httpapi

type API struct {
	// contains filtered or unexported fields
}

type APIKey struct {
	ID        string
	Name      string
	Key       string
	CreatedAt time.Time
	ExpiresAt time.Time
}

type APIKeyInfo struct {
	ID         string
	Name       string
	CreatedAt  time.Time
	LastUsedAt time.Time
	ExpiresAt  time.Time
}

type AdminLoaderRequest struct {
	Key         string
	Pathname    string
	RouteParams map[string]string
	Query       url.Values
	Identity    *AuthIdentity
	Locale      string
	AuditRead   func(string, string)
}

type AuditEvent struct {
	Time            time.Time
	RequestID       string
	ClientIP        string
	Action          string
	Collection      string
	DocumentID      string
	ActorID         string
	ActorCollection schema.CollectionSlug
}

type AuthIdentity struct {
	Collection   schema.CollectionSlug
	Actor        store.Document
	PreviewEpoch uint64
}

type AuthSession struct {
	ID         string
	Token      string
	Collection schema.CollectionSlug
	User       store.Document
	ExpiresAt  time.Time
	// PreparedSessions and PreparedAPIKeys reuse this exact server-resolved
	// session during admin bootstrap. They are never serialized or exposed to
	// application configuration.
	PreparedSessions func(context.Context) ([]AuthSessionInfo, error)
	PreparedAPIKeys  func(context.Context) ([]APIKeyInfo, error)
}

type AuthSessionInfo struct {
	ID         string
	CreatedAt  time.Time
	LastSeenAt time.Time
	ExpiresAt  time.Time
	IPAddress  string
	UserAgent  string
	Current    bool
}

type Config struct {
	AdminLoad func(context.Context, AdminLoaderRequest) (json.RawMessage, error)
	Manifest  schema.Manifest
	// Snapshot is the engine's resolved schema, the same content as Manifest,
	// shared read-only so requests reuse its block definition views and the
	// admin presents it without copying. Without one, New reads a copy of Manifest.
	Snapshot schema.Snapshot
	// LocalizationForRequest returns the content localization presented to one
	// identity, or nil when it sees the manifest's settings unchanged. It only
	// narrows admin presentation; it never weakens API validation or access.
	LocalizationForRequest func(context.Context, *AuthIdentity) (*schema.LocalizationSettings, error)
	Engine                 *operationengine.Engine
	AdminAssets            fs.FS
	MaxBodyBytes           int64
	SecureCookies          bool
	Login                  func(context.Context, string, string, string, LoginMetadata) (AuthSession, error)
	Session                func(context.Context, string) (AuthSession, error)
	RotateSession          func(context.Context, string) (AuthSession, error)
	Logout                 func(context.Context, string) error
	LogoutAll              func(context.Context, string) error
	Sessions               func(context.Context, string) ([]AuthSessionInfo, error)
	RevokeSession          func(context.Context, string, string) error
	RequestPasswordReset   func(context.Context, string, string) error
	ResetPassword          func(context.Context, string, string, string) error
	RequestVerification    func(context.Context, string, string) error
	VerifyEmail            func(context.Context, string, string) error
	ChangePassword         func(context.Context, string, string, string) error
	AuthBootstrapAvailable func(context.Context, string) (bool, error)
	// CreateAuthUser receives setup when an anonymous request presented
	// SetupToken.
	CreateAuthUser func(context.Context, string, store.Values, string, *AuthIdentity, LocaleOptions, *bool, bool) (store.Document, error)
	// SetupToken is the secret first-user setup must present. New generates
	// one when it is empty.
	SetupToken                   string
	CreateAPIKey                 func(context.Context, string, string, time.Time) (APIKey, error)
	APIKeys                      func(context.Context, string) ([]APIKeyInfo, error)
	RevokeAPIKey                 func(context.Context, string, string) error
	AuthenticateAPIKey           func(context.Context, string) (AuthIdentity, error)
	AuthenticateExternal         func(context.Context, map[string][]string) (AuthIdentity, error)
	PreviewLifecycleEpoch        func() uint64
	CreateCollectionPreviewToken func(context.Context, string, string, *AuthIdentity) (PreviewToken, error)
	CreateGlobalPreviewToken     func(context.Context, string, *AuthIdentity) (PreviewToken, error)
	RevokePreviewToken           func(context.Context, string, *AuthIdentity) error
	FindCollectionPreview        func(context.Context, string, string, string) (store.Document, error)
	FindGlobalPreview            func(context.Context, string, string) (store.Document, error)
	GetPreference                func(context.Context, *AuthIdentity, string) (json.RawMessage, error)
	SetPreference                func(context.Context, *AuthIdentity, string, json.RawMessage) (json.RawMessage, error)
	DeletePreference             func(context.Context, *AuthIdentity, string) error
	ResetPreferences             func(context.Context, *AuthIdentity) error
	ForceUnlock                  func(context.Context, string, string, *AuthIdentity) error
	DocumentLock                 func(context.Context, string, string, *AuthIdentity) (protocol.DocumentLockEnvelope, error)
	AcquireDocumentLock          func(context.Context, string, string, bool, *AuthIdentity) (protocol.DocumentLockEnvelope, error)
	ReleaseDocumentLock          func(context.Context, string, string, *AuthIdentity) error
	SchedulePublish              func(context.Context, string, string, time.Time, string, int, *AuthIdentity) (store.ScheduledPublication, error)
	ScheduleUnpublish            func(context.Context, string, string, time.Time, string, int, *AuthIdentity) (store.ScheduledPublication, error)
	ScheduledPublications        func(context.Context, string, string, *AuthIdentity) ([]store.ScheduledPublication, error)
	CancelScheduledPublication   func(context.Context, string, string, string, *AuthIdentity) error
	AllowAuthIPAttempt           func(context.Context, string, string, int, time.Duration) (bool, error)
	AllowAuthAttempt             func(context.Context, string, string, string, int, time.Duration) (bool, error)
	AllowedOrigins               []string
	AllowedRequestHeaders        []string
	AllowedHosts                 []string
	TrustedProxies               []netip.Prefix
	// TrustedProxyHops counts the proxies in front of a trusted peer, the
	// peer included, whose addresses can't be listed. See clientIP.
	TrustedProxyHops             int
	AuthRateLimit                int
	AuthRateWindow               time.Duration
	Audit                        func(AuditEvent)
	Ready                        func(context.Context) error
	Observe                      func(RequestObservation)
	RequestError                 func(RequestErrorEvent)
	RequestTimeout               time.Duration
	ContentSecurityPolicy        string
	DisableContentSecurityPolicy bool
	StrictTransportSecurity      string
	AcquireUpload                func(context.Context, string) (release func(), err error)
	Upload                       func(context.Context, string, UploadInput, *AuthIdentity, bool) (store.Document, error)
	UpdateUpload                 func(context.Context, string, string, UploadInput, *AuthIdentity, bool) (store.Document, error)
	RemoteUpload                 func(context.Context, string, string, UploadInput, *AuthIdentity) (store.Document, error)
	PreviewUpload                func(context.Context, string, string, string, *AuthIdentity) (io.ReadCloser, storage.Object, string, error)
	OpenUploadSource             func(context.Context, string, string, *AuthIdentity) (io.ReadCloser, storage.Object, error)
	Duplicate                    func(context.Context, string, string, store.Values, *AuthIdentity, LocaleOptions) (store.Document, error)
	OpenUpload                   func(context.Context, string, string, *AuthIdentity) (io.ReadCloser, storage.Object, error)
	CreateUploadGrants           func(context.Context, string, string, []protocol.UploadGrantRequestItem, time.Duration) ([]protocol.UploadGrant, error)
	OpenUploadGrant              func(context.Context, string, string, string) (io.ReadCloser, storage.Object, error)
	PluginEndpoints              []PluginEndpoint
	PluginTransports             []PluginEndpoint
	CustomEndpoints              []CustomEndpoint
}

