migrate

type BlobMode string

type ConcernSummary struct {
	Concern string `json:"concern"`
	Items   int    `json:"items"`
	Bytes   int    `json:"bytes"`
	Refused int    `json:"refused,omitempty"`
}

type ConfigStore interface {
	// Get returns the text of name; ok is false when it is absent.
	Get(ctx context.Context, name string) (value string, ok bool, err error)
	// Create writes name only if it is absent.
	Create(ctx context.Context, name, value string) error
}

type Domains struct {
	Workspaces  hub.Store
	Credentials hub.CredentialStore
	Orgs        orgStore
	Links       linkStore
	Runner      runnerStore
	Catalogue   catalogueStore
	SlackApps   slackCatalogueStore
	Slack       slackStore
	Shared      sharedStore
	Channels    channelStore
	SessionKey  sessionKeys
}

type LayoutItem struct {
	// Source is the v3 Secrets path, or `state:<record>` for an App whose ids
	// are in State.
	Source string `json:"source"`
	// Address is where it goes in v4: `internal/...`, `external/<kind>/<id>`
	// or `internal/config/...`.
	Address string `json:"address"`
	// Action is new, resume (a rotation half written), unchanged, conflict,
	// or, for the deletion, delete or missing.
	Action string `json:"action"`
	// V3Version and V4Revision are the versions a conflict is between.
	V3Version  string `json:"v3Version,omitempty"`
	V4Revision string `json:"v4Revision,omitempty"`
	Note       string `json:"note,omitempty"`
}

type Options struct {
	// DryRun plans and reports and writes nothing, the destination's objects
	// included.
	DryRun bool
	// Overwrite replaces what the destination holds with the source's. Without
	// it a destination value that differs fails the run, naming the key.
	Overwrite bool
	// WritersStopped is the operator's statement that nothing writes to the
	// source. A copy is a snapshot: a write during it is a copy of neither
	// state. A run that writes refuses without it.
	WritersStopped bool
	// Sessions also copies the issuer's logins in progress (sessions, refresh
	// tokens, the codes in flight, the Index sets). An installation's move does
	// not: people sign in again, and only the key ring's schedule is copied, so
	// that a token issued before the move keeps verifying.
	Sessions bool
	// Skip names domains left out (see the Domain constants).
	Skip []string
	// Blobs says whether the controllers' reports are copied.
	Blobs BlobMode
	// ReportBlob, when set, is a Blob name the report is also written to on
	// the destination (not by a dry run).
	ReportBlob string
	// ExportedGitHubApp says which catalogue GitHub Apps of the destination have
	// `export: true` (layout v4). Nil exports none; a runner App is always
	// exported.
	ExportedGitHubApp func(id string) bool
	// Log receives progress. Nil is silent.
	Log *slog.Logger
	// Now is the clock the copied lifetimes are measured against; nil is
	// time.Now. For tests, which inject the delay between reading and writing.
	Now func() time.Time
}

type Problem struct {
	Domain string `json:"domain"`
	Kind   string `json:"kind"`
	Key    string `json:"key"`
	Reason string `json:"reason"`
}

type Report struct {
	From        string    `json:"from"`
	To          string    `json:"to"`
	FromAdapter string    `json:"fromAdapter"`
	ToAdapter   string    `json:"toAdapter"`
	DryRun      bool      `json:"dryRun"`
	Overwrite   bool      `json:"overwrite"`
	StartedAt   time.Time `json:"startedAt"`
	FinishedAt  time.Time `json:"finishedAt"`
	Steps       []Step    `json:"steps"`
	Totals      Step      `json:"totals"`
	Conflicts   []Problem `json:"conflicts,omitempty"`
	Unreadable  []Problem `json:"unreadable,omitempty"`
	Mismatches  []Problem `json:"mismatches,omitempty"`
	// Refused are the items the destination would refuse, and why.
	Refused []Problem `json:"refused,omitempty"`
	// Concerns is the summary per concern: state, secrets, blobs.
	Concerns []ConcernSummary `json:"concerns,omitempty"`
	// Notes say what was left out and why (a domain skipped, a side with
	// nothing to read).
	Notes []string `json:"notes,omitempty"`
	// Error is how the run ended, if it did not end well.
	Error string `json:"error,omitempty"`
	// OK is true when the plan had no conflict, nothing unreadable, and, unless
	// this was a dry run, every item verified.
	OK bool `json:"ok"`
}

