ad

type Conn interface {
	// Add creates an entry with the given attributes.
	Add(dn string, attrs map[string][]string) error
	// Modify applies the change operations to an existing entry.
	Modify(dn string, mods []Mod) error
	// ReadAttr returns one attribute's values for an entry (a base-object read), used
	// for the userAccountControl read-modify-write. Missing → an empty slice, no error.
	ReadAttr(dn, attr string) ([]string, error)
	// ModifyDN moves and/or renames an entry. In a directory those are one operation:
	// an entry's place in the tree *is* its name, so a mover is a DN change.
	ModifyDN(dn, newRDN, newSuperior string) error
	// Delete removes an entry. AD refuses to delete a container that still has
	// children, which is the behaviour a leaver process wants.
	Delete(dn string) error
	// DirSync reads what changed under a naming context since a cookie. It is the one
	// read this connector does — search stays with the generic LDAP connector — and it
	// is here because DirSync is Active Directory's own mechanism, not LDAP's.
	DirSync(req DirSyncRequest) (DirSyncResult, error)
	Close() error
}

type Dialer interface {
	Dial(url, bindDN, bindPassword string, startTLS bool) (Conn, error)
}

type DirSyncRequest struct {
	BaseDN     string
	Filter     string
	Attributes []string
	Cookie     []byte
	Flags      int64
	MaxEntries int32
}

type DirSyncResult struct {
	Entries []Entry
	Cookie  []byte
	More    bool
}

type Entry struct {
	DN         string
	Attributes map[string][]string
}

type GoDialer struct{}

type Job struct {
	URL        string `json:"url"`
	BindDN     string `json:"bindDN,omitempty"`
	BindSecret string `json:"bindSecretRef,omitempty"`
	StartTLS   bool   `json:"startTLS,omitempty"`
	Operation  string `json:"operation"`
	DN         string `json:"dn"`
	MemberDN   string `json:"memberDN,omitempty"`
	NewDN      string `json:"newDN,omitempty"`
	// NewPassword is the password a set-password writes. It is the operation's own
	// data and always was a process variable (ADR-0166), so it travels — and a worker
	// leasing the job already receives the task's variables regardless, which is why
	// carrying it here adds no exposure that the lease did not already have.
	NewPassword string `json:"newPassword,omitempty"`
	// Attributes is the resolved entry for create-user, create-group and
	// update-attributes.
	Attributes map[string][]string `json:"attributes,omitempty"`
	// The sync operation's own fields. Cookie is base64 of the server's opaque resume
	// token, because a process variable holds text and the token is binary.
	// CookieVariable is where the *new* cookie is written back, which is what lets a
	// reconciliation loop carry itself forward without any state in the connector.
	BaseDN         string `json:"baseDN,omitempty"`
	Filter         string `json:"filter,omitempty"`
	Cookie         string `json:"cookie,omitempty"`
	CookieVariable string `json:"cookieVariable,omitempty"`
	MaxEntries     int    `json:"maxEntries,omitempty"`
	ObjectSecurity bool   `json:"objectSecurity,omitempty"`
	ResultVariable string `json:"resultVariable,omitempty"`
}

type Mod struct {
	Op   modOp
	Attr string
	Vals []string
}

type ProcessLookup func(defKey uint64) *compiler.CompiledProcess

type SecretResolver func(ref string) string