secretstore

type APIKeyData struct {
	Key string `json:"key"`
}

type AWSRoleData struct {
	RoleARN    string `json:"role_arn"`
	ExternalID string `json:"external_id,omitempty"`
}

type AzureServicePrincipalData struct {
	TenantID     string `json:"tenant_id"`
	ClientID     string `json:"client_id"`
	ClientSecret string `json:"client_secret"`
}

type BasicAuthData struct {
	Username string `json:"username"`
	Password string `json:"password"`
}

type BearerTokenData struct {
	Token string `json:"token"`
}

type Credential struct {
	ID             shared.ID
	TenantID       shared.ID
	Name           string
	CredentialType CredentialType
	Description    string

	// Encrypted credential data (AES-256-GCM encrypted JSON)
	EncryptedData []byte

	// Key management
	KeyVersion          int
	EncryptionAlgorithm string

	// Metadata
	LastUsedAt    *time.Time
	LastRotatedAt *time.Time
	ExpiresAt     *time.Time

	// Audit fields
	CreatedBy *shared.ID
	CreatedAt time.Time
	UpdatedAt time.Time
}

type CredentialType string

type Encryptor struct {
	// contains filtered or unexported fields
}

type GCPServiceAccountData struct {
	JSONKey string `json:"json_key"`
}

type GitHubAppData struct {
	AppID          string `json:"app_id"`
	InstallationID string `json:"installation_id"`
	PrivateKey     string `json:"private_key"`
}

type GitLabTokenData struct {
	Token string `json:"token"`
}

type ListInput struct {
	TenantID       shared.ID
	CredentialType *CredentialType
	Page           int
	PageSize       int
	SortBy         string
	SortOrder      string
}

type ListOutput struct {
	Items      []*Credential
	TotalCount int
}

type Repository interface {
	// Create persists a new credential.
	Create(ctx context.Context, credential *Credential) error

	// GetByTenantAndID retrieves a credential by tenant and ID.
	// This is the primary method for fetching credentials as it enforces tenant isolation.
	GetByTenantAndID(ctx context.Context, tenantID, id shared.ID) (*Credential, error)

	// GetByTenantAndName retrieves a credential by tenant and name.
	GetByTenantAndName(ctx context.Context, tenantID shared.ID, name string) (*Credential, error)

	// List lists credentials with pagination and filtering.
	List(ctx context.Context, input ListInput) (*ListOutput, error)

	// Update updates a credential.
	// Note: Implementations should validate tenant ownership before updating.
	Update(ctx context.Context, credential *Credential) error

	// DeleteByTenantAndID deletes a credential with tenant validation.
	DeleteByTenantAndID(ctx context.Context, tenantID, id shared.ID) error

	// UpdateLastUsedByTenantAndID updates only the last_used_at field with tenant validation.
	UpdateLastUsedByTenantAndID(ctx context.Context, tenantID, id shared.ID) error

	// CountByTenant counts credentials for a tenant.
	CountByTenant(ctx context.Context, tenantID shared.ID) (int, error)
}

type SSHKeyData struct {
	PrivateKey string `json:"private_key"`
	Passphrase string `json:"passphrase,omitempty"`
}