controller

type AWSCredsInput struct {
	ClusterID         string
	ClusterName       string
	ClusterExternalID string
	IsCCS             bool
	AWSAccountID      string
	AccountCRName     string
	Account           *awsv1alpha1.Account
	AdminUsername     string
	AwsClient         awsprovider.Client
	HiveKubeClient    client.Client
	ManagedClient     client.Client
	Log               *logrus.Logger
	Out               io.Writer
}

type CredRequestStatus struct {
	CredRequestName string
	SecretName      string
	Namespace       string
	Age             time.Duration
	Exists          bool
	NeedsRecreation bool
	ErrorMessage    string
}

type DiagnosticReport struct {
	ClusterID         string
	ClusterName       string
	ClusterExternalID string
	IsCCS             bool
	AWSAccountID      string
	AccountCRName     string

	ManagedAdminUser string
	CcsAdminUser     string
	CallerARN        string
	CallerAccount    string

	Keys         []KeyStatus
	Secrets      []SecretStatus
	CredRequests []CredRequestStatus
	Permissions  []PermissionResult
	Findings     []Finding

	AllPermissionsOK bool
	AllSecretsInSync bool
	RootKeyInSync    bool
	ClusterRootKeyID string
	HiveAccountKeyID string
}

type Finding struct {
	Severity string // "OK", "WARN", "FAIL"
	Message  string
	Guidance string
}

type InsufficientPermissionsError struct {
	DeniedActions []string
}

type KeyStatus struct {
	UserName    string
	AccessKeyID string
	Age         time.Duration
	CreateDate  time.Time
	LastUsed    string
	Status      string
	HiveMatch   bool
}

type PermissionResult struct {
	Action      string
	Allowed     bool
	Category    string   // "rotation" or "credreq"
	RequestedBy []string // CR names that request this action (credreq category only)
}

type RotateSecretInput struct {
	// AccountCRName is the name of the Account CR.
	AccountCRName string

	// Account is the pre-fetched Account CR.
	Account *awsv1alpha1.Account

	// OsdManagedAdminUsername is an explicit admin username override.
	// If empty, it is derived from the Account CR's iamUserId label.
	OsdManagedAdminUsername string

	// UpdateManagedAdminCreds controls whether osdManagedAdmin credentials are rotated.
	UpdateManagedAdminCreds bool

	// UpdateCcsCreds controls whether osdCcsAdmin credentials are also rotated.
	UpdateCcsCreds bool

	// AwsClient is the fully-authenticated AWS client with permissions in the
	// target AWS account (after all role chaining has been completed).
	AwsClient awsprovider.Client

	// HiveKubeClient is the k8s client connected to the hive cluster.
	HiveKubeClient client.Client

	// ManagedClusterClient is the k8s client connected to the managed cluster
	// (via backplane using the target OCM environment). Used to delete
	// CredentialRequests so CCO recreates them with the new credentials.
	ManagedClusterClient client.Client

	// DryRun, when true, prints what actions would be taken without performing
	// any mutating operations (no AWS key creation/deletion, no k8s resource
	// creation/deletion/updates).
	DryRun bool

	// Report is the pre-computed diagnostic report from the snapshot phase.
	// Used to display key/secret context during interactive key deletion.
	Report *DiagnosticReport

	// Log is the logger for operational messages (writes to stderr).
	Log *logrus.Logger

	// SkipPermissionCheck skips the managed-admin permission verification when
	// the caller has already run diagnostics and the user confirmed despite failures.
	SkipPermissionCheck bool

	// In is the reader for interactive prompts (defaults to os.Stdin).
	In io.Reader

	// Out is the writer for structured report output (writes to stdout).
	Out io.Writer
}

type SecretStatus struct {
	SecretName   string
	Namespace    string
	AccessKeyID  string
	MatchesAWS   bool
	Exists       bool
	ErrorMessage string
}