harbor

type Client interface {
	// EnsureProject ensures a Harbor project with the given name exists.
	EnsureProject(ctx context.Context, projectName string) error

	// ReconcileProjectMembers synchronizes the Harbor project membership to match
	// the desired list of members. It adds missing members, updates roles that
	// have changed, and removes members that are no longer desired.
	//
	// Desired users that do not yet exist in Harbor (404 on add) are skipped and
	// returned in missingUsers so the caller can schedule a later retry. Skipping
	// one user does not abort the rest of the loop; an error is only returned for
	// unrecoverable failures.
	ReconcileProjectMembers(ctx context.Context, projectName string, desired []ProjectMember) (missingUsers []string, err error)

	// EnsureRobotAccount ensures a robot account exists for the given project.
	// Returns the credentials and whether the robot was newly created.
	// If the robot already exists, created is false and credentials are nil.
	EnsureRobotAccount(ctx context.Context, projectName string, robotName string) (creds *RobotCredentials, created bool, err error)
}

type ProjectMember struct {
	Username string
	RoleID   int
}

type RobotCredentials struct {
	Name   string // full robot name, e.g. robot$workspace-mynamespace
	Secret string // the token/password
}