service

type APIKeyService interface {
	Create(ctx context.Context, input domain.CreateAPIKeyInput) (*domain.APIKeyResult, *domain.AppError)
	List(ctx context.Context) (*domain.ListAPIKeysResult, *domain.AppError)
	ListByTeamAndUser(ctx context.Context, team, user string) (*domain.ListAPIKeysResult, *domain.AppError)
	Get(ctx context.Context, keyID string) (*domain.APIKeyItem, *domain.AppError)
	Delete(ctx context.Context, input domain.DeleteAPIKeyInput) *domain.AppError
	// Promote elevates a locally-created key to a global key by syncing it
	// through the ws-proxy manager to all Worker clusters.
	Promote(ctx context.Context, keyID string) *domain.AppError
}

type ClusterConfigSink interface {
	ApplyClusterConfig(ctx context.Context, cfg cluster.ClusterConfig) error
}

type ClusterService interface {
	// List returns the cluster catalog sorted by ID. When store or localID are
	// empty the result is a single-entry list containing the local cluster, or an
	// empty slice when neither is configured. The list is a defensive copy; the
	// caller may mutate it freely.
	List(ctx context.Context) ([]domain.ClusterSummary, *domain.AppError)
}

type CreateKeyRequest struct {
	Namespace   string
	User        string
	Team        string
	Role        string
	Description string
	QuotaURL    string
	ExpiresAt   string // RFC3339; empty = never expires

	// Import/promote mode: when TokenHash + HashPrefix are set the Hub calls
	// CreateFromHash instead of generating a new token.
	TokenHash  string
	HashPrefix string
	IssuedAt   string // RFC3339
	RawToken   string // plaintext token for promote
}

type CreateKeyResponse struct {
	RawToken   string
	KeyID      string
	TokenHash  string
	HashPrefix string
	IssuedAt   string // RFC3339
}

type CrossClusterForwarder struct {
	// contains filtered or unexported fields
}

type ExecTokenRecord struct {
	SandboxID  string
	Namespace  string
	PodName    string
	Containers []string
	ExpiresAt  time.Time
}

type ExtProcClient interface {
	PushRoute(ctx context.Context, r RouteInfo) error
	EvictRoute(ctx context.Context, sandboxID string) error
	GetLastActive(ctx context.Context) (map[string]time.Time, error)
	Close() error
}

type IAMResolveResult struct {
	// Username is the normalised username.
	Username string
	// Team is the team derived from ScitixQuota labels. Empty when no quota found.
	Team string
	// Namespace is the effective Kubernetes namespace to use for this user.
	// When the computed namespace (t-{team}-{username}) exists in the cluster it
	// equals that value; otherwise it falls back to "default".
	Namespace string
	// QuotaURL is the quota URL label value, if found.
	QuotaURL string
}

type IAMService interface {
	// ResolveNamespace resolves the effective namespace for a given team+user pair.
	// Results are cached permanently (until process restart) for performance.
	ResolveNamespace(ctx context.Context, team, user string) (string, *domain.AppError)
}

type ListSandboxesResult struct {
	Items []domain.Sandbox
	Total int
}

type OrganizationService interface {
	// ListTeams returns all unique team names found across API Key secrets.
	ListTeams(ctx context.Context) ([]string, *domain.AppError)

	// ListUsersByTeam returns all unique user names belonging to the given team,
	// derived from API Key secrets filtered by team label.
	ListUsersByTeam(ctx context.Context, team string) ([]string, *domain.AppError)

	// ListNamespaces returns all Kubernetes namespace names visible to the operator.
	ListNamespaces(ctx context.Context) ([]string, *domain.AppError)
}

type QuotaService interface {
	// ListForUser returns all quotas matching the given user and team. When
	// the underlying provider is disabled the result is an empty list, not
	// an error — callers should treat that as "feature unavailable".
	ListForUser(ctx context.Context, user, team string) ([]domain.QuotaInfo, *domain.AppError)
}

type RegistryStore interface {
	LookupRegistry(host string) (clusterID, typ string, ok bool)
	RegistryForType(clusterID, typ string) (host string, ok bool)
}

type RouteInfo struct {
	SandboxID string
	Namespace string
	PodName   string
}

type SandboxPoolService interface {
	Create(ctx context.Context, input domain.CreateSandboxPoolInput) (*domain.SandboxPool, *domain.AppError)
	List(ctx context.Context, namespace, team, user string) ([]domain.SandboxPool, *domain.AppError)
	Get(ctx context.Context, namespace, name string) (*domain.SandboxPool, *domain.AppError)
	Update(ctx context.Context, input domain.UpdateSandboxPoolInput) (*domain.SandboxPool, *domain.AppError)
	Delete(ctx context.Context, namespace, name string) (*domain.DeleteSandboxPoolResult, *domain.AppError)
	// SyncTemplate re-reads the pool's source SandboxTemplate and patches the pool's EmbeddedSandboxTemplate.
	// Does not change replicas. Returns error if pool has no templateName annotation.
	SyncTemplate(ctx context.Context, input domain.SyncSandboxPoolTemplateInput) (*domain.SandboxPool, *domain.AppError)
	// SyncTemplatePreview dry-runs SyncTemplate: returns what the EmbeddedSandboxTemplate would look like
	// after applying all overrides, without writing to Kubernetes.
	SyncTemplatePreview(ctx context.Context, input domain.SyncSandboxPoolTemplateInput) (*domain.SyncTemplatePreviewResult, *domain.AppError)
}

