mode

type Deps struct {
	// DB is the identity database: the membership and grant tables both
	// modes keep. Required.
	DB *ent.Client

	// Registry holds the application vocabularies. It restricts grants to
	// registered applications' resource types and, in mode rebac, supplies
	// the schema fragments composed into the engine's schema. Optional.
	Registry *authz.VocabularyRegistry

	// SyncMode decides what a failed write of granted access to the
	// relationship engine does: authz.SyncModeStrict returns it,
	// SyncModeEventual (the default) logs it. Revocations remove the
	// relationship before their transaction commits and fail when the
	// engine refuses, whatever the mode; the reconciler (Result.Reconciler)
	// repairs what a failed write leaves behind. Mode rbac writes nothing.
	// See authz.SyncMode.
	SyncMode authz.SyncMode

	// AccessChangeSink announces the access changes grants record
	// (ADR-010). Optional.
	AccessChangeSink accesschange.Sink

	// Logger records sync failures and startup. Default: slog.Default().
	Logger *slog.Logger

	// PlatformAdmin and ManagerRoles feed the role-based provider's
	// platform-admin bypass and manager-role checks (rbac.WithPlatformAdminChecker and rbac.WithManagerRoleGetter). Mode rebac reads
	// both from the graph. Optional.
	PlatformAdmin func(ctx context.Context, principalID uuid.UUID) (bool, error)
	ManagerRoles  authz.ManagerRoleGetter

	// RBACOptions are further options for the role-based provider, such as
	// WithPermissions and WithRoleHierarchy. They apply after the ones
	// above.
	RBACOptions []rbac.Option
}

type Graph interface {
	// ReadRelationships calls fn for every relationship matching filter,
	// as one consistent snapshot read pageSize at a time.
	ReadRelationships(ctx context.Context, filter *spicedb.RelationshipFilter, pageSize int, fn func(*spicedb.Relationship) error) error
	// WriteRelationships writes relationships; writing one that exists
	// succeeds.
	WriteRelationships(ctx context.Context, rels []*spicedb.Relationship) error
	// DeleteRelationshipsExact deletes relationships; deleting one that
	// is absent succeeds.
	DeleteRelationshipsExact(ctx context.Context, rels []*spicedb.Relationship) error
}

type NamespaceResult struct {
	Namespace string
	Checked   int
	Desired   int
	Added     int
	Removed   int
	Restored  int
	Skipped   int
}

type ReconcileResult struct {
	Started  time.Time
	Duration time.Duration

	// Checked is the number of relationships read from the graph that the
	// reconciler manages, and Desired the number the identity tables call
	// for.
	Checked int
	Desired int

	// Added is the number of missing relationships written, and Removed
	// the number of stale relationships deleted. Restored counts deleted
	// relationships written back because a grant committed while the
	// reconciliation ran; Skipped counts missing relationships not
	// written because a revocation removed their rows meanwhile.
	Added    int
	Removed  int
	Restored int
	Skipped  int

	// Namespaces breaks the counts down by the graph definition
	// reconciled ("organization", "platform", "principal", an
	// application's "{app}_org", or a resource type).
	Namespaces []NamespaceResult
}

type ReconcileSchedule struct {
	// OnStartup reconciles as soon as Run starts.
	OnStartup bool
	// Interval is the time between periodic reconciliations; zero or
	// less disables them.
	Interval time.Duration
	// Jitter adds a random delay of up to Jitter to every interval, so
	// several instances do not reconcile in step.
	Jitter time.Duration
}

type ReconcileStats struct {
	Runs     int64
	Failures int64
	Added    int64
	Removed  int64
	Restored int64
	Skipped  int64
	// Last is the result of the last successful run, zero before one.
	Last ReconcileResult
	// LastError is the error of the last run, nil when it succeeded.
	LastError error
}

type Reconciler struct {
	// contains filtered or unexported fields
}

type ReconcilerOption func(*Reconciler)

type Result struct {
	// Mode is the configured mode.
	Mode authz.Mode

	// Provider answers authorization checks and implements the resource
	// grant contract. For mode rbac it is a *rbac.Provider, which also
	// implements authz.DecisionAuthorizer; for rebac, a *spicedb.Provider.
	Provider authz.Provider

	// Syncer is the relationship syncer to pass to the identity services
	// (organization, invite, approle: their WithAuthzSyncer options). Mode
	// rbac returns the no-op syncer, since it reads the tables at check
	// time; mode rebac returns the engine's, which also implements
	// authz.AppRoleSyncer and authz.ResourceGrantSyncer.
	Syncer authz.RelationshipSyncer

	// SyncMode is Deps.SyncMode with its default applied
	// (authz.SyncModeEventual), to pass to the services with Syncer.
	SyncMode authz.SyncMode

	// Grants is the resource-grant store both modes keep, for services that
	// grant inside their own transactions (invite.WithResourceGrants).
	Grants *resourcegrant.Service

	// Reconciler repairs the relationship graph from the identity tables
	// in mode rebac; nil in mode rbac, which has no graph. Call its
	// Reconcile for an on-demand run, and RunReconciler to run it on the
	// configured schedule.
	Reconciler *Reconciler

	// Schedule is when RunReconciler reconciles, from the configuration's
	// reconcile settings. Disabled reconciler: the zero schedule.
	Schedule ReconcileSchedule
	// contains filtered or unexported fields
}