admin

type ApplyOptions struct {
	DryRun          bool
	Delete          bool
	ContinueOnError bool
	Reconcile       bool
}

type ApplyReport struct {
	Results []ApplyResult
	Failed  int
}

type ApplyResult struct {
	Resource  string `json:"resource"`
	Realm     string `json:"realm,omitempty"`
	Name      string `json:"name"`
	Action    string `json:"action"`
	Status    int    `json:"status"`
	Error     string `json:"error,omitempty"`
	CreatedID string `json:"createdId,omitempty"`
	// contains filtered or unexported fields
}

type ChildFetchQuery struct {
	// FullRepresentation requests briefRepresentation=false so children that
	// carry an attributes map (e.g. client roles) return it, matching the
	// representation flag on the realm-level fetch path (ISSUE 0001 parity).
	FullRepresentation bool
}

type Config struct {
	BaseURL  string
	SpecPath string
	Timeout  time.Duration

	// Auth optionally injects a custom auth.Service. When nil, admin.New
	// falls back to auth.New() (the password-grant default), preserving
	// backward compatibility. The syncengine migration injects a
	// client_credentials provider here.
	Auth auth.Service
}

type Error struct {
	Kind       ErrorKind
	Operation  string
	Resource   string
	StatusCode int
	Err        error
}

type ErrorKind string

type FetchFailure struct {
	Resource string
	Detail   string
	NotFound bool
	Err      error
}

type FetchQuery struct {
	Realm                string
	Resources            string
	Search               string
	Max                  int
	Parent               string
	IncludeRelationships bool
	Depth                int
	Filter               string
	ExactMatch           bool
	// FullRepresentation requests Keycloak's complete resource representation on
	// collection fetches by sending briefRepresentation=false. Keycloak's list
	// endpoints for users, groups and organizations otherwise return a brief
	// representation that omits the attributes map. The false default preserves
	// the existing brief behavior.
	FullRepresentation bool
}

type FetchReport struct {
	Resources     []manifest.Resource
	Relationships []manifest.RelationshipOperation
	Failures      []FetchFailure
}

type Service interface {
	Spec() *catalog.Spec
	Fetch(ctx context.Context, query FetchQuery) (FetchReport, error)
	// FetchChildren returns one child collection of one parent resource (e.g. the
	// roles of a client) with exactly one HTTP GET — no depth fan-out and no
	// realm-wide reference-resolution sweep. See fetch.go for the contract.
	FetchChildren(ctx context.Context, parent manifest.Resource, childType string, query ChildFetchQuery) (FetchReport, error)
	Apply(ctx context.Context, resources []manifest.Resource, relationships []manifest.RelationshipOperation, options ApplyOptions) (ApplyReport, error)
}