ruleengine

type Decision struct {
	SetName     string
	EventReason string
	Action      api.ActionType
	Value       Value

	MatchedValue any

	// MatchedRule is the human-readable rule description returned by Set.RuleDescription.
	MatchedRule string

	// MatchDetail is the human-readable detail returned by Match.Detail.
	MatchDetail string

	Message string
}

type DecisionError struct {
	Decision *Decision
}

type Evaluation struct {
	// Final is the last matching allow/deny decision.
	Final *Decision

	// Blocking is set when the final result blocks admission.
	Blocking *Decision

	// Audits contains all matching audit decisions.
	Audits []*Decision
}

type Match struct {
	Matched      bool
	MatchedValue any

	// Detail is optional human-readable matcher context.
	// Example: "10.0.171.239 is contained in 10.0.0.0/16".
	Detail string
}

type Set[R any, O any] struct {
	Name        string
	EventReason string

	Values func(O) []Value
	// Rules extracts rules when extraction cannot fail.
	Rules func(*api.NamespaceRuleEnforceBody) []R
	// RulesWithError extracts rules that require runtime parsing or matching.
	// When set, it takes precedence over Rules.
	RulesWithError func(*api.NamespaceRuleEnforceBody) ([]R, error)
	Matches        func(R, Value) (Match, error)

	// Message can fully override the default message.
	// Prefer leaving this nil unless a rule requires very specific wording.
	Message func(api.ActionType, Value, any) string

	// RuleDescription returns a human-readable representation of one rule.
	// It is used only for admission/audit messages.
	RuleDescription func(R) string

	// AllowedDescription optionally overrides the "Allowed values" label.
	// Example: "Allowed CIDRs", "Allowed ranges", "Allowed hostnames".
	AllowedDescription string
}

type Value struct {
	Value string
	Path  string
}