serviceaccount

type Account struct {
	ID             uuid.UUID  `json:"id"`
	Identifier     string     `json:"identifier"`
	Name           string     `json:"name"`
	Description    string     `json:"description,omitempty"`
	OrganizationID uuid.UUID  `json:"organization_id"`
	Active         bool       `json:"active"`
	AllowedScopes  []string   `json:"allowed_scopes,omitempty"`
	CreatedBy      *uuid.UUID `json:"created_by,omitempty"`
	LastUsedAt     *time.Time `json:"last_used_at,omitempty"`
	CreatedAt      time.Time  `json:"created_at"`
}

type Config struct {
	// Client is the identity database. Required.
	Client *ent.Client
	// Principals creates, deactivates and reactivates principals. Use the
	// host's principal service so authorization syncing and access-change
	// announcements follow its options. Required; principal.NewService's
	// result implements it.
	Principals principal.Service
	// Credentials stores key-pair credentials. Default:
	// credential.NewService(Client).
	Credentials credential.Service
	// Roles manages application roles. Required for GrantRole, RemoveRole
	// and Delete.
	Roles *approle.Service
	// AccessChangeSink announces the access changes the service itself
	// records (revoking a key) after they commit.
	AccessChangeSink accesschange.Sink
	// Logger records operator actions. Default: slog.Default().
	Logger *slog.Logger
	// Audit records security events (EventServiceAccount) for account,
	// key and role changes. Optional.
	Audit audit.Emitter
}

type CreateInput struct {
	OrganizationID uuid.UUID
	Name           string
	Description    string
	// Scopes are the scopes the account may be granted; a token's scopes
	// are the requested ones intersected with these and its key's.
	Scopes []string
	// CreatedBy is the operator's principal ID; uuid.Nil records none.
	CreatedBy uuid.UUID
}

type Key struct {
	CredentialID uuid.UUID  `json:"credential_id"`
	KeyID        string     `json:"key_id"`
	Algorithm    string     `json:"algorithm"`
	PublicKeyPEM string     `json:"public_key_pem"`
	Name         string     `json:"name,omitempty"`
	Scopes       []string   `json:"scopes,omitempty"`
	Active       bool       `json:"active"`
	Revoked      bool       `json:"revoked"`
	ExpiresAt    *time.Time `json:"expires_at,omitempty"`
	RevokedAt    *time.Time `json:"revoked_at,omitempty"`
	LastUsedAt   *time.Time `json:"last_used_at,omitempty"`
	LastUsedIP   string     `json:"last_used_ip,omitempty"`
	CreatedAt    time.Time  `json:"created_at"`

	// PrivateKeyPEM is the PKCS #8 private key, set only on the Key AddKey
	// returns for a generated key pair. It is never stored; it is not
	// serialized, so it cannot leak through a JSON listing.
	PrivateKeyPEM string `json:"-"`
}

type KeyInput struct {
	// PublicKeyPEM is a PEM "PUBLIC KEY" (PKIX) or "RSA PUBLIC KEY"
	// (PKCS #1) block. Empty generates a key pair.
	PublicKeyPEM string
	// Algorithm is ES256 (P-256), RS256 (RSA, 2048 bits or more) or
	// EdDSA (Ed25519). Empty takes it from the key.
	Algorithm string
	// Name labels the key.
	Name string
	// Scopes limit the key; empty means the account's allowed scopes.
	Scopes []string
	// ExpiresAt is when the key stops working; nil means never.
	ExpiresAt *time.Time
}

type PrincipalService interface {
	principal.ServiceTxCreator
	Deactivate(ctx context.Context, id uuid.UUID) error
	Reactivate(ctx context.Context, id uuid.UUID) error
}

type Service struct {
	// contains filtered or unexported fields
}