core

type Action struct {
	Name string
	// LowestScope indicates the lowest resource hierarchy level at which this action is evaluated
	LowestScope ActionScope
	// IsInternal indicates if the action is internal (not publicly visible)
	IsInternal bool
}

type ActionCapability struct {
	Allowed []*CapabilityResource `json:"allowed"`
	Denied  []*CapabilityResource `json:"denied"`
}

type ActionScope string

type BatchEvaluateRequest struct {
	Requests []EvaluateRequest `json:"requests"`
}

type BatchEvaluateResponse struct {
	Decisions []Decision `json:"decisions"`
}

type CapabilityResource struct {
	Path        string       `json:"path"`        // Full resource path: "namespace/acme/project/payment"
	Constraints *interface{} `json:"constraints"` // represents additional instance level restrictions

}

type Context struct {
}

type Decision struct {
	Decision bool             `json:"decision"`
	Context  *DecisionContext `json:"context,omitempty"`
}

type DecisionContext struct {
	Reason string `json:"reason,omitempty"`
}

type Entitlement struct {
	// Claim is the JWT claim name (e.g., "group", "sub")
	Claim string `json:"claim" yaml:"claim"`

	// Value is the entitlement value (e.g., "admin-group", "service-123")
	Value string `json:"value" yaml:"value"`
}

type EvaluateRequest struct {
	SubjectContext *SubjectContext `json:"subject_context"`
	Resource       Resource        `json:"resource"`
	Action         string          `json:"action"`
	Context        Context         `json:"context"`
}

type PAP interface {
	// ListActions lists all public actions in the system
	ListActions(ctx context.Context) ([]Action, error)

	// CreateClusterRole creates a new cluster-scoped role and returns the full CRD object
	CreateClusterRole(ctx context.Context, role *openchoreov1alpha1.ClusterAuthzRole) (*openchoreov1alpha1.ClusterAuthzRole, error)
	// GetClusterRole retrieves a cluster-scoped role by name
	GetClusterRole(ctx context.Context, name string) (*openchoreov1alpha1.ClusterAuthzRole, error)
	// ListClusterRoles lists all cluster-scoped roles
	ListClusterRoles(ctx context.Context, limit int, cursor string) (*PaginatedList[openchoreov1alpha1.ClusterAuthzRole], error)
	// UpdateClusterRole updates a cluster-scoped role and returns the updated CRD object
	UpdateClusterRole(ctx context.Context, role *openchoreov1alpha1.ClusterAuthzRole) (*openchoreov1alpha1.ClusterAuthzRole, error)
	// DeleteClusterRole deletes a cluster-scoped role by name
	DeleteClusterRole(ctx context.Context, name string) error

	// CreateNamespacedRole creates a new namespace-scoped role and returns the full CRD object
	CreateNamespacedRole(ctx context.Context, role *openchoreov1alpha1.AuthzRole) (*openchoreov1alpha1.AuthzRole, error)
	// GetNamespacedRole retrieves a namespace-scoped role by name and namespace
	GetNamespacedRole(ctx context.Context, name string, namespace string) (*openchoreov1alpha1.AuthzRole, error)
	// ListNamespacedRoles lists namespace-scoped roles in the given namespace
	ListNamespacedRoles(ctx context.Context, namespace string, limit int, cursor string) (*PaginatedList[openchoreov1alpha1.AuthzRole], error)
	// UpdateNamespacedRole updates a namespace-scoped role and returns the updated CRD object
	UpdateNamespacedRole(ctx context.Context, role *openchoreov1alpha1.AuthzRole) (*openchoreov1alpha1.AuthzRole, error)
	// DeleteNamespacedRole deletes a namespace-scoped role by name and namespace
	DeleteNamespacedRole(ctx context.Context, name string, namespace string) error

