apiaccess

type API struct {
	ID               APIID        `json:"id"`
	Name             string       `json:"name"`
	Resource         string       `json:"resource"`
	AllowCIMDClients bool         `json:"allow_cimd_clients"`
	Permissions      []Permission `json:"permissions"`
	CreatedAt        time.Time    `json:"created_at"`
	UpdatedAt        *time.Time   `json:"updated_at,omitzero"`
}

type APIID = typeid.TypeID[apiPrefix]

type ClientRef struct {
	ID         string `json:"id"`
	Name       string `json:"name"`
	ClientType string `json:"client_type"`
	IsPublic   bool   `json:"is_public"`
	HasLogo    bool   `json:"has_logo"`
}

type CreateParams struct {
	Name     string
	Resource string
}

type Grant struct {
	APIID                      string
	ClientID                   string
	UserDelegatedAccess        bool
	UserDelegatedPermissionIDs []string
	ClientAccess               bool
	ClientPermissionIDs        []string
}

type GrantParams struct {
	UserDelegatedAccess        bool
	UserDelegatedPermissionIDs []string
	ClientAccess               bool
	ClientPermissionIDs        []string
}

type ListParams struct {
	Query string
	Page
}

type Page struct {
	Page  int
	Limit int
}

type Permission struct {
	ID                    string    `json:"id"`
	APIID                 string    `json:"-"`
	Key                   string    `json:"key"`
	Name                  string    `json:"name"`
	Description           *string   `json:"description,omitzero"`
	AllowedForCIMDClients bool      `json:"allowed_for_cimd_clients"`
	CreatedAt             time.Time `json:"-"`
}

type PermissionInput struct {
	Key         string
	Name        string
	Description *string
}

type PostgresStore struct {
	// contains filtered or unexported fields
}

type Service struct {
	// contains filtered or unexported fields
}

type ServiceOption func(*Service)

type Store interface {
	Create(ctx context.Context, params CreateParams) (API, error)
	GetByID(ctx context.Context, id APIID) (API, error)
	Update(ctx context.Context, id APIID, params UpdateParams) (API, error)
	Delete(ctx context.Context, id APIID) error
	List(ctx context.Context, params ListParams) ([]API, int, error)

	SetPermissions(ctx context.Context, id APIID, perms []PermissionInput) ([]Permission, error)

	// Client listing/lookup joins public.oidc_clients; the client
	// ID is the oidc_clients TEXT primary key.
	ListClientsWithAccess(ctx context.Context, id APIID, params ListParams) ([]ClientRef, int, error)
	ListAssignableClients(ctx context.Context, id APIID, params ListParams) ([]ClientRef, int, error)

	GrantFor(ctx context.Context, id APIID, clientID string) (Grant, error)
	UpsertGrant(ctx context.Context, id APIID, clientID string, params GrantParams) (Grant, error)
	DeleteGrant(ctx context.Context, id APIID, clientID string) error
	ListGrantsForClient(ctx context.Context, clientID string) ([]Grant, error)
	ListAssignableAPIs(ctx context.Context, clientID string, params ListParams) ([]API, int, error)

	SetCIMDAccess(ctx context.Context, id APIID, enabled bool, permissionIDs []string) (API, error)

	// AllowedScopesForAudience resolves an RFC 8707 resource to the
	// permission keys one client may use on it, for the OIDC token
	// paths. apiExists false means the resource is unknown. The
	// subject type is a plain string ("user" / "client") to keep
	// this package decoupled from the OIDC surface.
	AllowedScopesForAudience(ctx context.Context, clientID, resource string, subjectType string) (scopes []string, apiExists bool, hasAccess bool, err error)
}

type SubjectType string

type UpdateParams struct {
	Name string
}