type SandboxService interface {
	Create(ctx context.Context, input domain.CreateSandboxInput) (*domain.Sandbox, *domain.AppError)
	List(ctx context.Context, filter domain.ListSandboxesFilter) (*ListSandboxesResult, *domain.AppError)
	Get(ctx context.Context, namespace, sandboxID string) (*domain.Sandbox, *domain.AppError)
	Delete(ctx context.Context, namespace, sandboxID string) (*domain.DeleteSandboxResult, *domain.AppError)
	// SetTimeout updates the idle timeout annotation on the sandbox pod.
	// A timeout of 0 removes the annotation (no expiry).
	SetTimeout(ctx context.Context, namespace, sandboxID string, timeout time.Duration) *domain.AppError
	// GetLogs retrieves logs for a sandbox. For active sandboxes it fetches live
	// logs from the K8s API; for runtime sources it reads the log file via exec.
	GetLogs(ctx context.Context, namespace, sandboxID string, opts domain.GetLogsOptions) (*domain.SandboxLogs, *domain.AppError)
	// CreateExecToken generates a single-use exec token (TTL 30 s) for the given sandbox.
	// The sandbox must be in the Running phase.
	CreateExecToken(ctx context.Context, namespace, sandboxID string) (string, *domain.AppError)
	// ValidateExecToken validates and consumes the token.
	// Returns ExecTokenInfo on success, or a 401 AppError if the token is invalid / expired.
	ValidateExecToken(tokenStr string) (*domain.ExecTokenInfo, *domain.AppError)
	// ExecCommand runs a one-shot command inside the sandbox pod (non-interactive, no TTY).
	// The sandbox must be in Running phase. clientset must be non-nil.
	ExecCommand(ctx context.Context, namespace, sandboxID string, input domain.ExecCommandInput) (*domain.ExecCommandResult, *domain.AppError)
	// IsReady checks if all runtime readiness probes for a sandbox pass.
	// If a runtime has no ReadinessProbe configured, it is considered ready.
	IsReady(ctx context.Context, namespace, sandboxID string) (*domain.SandboxReadinessResult, *domain.AppError)
}

type SandboxTemplateService interface {
	// List returns templates visible to the caller (auth). isAdmin=true bypasses
	// visibility filtering and returns all templates.
	List(ctx context.Context, auth domain.AuthInfo, isAdmin bool) ([]domain.SandboxTemplate, *domain.AppError)
	// Get returns a single template if it is visible to the caller. isAdmin=true
	// bypasses visibility filtering. Returns ErrCodeNotFound when the template
	// does not exist or the caller cannot see it (to avoid leaking names).
	Get(ctx context.Context, name string, auth domain.AuthInfo, isAdmin bool) (*domain.SandboxTemplate, *domain.AppError)
	// Admin only:
	Create(ctx context.Context, tmpl *agentsv1alpha1.SandboxTemplate) (*domain.SandboxTemplate, *domain.AppError)
	Update(ctx context.Context, tmpl *agentsv1alpha1.SandboxTemplate) (*domain.SandboxTemplate, *domain.AppError)
	Delete(ctx context.Context, name string) *domain.AppError
	// CreateOrUpdate upserts a SandboxTemplate. It is used by SyncService to apply
	// sync events from ws-proxy. The operation is idempotent: if the template already
	// exists its spec is replaced; otherwise it is created.
	CreateOrUpdate(ctx context.Context, tmpl *agentsv1alpha1.SandboxTemplate) *domain.AppError
	// StripStaleGlobalLabels removes the sync-source=global label from any local
	// template whose name is NOT present in knownNames. This corrects templates
	// that were mistakenly (or historically) labeled as global but no longer exist
	// on the master cluster, preventing delete requests from being forwarded to
	// ws-proxy and receiving a 404.
	StripStaleGlobalLabels(ctx context.Context, knownNames map[string]struct{}) *domain.AppError
}

type SyncHTTPError struct {
	Status  int
	Message string
}

type SyncService interface {
	// OnConnect registers a new ClientConn (produced by wsmux.DialGRPC after
	// a fresh /v1/ws/sync upgrade). Returns a connection generation ID that
	// must be passed back to OnDisconnect so that a stale teardown does not
	// race against a newer connect.
	OnConnect(conn *grpc.ClientConn) uint64

	// OnDisconnect tears down all background Watch goroutines associated
	// with connID and clears the ClientConn — but only if connID still
	// matches the currently-registered conn.
	OnDisconnect(connID uint64)

	RequestCreate(ctx context.Context, req CreateKeyRequest) (*CreateKeyResponse, error)
	RequestDelete(ctx context.Context, name string) error
	RequestTemplateCreate(ctx context.Context, raw json.RawMessage) error
	RequestTemplateUpdate(ctx context.Context, raw json.RawMessage) error
	RequestTemplateDelete(ctx context.Context, name string) error
}

type URLKind = cluster.URLKind