core

type ActionCapability struct {
	Allowed []*CapabilityResource `json:"allowed"`
	Denied  []*CapabilityResource `json:"denied"`
}

type BatchEvaluateRequest struct {
	Requests []EvaluateRequest `json:"requests"`
}

type BatchEvaluateResponse struct {
	Decisions []Decision `json:"decisions"`
}

type CapabilityResource struct {
	Path        string       `json:"path"`        // Full resource path: "org/acme/project/payment"
	Constraints *interface{} `json:"constraints"` // represents additional instance level restrictions

}

type ConfigurableDetector struct {
	// contains filtered or unexported fields
}

type Context struct {
}

type Decision struct {
	Decision bool             `json:"decision"`
	Context  *DecisionContext `json:"context,omitempty"`
}

type DecisionContext struct {
	Reason string `json:"reason,omitempty"`
}

type Detector interface {
	// DetectUserType analyzes a JWT token and returns the SubjectContext
	DetectUserType(jwtToken string) (*SubjectContext, error)
}

type Entitlement struct {
	// Claim is the JWT claim name (e.g., "group", "sub")
	Claim string `json:"claim"`

	// Value is the entitlement value (e.g., "admin-group", "service-123")
	Value string `json:"value"`
}

type EntitlementClaimInfo struct {
	// Name is the JWT claim name (e.g., "group", "sub")
	Name string `json:"name"`

	// DisplayName is a human-readable name for the claim
	DisplayName string `json:"display_name"`
}

type EntitlementConfig struct {
	Claim       string `yaml:"claim"`        // JWT claim for detection and entitlement
	DisplayName string `yaml:"display_name"` // Human-readable name for the claim
}

type EvaluateRequest struct {
	Subject  Subject  `json:"subject"`
	Resource Resource `json:"resource"`
	Action   string   `json:"action"`
	Context  Context  `json:"context"`
}

type PAP interface {
	// AddRole creates a new role with the specified name and actions
	AddRole(ctx context.Context, role *Role) error

	// RemoveRole deletes a role by name
	RemoveRole(ctx context.Context, roleName string) error

	// GetRole retrieves a role by name
	GetRole(ctx context.Context, roleName string) (*Role, error)

	// ListRoles returns all defined roles
	ListRoles(ctx context.Context) ([]*Role, error)

	// AddRoleEntitlementMapping creates a new role-entitlement mapping with optional conditions
	AddRoleEntitlementMapping(ctx context.Context, mapping *RoleEntitlementMapping) error

	// RemoveRoleEntitlementMapping removes a role-entitlement mapping
	RemoveRoleEntitlementMapping(ctx context.Context, mappingID uint) error

	// GetRoleMappings retrieves all entitlement mappings for a specific role
	GetRoleMappings(ctx context.Context, roleName string) ([]*RoleEntitlementMapping, error)

	// ListRoleEntitlementMappings lists all role-entitlement mappings
	ListRoleEntitlementMappings(ctx context.Context) ([]*RoleEntitlementMapping, error)

	// ListActions lists all defined actions in the system
	ListActions(ctx context.Context) ([]string, error)

	// ListUserTypes returns all configured user types in the system
	ListUserTypes(ctx context.Context) ([]UserTypeInfo, error)
}

type PDP interface {
	// Evaluate evaluates a single authorization request and returns a decision
	Evaluate(ctx context.Context, request *EvaluateRequest) (*Decision, error)

	// BatchEvaluate evaluates multiple authorization requests and returns corresponding decisions
	BatchEvaluate(ctx context.Context, request *BatchEvaluateRequest) (*BatchEvaluateResponse, error)

	// GetSubjectProfile retrieves the authorization profile for a given subject
	GetSubjectProfile(ctx context.Context, request *ProfileRequest) (*UserCapabilitiesResponse, error)
}

type PolicyEffectType string

type ProfileRequest struct {
	// Subject is the actor whose profile is being requested
	Subject Subject `json:"subject"`

	// Scope is the resource hierarchy scope for the profile
	Scope ResourceHierarchy `json:"scope"`
}

type Resource struct {
	Type      string            `json:"type"`
	ID        string            `json:"id,omitempty"`
	Hierarchy ResourceHierarchy `json:"hierarchy"`
}

type ResourceHierarchy struct {
	Organization      string   `json:"organization,omitempty"`
	OrganizationUnits []string `json:"organization_units,omitempty"`
	Project           string   `json:"project,omitempty"`
	Component         string   `json:"component,omitempty"`
}

type Role struct {
	// Name is the unique identifier for the role
	Name string `json:"name"`

	// Actions is the list of actions this role permits
	Actions []string `json:"actions"`

	// IsInternal indicates if this role should be hidden from public listings
	IsInternal bool `json:"-"`
}

type RoleEntitlementMapping struct {
	// ID is the unique identifier for the mapping
	ID uint `json:"id"`

	// RoleName is the name of the role being assigned
	RoleName string `json:"role_name"`

	// Entitlement contains the claim and value for this mapping
	Entitlement Entitlement `json:"entitlement"`

	// Hierarchy defines the resource hierarchy scope where this role applies
	Hierarchy ResourceHierarchy `json:"hierarchy"`

	// Effect indicates whether the mapping is to allow or deny access
	Effect PolicyEffectType `json:"effect"`

	// Context provides optional additional context metadata for this mapping
	Context Context `json:"context"`

	// IsInternal indicates if this mapping should be hidden from public listings
	IsInternal bool `json:"-"`
}

type Subject struct {
	JwtToken string `json:"jwt_token"`
}

type SubjectContext struct {
	Type              SubjectType
	EntitlementClaim  string
	EntitlementValues []string
}

type SubjectType string

type UserCapabilitiesResponse struct {
	User         *SubjectContext              `json:"user"`
	Capabilities map[string]*ActionCapability `json:"capabilities"`
	GeneratedAt  time.Time                    `json:"evaluatedAt"`
}

type UserTypeConfig struct {
	Type        SubjectType       `yaml:"type"`         // "user" or "service_account"
	DisplayName string            `yaml:"display_name"` // Human-readable name for user type
	Priority    int               `yaml:"priority"`     // Check order (lower = higher priority)
	Entitlement EntitlementConfig `yaml:"entitlement"`  // Entitlement configuration
}

type UserTypeInfo struct {
	// Type is the user type (e.g., "user", "service_account")
	Type SubjectType `json:"type"`

	// DisplayName is a human-readable name for the user type
	DisplayName string `json:"display_name"`

	// Priority determines the order in which user types are checked (lower = higher priority)
	Priority int `json:"priority"`

	// Entitlement contains information about the entitlement claim
	Entitlement EntitlementClaimInfo `json:"entitlement"`
}