tenancy

type Capabilities struct {
	// EnforcesAtStorage is true when the provider installs DB-side
	// rules that block access without per-query gating (e.g., RLS,
	// views). Used by the pool to skip any fallback scope it might
	// otherwise have applied.
	EnforcesAtStorage bool
}

type Claims struct {
	// TenantID is the single tenant this principal belongs to.
	TenantID string

	// PartitionIDs are every partition this principal can access. One
	// principal may legitimately span multiple partitions (e.g., an
	// operator with access to several branches, an analyst aggregating
	// across groups). Single-partition principals carry one element.
	PartitionIDs []string

	// AccessID is an optional access-control hint propagated through
	// queue metadata and lifecycle hooks.
	AccessID string

	// Skip is true for internal/system callers that should bypass
	// tenancy enforcement. Providers honour Skip by performing no
	// session binding for the conn — the database-side policy's
	// empty-match-all branch then keeps every row visible.
	Skip bool
}

type ModelInfo struct {
	// Table is the SQL table name resolved through GORM's naming
	// strategy.
	Table string

	// TenantColumn is the SQL column carrying the tenant identifier
	// (conventionally "tenant_id").
	TenantColumn string

	// PartitionColumn is the SQL column carrying the partition
	// identifier (conventionally "partition_id").
	PartitionColumn string
}

type Provider interface {
	// Name returns a short, stable identifier ("postgres-rls") used in
	// logs and diagnostics.
	Name() string

	// Capabilities advertises what the provider does so the pool can
	// decide whether a complementary fallback (e.g., GORM scope) is
	// required.
	Capabilities() Capabilities

	// Install applies storage-side enforcement schema (RLS policies,
	// views, etc.) for the supplied models. Called once per migration.
	// Implementations MUST be idempotent — Frame re-runs migration on
	// every boot.
	Install(ctx context.Context, db *gorm.DB, models []ModelInfo) error

	// WireAdapter registers dialect-level hooks. Called once when the
	// pool is constructed, BEFORE any connection is opened. Providers
	// that enforce per-acquire (Postgres-RLS) register here.
	WireAdapter(adapter dialect.DialectAdapter) error

	// WireGorm registers GORM-level callbacks on the supplied *gorm.DB.
	// Called once per opened connection. Providers that enforce
	// per-query (alternative dialects without per-acquire hooks)
	// register here. Postgres-RLS implements as a no-op.
	WireGorm(db *gorm.DB) error
}

type Tenanted interface {
	GetTenantID() string
	GetPartitionID() string
	GetAccessID() string
	SetTenantID(string)
	SetPartitionID(string)
	SetAccessID(string)
}

type Unscoped interface {
	TenancyUnscoped()
}

type UnscopedMarker struct{}