type CustomEndpoint struct {
	Method       string
	Pattern      string
	Scope        CustomEndpointScope
	Resource     schema.CollectionSlug
	MaxBodyBytes int64
	Handler      EndpointHandler
}

type CustomEndpointScope uint8

type EndpointContext struct {
	Writer           http.ResponseWriter
	Request          *http.Request
	RequestID        string
	ClientIP         string
	RouteParams      map[string]string
	Actor            *store.Document
	ActorCollection  schema.CollectionSlug
	AdmitAuthAttempt func(context.Context, string, string) error
	ReportError      func(error, string)
}

type EndpointHandler func(EndpointContext)

type LocaleOptions struct {
	Locale          string
	FallbackLocales []schema.LocaleCode
	DisableFallback bool
	AllLocales      bool
}

type LoginMetadata struct {
	IPAddress string
	UserAgent string
}

type PluginEndpoint struct {
	Method       string
	Path         string
	MaxBodyBytes int64
	Handler      EndpointHandler
}

type PreviewToken struct {
	Token      string
	Resource   string
	Slug       string
	DocumentID string
	ExpiresAt  time.Time
}

type RequestErrorEvent struct {
	Time      time.Time
	RequestID string
	Method    string
	Path      string
	Error     error
	Panic     bool
	Stack     string
}

type RequestObservation struct {
	Time          time.Time
	RequestID     string
	Method        string
	Path          string
	Status        int
	ErrorCode     string
	ErrorReason   string
	ResponseBytes int64
	Duration      time.Duration
}

type UploadInput struct {
	Filename         string                    `json:"filename"`
	Data             store.Values              `json:"data"`
	Image            *protocol.UploadImageEdit `json:"image"`
	Publish          bool                      `json:"publish"`
	Draft            *bool                     `json:"-"`
	Reader           io.Reader                 `json:"-"`
	Locale           LocaleOptions             `json:"-"`
	ExpectedRevision int                       `json:"-"`
}