authz

type Action struct {
	Operation string
	// Digest is [Digest] over the Worker Type, the Worker, the operation, the
	// resource and every material parameter. Approvals are of a digest.
	Digest string
}

type Actor struct {
	IdentityMode string
	Worker       string // the configured Worker the compiled task names
	WorkerType   string
	// WorkerInstance is the lease holder's self-asserted label. It is recorded and
	// may be matched by nothing that decides — it is not a credential.
	WorkerInstance string
	// ExecutedAs is the external identity key, or "service:<worker>".
	ExecutedAs string
	// Connection is the connection a delegated mode uses; nil when there is none.
	Connection *Connection
}

type Approval struct {
	ID             string   `json:"id"`
	Digest         string   `json:"digest"`
	ApproverID     string   `json:"approverId"`
	ApproverGroups []string `json:"approverGroups"` // the approver's groups now, not when they decided
	Outcome        string   `json:"outcome"`        // ApprovalGranted or ApprovalRejected
	DecidedAt      int64    `json:"decidedAt"`      // Unix nanoseconds
	Revoked        bool     `json:"revoked"`
}

type Connection struct {
	ID             string   `json:"id"`
	OwnerID        string   `json:"ownerId"`
	Status         string   `json:"status"`
	AllowedWorkers []string `json:"allowedWorkers"`
	// LastInteractiveAuth is when its owner last signed in at the provider, Unix
	// nanoseconds; 0 when unknown.
	LastInteractiveAuth int64 `json:"lastInteractiveAuth"`
}

type Context struct {
	// Time is the evaluation instant, Unix nanoseconds, read by the caller from its
	// clock and frozen into the decision's event.
	Time               int64
	ProcessID          string // the BPMN process id
	ProcessInstanceKey uint64
	JobKey             uint64
	// InitiatedBy is the principal who started the process instance, as the engine
	// recorded it at creation; empty when nobody authenticated did.
	InitiatedBy string
	// Approvals are the approval facts recorded for this instance, with each
	// approver's current group membership.
	Approvals []Approval
}

type Decision struct {
	Effect     Effect
	ReasonCode string
	// PolicyID and PolicyVersion name the deciding policy: the first Deny under
	// deny-overrides, else the first Permit. Empty for a guard's or a default answer.
	PolicyID      string
	PolicyVersion int
	// Obligations are those of every contributing Permit, satisfied or not.
	Obligations []ObligationResult
	// Trace is every policy that was asked and what it said, in evaluation order.
	Trace []Step
}

type Document struct {
	ID          string `json:"id"`
	Description string `json:"description,omitempty"`
	// Priority orders policies, lowest first. It decides nothing under the fixed
	// deny-overrides combination; it decides which policy is reported as deciding
	// and the order of the explanation.
	Priority      int       `json:"priority,omitempty"`
	Target        Target    `json:"target,omitempty"`
	RuleCombining string    `json:"ruleCombining"`
	Rules         []RuleDoc `json:"rules"`
	// DMN is a DMN model whose decisions rules may name. It is compiled once, at
	// publication.
	DMN string `json:"dmn,omitempty"`
}

type Effect uint8

type Match struct {
	SubjectRolesAny  []string `json:"subjectRolesAny,omitempty"`
	SubjectGroupsAny []string `json:"subjectGroupsAny,omitempty"`
	SubjectIDs       []string `json:"subjectIds,omitempty"`
	Operations       []string `json:"operations,omitempty"`
	Workers          []string `json:"workers,omitempty"`
	IdentityModes    []string `json:"identityModes,omitempty"`
	ProcessIDs       []string `json:"processIds,omitempty"`
	// ResourcePrefixes match when the canonical resource id starts with one.
	ResourcePrefixes []string `json:"resourcePrefixes,omitempty"`
}

type ObligationDoc struct {
	ID   string `json:"id"`
	Type string `json:"type"`
	// approval
	ApproverGroup    string `json:"approverGroup,omitempty"`
	Approvals        int    `json:"approvals,omitempty"`
	ValidForSeconds  int64  `json:"validForSeconds,omitempty"`
	ExcludeRequester bool   `json:"excludeRequester,omitempty"`
	// fresh-authentication
	MaxAgeSeconds int64 `json:"maxAgeSeconds,omitempty"`
}

type ObligationResult struct {
	ID            string `json:"id"`
	Type          string `json:"type"`
	PolicyID      string `json:"policyId"`
	PolicyVersion int    `json:"policyVersion"`
	RuleID        string `json:"ruleId,omitempty"`
	Satisfied     bool   `json:"satisfied"`
	Reason        string `json:"reason,omitempty"` // why it is not satisfied; empty when it is
	// ApprovalsUsed are the ids of the approvals that satisfied it, sorted.
	ApprovalsUsed []string `json:"approvalsUsed,omitempty"`
	// What the approval asks for, so the enforcement point can open a request.
	ApproverGroup    string `json:"approverGroup,omitempty"`
	Approvals        int    `json:"approvals,omitempty"`
	ValidForSeconds  int64  `json:"validForSeconds,omitempty"`
	ExcludeRequester bool   `json:"excludeRequester,omitempty"`
}

type Policy struct {
	// contains filtered or unexported fields
}

type Published struct {
	Document    Document
	Version     int
	PublishedAt int64
	PublishedBy string
}

type Request struct {
	Subject  Subject
	Actor    Actor
	Action   Action
	Resource Resource
	Context  Context
}

type Resource struct {
	Type string
	ID   string
}

type RuleDoc struct {
	ID string `json:"id"`
	// Effect is "Permit" or "Deny". Exactly one of Effect and Decision is set.
	Effect string `json:"effect,omitempty"`
	// Decision names a decision of the policy's DMN model; its outputs "effect" and
	// "reasonCode" are the rule's answer.
	Decision   string `json:"decision,omitempty"`
	ReasonCode string `json:"reasonCode,omitempty"`
	When       Match  `json:"when,omitempty"`
	// Condition is a FEEL boolean over subject, actor, action, resource and context.
	Condition   string          `json:"condition,omitempty"`
	Obligations []ObligationDoc `json:"obligations,omitempty"`
}

type Set struct {
	// contains filtered or unexported fields
}

type Step struct {
	PolicyID      string
	PolicyVersion int
	RuleID        string // the rule that answered; empty when none did
	Effect        Effect
	Reason        string
	Note          string // why an answer was Indeterminate
}

type Subject struct {
	// ID is the stable principal id ("usr_…"); empty when there is none.
	ID string
	// Known says ID was found in the user store; Disabled that the account is
	// deactivated. Both are read at decision time — current state decides.
	Known    bool
	Disabled bool
	// Roles and Groups are the principal's current roles and group ids.
	Roles  []string
	Groups []string
}

type Target struct {
	WorkerTypes   []string `json:"workerTypes,omitempty"`
	Workers       []string `json:"workers,omitempty"`
	Operations    []string `json:"operations,omitempty"`
	IdentityModes []string `json:"identityModes,omitempty"`
}