	// CreateClusterRoleBinding creates a new cluster-scoped role binding and returns the full CRD object
	CreateClusterRoleBinding(ctx context.Context, binding *openchoreov1alpha1.ClusterAuthzRoleBinding) (*openchoreov1alpha1.ClusterAuthzRoleBinding, error)
	// GetClusterRoleBinding retrieves a cluster-scoped role binding by name
	GetClusterRoleBinding(ctx context.Context, name string) (*openchoreov1alpha1.ClusterAuthzRoleBinding, error)
	// ListClusterRoleBindings lists all cluster-scoped role bindings
	ListClusterRoleBindings(ctx context.Context, limit int, cursor string) (*PaginatedList[openchoreov1alpha1.ClusterAuthzRoleBinding], error)
	// UpdateClusterRoleBinding updates a cluster-scoped role binding and returns the updated CRD object
	UpdateClusterRoleBinding(ctx context.Context, binding *openchoreov1alpha1.ClusterAuthzRoleBinding) (*openchoreov1alpha1.ClusterAuthzRoleBinding, error)
	// DeleteClusterRoleBinding deletes a cluster-scoped role binding by name
	DeleteClusterRoleBinding(ctx context.Context, name string) error

	// CreateNamespacedRoleBinding creates a new namespace-scoped role binding and returns the full CRD object
	CreateNamespacedRoleBinding(ctx context.Context, binding *openchoreov1alpha1.AuthzRoleBinding) (*openchoreov1alpha1.AuthzRoleBinding, error)
	// GetNamespacedRoleBinding retrieves a namespace-scoped role binding by name and namespace
	GetNamespacedRoleBinding(ctx context.Context, name string, namespace string) (*openchoreov1alpha1.AuthzRoleBinding, error)
	// ListNamespacedRoleBindings lists namespace-scoped role bindings in the given namespace
	ListNamespacedRoleBindings(ctx context.Context, namespace string, limit int, cursor string) (*PaginatedList[openchoreov1alpha1.AuthzRoleBinding], error)
	// UpdateNamespacedRoleBinding updates a namespace-scoped role binding and returns the updated CRD object
	UpdateNamespacedRoleBinding(ctx context.Context, binding *openchoreov1alpha1.AuthzRoleBinding) (*openchoreov1alpha1.AuthzRoleBinding, error)
	// DeleteNamespacedRoleBinding deletes a namespace-scoped role binding by name and namespace
	DeleteNamespacedRoleBinding(ctx context.Context, name string, namespace string) error
}

type PDP interface {
	// Evaluate evaluates a single authorization request and returns a decision
	Evaluate(ctx context.Context, request *EvaluateRequest) (*Decision, error)

	// BatchEvaluate evaluates multiple authorization requests and returns corresponding decisions
	BatchEvaluate(ctx context.Context, request *BatchEvaluateRequest) (*BatchEvaluateResponse, error)

	// GetSubjectProfile retrieves the authorization profile for a given subject
	GetSubjectProfile(ctx context.Context, request *ProfileRequest) (*UserCapabilitiesResponse, error)
}

type PaginatedList[T any] struct {
	Items      []T
	NextCursor string
}

type PolicyEffectType string

type ProfileRequest struct {
	// SubjectContext is the authenticated subject whose profile is being requested
	SubjectContext *SubjectContext `json:"subject_context"`

	// Scope is the resource hierarchy scope for the profile
	Scope ResourceHierarchy `json:"scope"`
}

type Resource struct {
	Type      string            `json:"type"`
	ID        string            `json:"id,omitempty"`
	Hierarchy ResourceHierarchy `json:"hierarchy"`
}

type ResourceHierarchy struct {
	Namespace string `json:"namespace,omitempty"`
	Project   string `json:"project,omitempty"`
	Component string `json:"component,omitempty"`
}

type RoleRef struct {
	// Name is the role name
	Name string `json:"name" yaml:"name"`

	// Namespace identifies the role scope:
	// - Empty string ("") = cluster-scoped role
	// - Non-empty = namespace-scoped role in the specified namespace
	Namespace string `json:"namespace,omitempty" yaml:"namespace"`
}

type SubjectContext struct {
	Type              string   `json:"type"`
	EntitlementClaim  string   `json:"entitlement_claim"`
	EntitlementValues []string `json:"entitlement_values"`
}

type UserCapabilitiesResponse struct {
	User         *SubjectContext              `json:"user"`
	Capabilities map[string]*ActionCapability `json:"capabilities"`
	GeneratedAt  time.Time                    `json:"evaluatedAt"`
}