struct {
	RecoveryPoint string
	StepData      json.RawMessage
}

type IdempotencyKey struct {
	ID              string
	InternalID      int64
	CreatedAt       time.Time
	UpdatedAt       time.Time
	IdempotencyKey  string
	LastRunAt       time.Time
	LockedAt        *time.Time
	LockOwner       *string
	LockExpiresAt   *time.Time
	RequestMethod   string
	RequestParams   json.RawMessage
	NormalizedRoute string
	ScopeHash       string
	RequestBodyHash string
	ResponseCode    *int
	ResponseBody    json.RawMessage
	ResponseHeaders json.RawMessage
	ActorID         *string
	TargetAccountID *string
	IdentityType    string
	OperationID     *int64
	ExpiresAt       *time.Time
	RecoveryPoint   string
	StepData        json.RawMessage
}

type IdempotencyKeyRepo interface {
	UpsertAndLock(ctx context.Context, key *IdempotencyKey) (*UpsertAndLockResult, *apierror.APIError)
	SetResponse(ctx context.Context, params SetResponseParams) *apierror.APIError
	ReleaseLock(ctx context.Context, id string) *apierror.APIError
	AdvanceRecoveryPoint(ctx context.Context, params AdvanceRecoveryPointParams) *apierror.APIError
	GetRecoveryPoint(ctx context.Context, id string) (*GetRecoveryPointResult, *apierror.APIError)
}

type ListAuditEventsFilter struct {
	StartDate     *time.Time
	EndDate       *time.Time
	ResourceTypes []string
	ResourceIDs   []string
	// RootResourceType / RootResourceID scope results to a root record's entire tree (e.g. all events whose root_resource is a given sales_order). Both must be set together to apply.
	RootResourceType string
	RootResourceID   string
	ActorIDs         []string
	ActorTypes       []string
	Actions          []string
	// ActorAccountIDs filters by audit_event.account_id: the account that performed the mutation. TargetAccountIDs filters by audit_event.target_account_id: the account the mutation targeted. Both narrow within the caller's actor-or-target security scope.
	ActorAccountIDs  []string
	TargetAccountIDs []string
	Query            *string
	Cursor           *string
	Limit            int32
}

type ListAuditEventsResult struct {
	AuditEvents []*AuditEventRead
	PageInfo    pagination.PageInfo
}

type ListRequestLogsFilter struct {
	Query             *string
	StartDate         *time.Time
	EndDate           *time.Time
	Methods           []string
	StatusCodes       []int32
	StatusCodeClasses []int32
	ErrorCodes        []string
	// ExcludeErrorCodes drops logs whose error_code is in this set (NOT IN), used to hide routine noise such as expired_token 401s.
	ExcludeErrorCodes []string
	// ActorAccountIDs filters by request_log.account_id: the account the actor belongs to. TargetAccountIDs filters by request_log.target_account_id: the account the request acted upon. Both narrow within the caller's actor-or-target security scope.
	ActorAccountIDs  []string
	TargetAccountIDs []string
	ActorIDs         []string
	ActorTypes       []string
	NormalizedRoutes []string
	Hosts            []string
	MinLatencyUs     *int64
	PublicEndpoint   *bool
	IdempotencyKey   *string
	Cursor           *string
	Limit            int32
}

type ListRequestLogsResult struct {
	RequestLogs []*RequestLogRead
	PageInfo    pagination.PageInfo
}

type LoggingSvc interface {
	// SaveRequestLog persists a request log entry.
	SaveRequestLog(ctx context.Context, rl *RequestLog) *apierror.APIError

	// GetRequestLog returns a single request log by ID, scoped to the caller's target account.
	GetRequestLog(ctx context.Context, id string, includes []string) (*RequestLogRead, *apierror.APIError)

	// ListRequestLogs returns a filtered, paginated list of request logs scoped to the caller's target account.
	ListRequestLogs(ctx context.Context, filter *ListRequestLogsFilter, includes []string) (*ListRequestLogsResult, *apierror.APIError)
}

type RepoFactory interface {
	NewRequestLogRepo() RequestLogRepo
	NewAuditEventRepo() AuditEventRepo
	NewOutboxRepo() messaging.OutboxRepo
}

type RequestLog struct {
	ID                   string
	Method               string
	Host                 string
	Path                 string
	NormalizedRoute      string
	QueryJSON            *string
	StatusCode           int32
	LatencyUs            int64
	AccountID            *string
	TargetAccountID      *string
	ClientIP             []byte
	ClientIPString       *string
	UserAgent            *string
	Referrer             *string
	ErrorCode            *string
	ErrorMessage         *string
	CreatedAt            time.Time
	OccurredAt           time.Time
	IdempotencyKeyTypeID *string
	ActorID              *string
	ActorType            *string
	InternalErrorMessage *string
	StackTrace           *string
	IdentityType         *string
	APIVersion           *string
	TraceID              *string
	PublicEndpoint       bool
	Hidden               bool
	BodyJSON             *string
	ResponseJSON         *string
}

type RequestLogActor struct {
	ID            string
	ActorType     constants.ActorType
	Name          *string
	Email         *string
	RedactedValue *string
	RoleID        *string
	RoleName      *string
	RoleType      *string
}

type RequestLogRead struct {
	ID               string
	Method           string
	Host             string
	Path             string
	NormalizedRoute  string
	QueryJSON        *string
	StatusCode       int32
	LatencyUs        int64
	APIVersion       *string
	IdentityType     *string
	ClientIP         *string
	UserAgent        *string
	Referrer         *string
	ErrorCode        *string
	ErrorMessage     *string
	OccurredAt       time.Time
	CreatedAt        time.Time
	AccountID        *string
	AccountName      *string
	AccountCreatedAt *time.Time
	AccountUpdatedAt *time.Time
	Actor            *RequestLogActor
	IdempotencyKey   *string
	BodyJSON         *string
	ResponseJSON     *string
}

type RequestLogRepo interface {
	Create(ctx context.Context, requestLog *RequestLog) *apierror.APIError
	FindByID(ctx context.Context, id, targetAccountID string, includes []string) (*RequestLogRead, *apierror.APIError)
	List(ctx context.Context, targetAccountID string, filter *ListRequestLogsFilter, includes []string) (*ListRequestLogsResult, *apierror.APIError)
}

type ResourceCreator struct {
	ResourceID string
	Actor      *AuditActor
}

type SetResponseParams struct {
	ID            string
	StatusCode    int
	RecoveryPoint string
	Body          json.RawMessage
	Headers       json.RawMessage
	TTLSeconds    *int32
}

type UpsertAndLockResult struct {
	Key     *IdempotencyKey
	Created bool
	Locked  bool
}