controld

type AgentCredential struct {
	UserID, Provider   string
	Ciphertext, Nonce  []byte
	Version            uint64
	Revoked            bool
	LastRevokedVersion uint64
	UpdatedAt          time.Time
}

type AgentCredentialRows interface {
	// GetAgentCredential returns the row, or control.ErrNotFound.
	GetAgentCredential(ctx context.Context, userID, provider string) (AgentCredential, error)
	// PutAgentCredential inserts or replaces the row and returns the stored
	// version.
	//
	// c.Version is the version the CALLER has already sealed c.Ciphertext
	// for, and the write succeeds only when it is exactly one more than the
	// stored row's (or when there is no stored row). Anything else is
	// control.ErrConflict and nothing changes. That guard is what makes the
	// stored version always the version the ciphertext was sealed against,
	// under concurrency: two sessions of one person racing each other cannot
	// both land on the same version, and the loser re-reads, re-seals, and
	// tries again rather than storing a blob that will never open.
	//
	// A c.Version of 0 is control.ErrInvalid: versions start at 1, and 0 is
	// the wire's word for "there is no set".
	PutAgentCredential(ctx context.Context, c AgentCredential) (version uint64, err error)
	// RevokeAgentCredential replaces the row with a tombstone whose monotonic
	// version fences every put that began before logout. The fence remains in
	// LastRevokedVersion after a later login. It returns the new version;
	// revoking an absent row creates version 1.
	RevokeAgentCredential(ctx context.Context, userID, provider string) (uint64, error)
	ConditionalRevokeAgentCredential(ctx context.Context, userID, provider string, expected uint64) (uint64, error)
	// ListAgentCredentials returns userID's rows ordered by provider, with
	// Ciphertext and Nonce left NIL. A listing renders a status — provider,
	// version, timestamp — so it never reads the sealed bytes at all, which
	// is a stronger guarantee than clearing them afterwards would be.
	ListAgentCredentials(ctx context.Context, userID string) ([]AgentCredential, error)
}

type AgentVault struct {
	// contains filtered or unexported fields
}

type Config struct {
	// RunnerToken is the fleet-wide bearer every runnerd presents on
	// /v0/runners/connect (and, later, on the attach-back dial).
	RunnerToken string
	// SecretsKey is the AES-256 key team secrets are sealed under at rest
	// (seal.go), parsed from RAINIER_SECRETS_KEY by ParseSecretsKey. It is
	// required and has no default: a zero key means "unconfigured", and New
	// refuses to start rather than seal every team secret under a key of
	// zeros. Losing it loses secret values and nothing else.
	SecretsKey [32]byte
	// Admins and Members are GitHub logins; a login in neither list cannot
	// log in at all (fail closed — an empty allowlist admits nobody).
	Admins  []string
	Members []string
	// GitHubAPIBase is the base URL of GitHub's API, overridden in tests.
	GitHubAPIBase string
	// ExternalURL is the http(s) base URL that both clients and runners
	// reach this replica at. The attach plane derives the runner's
	// dial-back ws URL from it, so it must be absolute and routable from
	// the fleet — not "localhost" on a multi-host deployment.
	ExternalURL string
	// OpTimeout is the budget for one dispatch round-trip to a runner.
	OpTimeout time.Duration
	// AttachWait bounds how long WS /v0/sessions/{id}/attach waits for the
	// session to reach `running` before answering 503 session_not_ready.
	// Zero means defaultAttachWait; tests shorten it.
	AttachWait time.Duration
	// AttachPairTTL bounds how long a parked client socket waits for its
	// runner's dial-back before controld closes it. Zero means
	// defaultAttachPairTTL; tests shorten it.
	AttachPairTTL time.Duration
	// MaxTransferBytes is the most this replica relays in one file transfer,
	// either direction; zero means workspace.MaxBytes; tests lower it.
	MaxTransferBytes int64
}

