organization

type Reconciler struct {
	// contains filtered or unexported fields
}

type WorkspaceProvisioner interface {
	// EnsureOrgWorkspace materializes the kcp Workspace at
	// root:railgrid:tenants:{orgUUID}. Idempotent (per O-11).
	EnsureOrgWorkspace(ctx context.Context, orgUUID string) error

	// EnsureOrgMembership creates an org-scope Membership CR inside the
	// Organization workspace granting userName the given role.
	// Idempotent.
	EnsureOrgMembership(ctx context.Context, orgUUID, userName, role string) error

	// ListOrgMembershipRoles reads current organization membership authority.
	// Initial workspace access includes every current org administrator.
	ListOrgMembershipRoles(ctx context.Context, orgUUID string) (map[string]string, error)

	// EnsureChildWorkspace materializes the kcp Workspace at
	// root:railgrid:tenants:{orgUUID}:{wsUUID} of type `workspace`. Used to
	// create the initial team Workspace inside either organization kind.
	// Idempotent (per O-11).
	EnsureChildWorkspace(ctx context.Context, orgUUID, wsUUID string) error

	// EnsureChildWorkspaceDisplayName stamps the display-name
	// annotation on the child Workspace when none is set yet, so the
	// default workspace surfaces under a human-readable name instead
	// of its UUID. Never overwrites an existing name — a user rename
	// must survive reconciles. Idempotent.
	EnsureChildWorkspaceDisplayName(ctx context.Context, orgUUID, wsUUID, displayName string) error

	// EnsureChildWorkspaceRailgridBinding materializes an APIBinding to
	// root:railgrid:providers.core.railgrid.ai inside the child team
	// Workspace, with the permission claims railgrid controllers need.
	// This is what makes Edge / MCPServer / Placement / VirtualWorkload
	// usable inside the user's default Workspace. Idempotent.
	EnsureChildWorkspaceRailgridBinding(ctx context.Context, orgUUID, wsUUID string) error

	// EnsureChildWorkspaceAdmin grants cluster-admin to the User in
	// the child team Workspace via a ClusterRoleBinding for the User's
	// rbacIdentity. Idempotent.
	EnsureChildWorkspaceAdmin(ctx context.Context, orgUUID, wsUUID, rbacIdentity string) error

	// ListChildTeamWorkspaces lists the Org's team workspaces (no
	// infrastructure children). Used by the RBAC backfill to bind an
	// org-scope admin into every child workspace (O-15).
	ListChildTeamWorkspaces(ctx context.Context, orgUUID string) ([]string, error)

	// EnsureChildWorkspaceDefaultMCPServer seeds the "default"
	// MCPServer CR inside the child team Workspace so users have a
	// working MCP endpoint out of the box. Idempotent.
	EnsureChildWorkspaceDefaultMCPServer(ctx context.Context, orgUUID, wsUUID string) error

	// GetChildWorkspaceClusterName returns the kcp logical-cluster
	// short hash for the child team Workspace. Used by User reconciliation to patch
	// User.spec.DefaultCluster with the hash form (which kubectl /
	// /clusters/{hash} address by) rather than the full path.
	GetChildWorkspaceClusterName(ctx context.Context, orgUUID, wsUUID string) (string, error)
}