tenancy

type AllowGlobalAware interface {
	SetAllowGlobalServices(names ...string)
	AllowGlobalServices() []string
}

type Capabilities struct {
	// EnforcesAtStorage is true when the provider installs DB-side
	// rules that block access without per-query gating (e.g., RLS,
	// views). Used by the pool to skip any fallback scope it might
	// otherwise have applied.
	EnforcesAtStorage bool
}

type Claims struct {
	// TenantID is the single tenant this principal belongs to.
	TenantID string

	// PartitionIDs are every partition this principal can access. One
	// principal may legitimately span multiple partitions (e.g., an
	// operator with access to several branches, an analyst aggregating
	// across groups). Single-partition principals carry one element.
	PartitionIDs []string

	// AccessID is the membership grant used for this session (write
	// attribution). Stamped onto rows at create; not used for RLS or Keto.
	// Empty is allowed (service accounts, system jobs).
	AccessID string

	// Skip is true for internal/system callers that should bypass
	// tenancy enforcement. Providers honour Skip by not binding session
	// scope — the database-side policy's empty-match-all branch then
	// keeps every row visible (same as missing claims).
	Skip bool
}

type ClaimsBinder struct {
	// HonorInternalSkip when true (default) maps roles=internal and
	// SkipTenancyChecksOnClaims to Claims.Skip. Secure Profile sets false.
	HonorInternalSkip bool

	// RequireClaims when true fails Bind early if no bindable tenancy is
	// present after auth (Secure Profile / Hybrid interceptors).
	RequireClaims bool
}

type ClaimsFromAuthOption func(*claimsFromAuthConfig)

type ModeAware interface {
	SetSecurityMode(SecurityMode)
	SecurityMode() SecurityMode
}

type ModelInfo struct {
	// Table is the SQL table name resolved through GORM's naming
	// strategy.
	Table string

	// TenantColumn is the SQL column carrying the tenant identifier
	// (conventionally "tenant_id").
	TenantColumn string

	// PartitionColumn is the SQL column carrying the partition
	// identifier (conventionally "partition_id").
	PartitionColumn string
}

type Provider interface {
	// Name returns a short, stable identifier ("postgres-rls") used in
	// logs and diagnostics.
	Name() string

	// Capabilities advertises what the provider does so the pool can
	// decide whether a complementary fallback (e.g., GORM scope) is
	// required.
	Capabilities() Capabilities

	// Install applies storage-side enforcement schema (RLS policies,
	// views, etc.) for the supplied models. Called once per migration.
	// Implementations MUST be idempotent — Frame re-runs migration on
	// every boot.
	Install(ctx context.Context, db *gorm.DB, models []ModelInfo) error

	// WireAdapter registers dialect-level hooks. Called once when the
	// pool is constructed, BEFORE any connection is opened. Providers
	// that enforce per-acquire (Postgres-RLS) register here.
	WireAdapter(adapter dialect.DialectAdapter) error

	// WireGorm registers GORM-level callbacks on the supplied *gorm.DB.
	// Called once per opened connection. Providers that enforce
	// per-query (alternative dialects without per-acquire hooks)
	// register here. Postgres-RLS implements as a no-op.
	WireGorm(db *gorm.DB) error
}

type SecurityMode int

type SystemPrincipal struct {
	ServiceName  string
	Reason       string // logs/metrics ONLY — never used for authorization
	TenantID     string // if set and !AllowGlobal, beforeAcquire binds this scope
	PartitionIDs []string
	AllowGlobal  bool // match-all; requires provider allowlist OR framework marker
}

type Tenanted interface {
	GetTenantID() string
	GetPartitionID() string
	GetAccessID() string
	SetTenantID(string)
	SetPartitionID(string)
	SetAccessID(string)
}

type Unscoped interface {
	TenancyUnscoped()
}

type UnscopedMarker struct{}