type Credential struct {
	UserID, Provider                string
	Ciphertext, Nonce               []byte // sealed access token
	RefreshCiphertext, RefreshNonce []byte // nullable; unused in v0
	Status                          string // CredentialValid | CredentialNeedsRefresh
	Scopes                          string // informational; what the provider said it granted
	ObtainedAt                      time.Time
	ExpiresAt                       *time.Time // nil when the provider named no expiry
	LastVerifiedAt                  time.Time
	LastUsedAt                      time.Time
	UpdatedAt                       time.Time
}

type HostStore interface {
	// EnsureWorkspace makes ws exist; idempotent. New calls it for the
	// installation workspace, the repository contract suite for its two.
	EnsureWorkspace(ctx context.Context, ws control.WorkspaceID) error

	UpsertUser(ctx context.Context, githubID int64, login, role string) (User, error)
	InsertToken(ctx context.Context, userID, tokenHash string) error
	UserByToken(ctx context.Context, tokenHash string) (User, error)
	GetUser(ctx context.Context, id string) (User, error)

	PutSecret(ctx context.Context, name string, ciphertext, nonce []byte) error
	ListSecrets(ctx context.Context) ([]SecretMeta, error)
	GetSecret(ctx context.Context, name string) (ciphertext, nonce []byte, err error)
	DeleteSecret(ctx context.Context, name string) error

	UpsertCredential(ctx context.Context, c Credential) error
	GetCredential(ctx context.Context, userID, provider string) (Credential, error)
	SetCredentialStatus(ctx context.Context, userID, provider, status string) error
	TouchCredentialUsed(ctx context.Context, userID, provider string) error
	ListCredentials(ctx context.Context, userID string) ([]Credential, error)

	// The agent credential rows, in the same vault the git credential lives
	// in and under the same discipline. They are embedded rather than listed
	// so the narrow port and the wide one cannot drift apart.
	AgentCredentialRows

	// EnvironmentByName resolves a name inside ws to the id the service is
	// then asked for. The name index is a locator, never authority: the
	// caller still fetches through the service, which authorizes.
	EnvironmentByName(ctx context.Context, ws control.WorkspaceID, name string) (control.EnvironmentID, error)
	// SnapshotRunner names the runner that built id's cached snapshot, ""
	// when there is none — stale or not, because the wire has always shown
	// the column. It decides nothing.
	SnapshotRunner(ctx context.Context, ws control.WorkspaceID, id control.EnvironmentID) (control.RunnerID, error)
	// SnapshotHolder names the runner holding the snapshot with ref in ws,
	// "" when no environment's current cache has it. A cache whose hash no
	// longer matches its environment's setup hash is stale and holds
	// nothing, which is the difference between this and SnapshotRunner: this
	// one is asked where a checkpoint can boot, and a stale image is not an
	// answer to that. An empty workspace or ref is control.ErrInvalid.
	SnapshotHolder(ctx context.Context, ws control.WorkspaceID, ref string) (control.RunnerID, error)
	// NextRunnerGeneration opens a new generation for id in pool and returns
	// it: 1 for a runner never seen, else one more than stored. It is the
	// only writer of the generation the fleet repository fences on.
	NextRunnerGeneration(ctx context.Context, pool control.PoolID, id control.RunnerID) (uint64, error)
}

type MemStore interface {
	Store
	// Events returns a copy of every event recorded so far, in the order it
	// was recorded. It exists for tests above the store: nothing in the
	// process consumes an event, and the in-memory store is the durable home
	// of nothing, so keeping them costs only what a test then reads back.
	Events() []control.Event
}

type Repositories interface {
	Sessions() control.SessionRepository
	Environments() control.EnvironmentRepository
	Fleet() control.FleetRepository
}

type SecretMeta struct {
	Name      string
	CreatedAt time.Time
	UpdatedAt time.Time
}

type Server struct {
	// contains filtered or unexported fields
}

type Store interface {
	HostStore
	control.UnitOfWork
	control.EventRecorder
	Repositories
}

type User struct {
	ID        string
	GitHubID  int64
	Login     string
	Role      string
	CreatedAt time.Time
}