type SSMAPI interface {
	GetParametersByPath(ctx context.Context, in *awsssm.GetParametersByPathInput, opts ...func(*awsssm.Options)) (*awsssm.GetParametersByPathOutput, error)
	PutParameter(ctx context.Context, in *awsssm.PutParameterInput, opts ...func(*awsssm.Options)) (*awsssm.PutParameterOutput, error)
	DescribeParameters(ctx context.Context, in *awsssm.DescribeParametersInput, opts ...func(*awsssm.Options)) (*awsssm.DescribeParametersOutput, error)
}

type SSMConfig struct {
	API  SSMConfigAPI
	Root string
	// KMSKeyID encrypts what is written; empty is the AWS-managed key.
	KMSKeyID string
}

type SSMConfigAPI interface {
	GetParameter(ctx context.Context, in *awsssm.GetParameterInput, opts ...func(*awsssm.Options)) (*awsssm.GetParameterOutput, error)
	PutParameter(ctx context.Context, in *awsssm.PutParameterInput, opts ...func(*awsssm.Options)) (*awsssm.PutParameterOutput, error)
}

type SSMLayoutOptions struct {
	// From is the v2 root (`/sluis`), To the v3 one (`/sluis/<instance>`).
	From, To string
	// KMSKeyID encrypts what is written. Empty keeps each parameter's own key:
	// a customer key is never silently replaced by the AWS-managed one.
	KMSKeyID string
	// DryRun plans and writes nothing; Overwrite replaces a parameter that
	// is already there with a different value.
	DryRun, Overwrite bool
}

type SSMLayoutReport struct {
	// Account and Region are where it ran, as STS and the SDK say: what an
	// operator checks before trusting a dry run.
	Account   string   `json:"account,omitempty"`
	Region    string   `json:"region,omitempty"`
	From      string   `json:"from"`
	To        string   `json:"to"`
	Copied    []string `json:"copied"`
	Unchanged []string `json:"unchanged"`
	Conflicts []string `json:"conflicts,omitempty"`
	DryRun    bool     `json:"dryRun"`
}

type SecretsLayoutOptions struct {
	// V3 is the layout-v3 Secrets port of the installation (its `private/`
	// tree, not the layout-aware one), State the port its App records are in.
	V3    port.Secrets
	State port.State
	// Dest are the v4 stores, Config the plain-text parameters.
	Dest   *secretstore.Stores
	Config ConfigStore
	// ExportedGitHubApp says which catalogue GitHub Apps have `export: true`
	// (a runner App is always exported). Nil exports none.
	ExportedGitHubApp func(id string) bool
	// DryRun plans and writes nothing.
	DryRun bool
	// Layout is the installation's `secrets.layout` (DeleteV3 only).
	Layout string
	// Now is the clock a rotated client's previous secret is judged by.
	Now func() time.Time
}

type SecretsLayoutReport struct {
	To        string       `json:"to,omitempty"`
	DryRun    bool         `json:"dryRun"`
	Items     []LayoutItem `json:"items"`
	New       int          `json:"new"`
	Unchanged int          `json:"unchanged"`
	Conflicts int          `json:"conflicts,omitempty"`
	Written   int          `json:"written"`
	Verified  int          `json:"verified"`
	Deleted   int          `json:"deleted,omitempty"`
	// Skipped are v3 paths not migrated on purpose (the retired exports
	// copies); DeleteV3 removes them.
	Skipped []string `json:"skipped,omitempty"`
	OK      bool     `json:"ok"`
	Error   string   `json:"error,omitempty"`
}

type Side struct {
	// Name labels it in the report: the configuration file it came from.
	Name string
	// Stores is the opened ports.
	Stores *store.Stores
	// BlobID identifies where this side keeps blobs, so that two sides that
	// share a place are known to; empty is "nowhere shared".
	BlobID string
	// SecretsLayout is the `secrets.layout` of an ssm secrets source (v3, the
	// default, transition or v4); empty when the secrets are not in ssm.
	SecretsLayout string
}

type Step struct {
	Domain string `json:"domain"`
	Kind   string `json:"kind"`
	// Source is how many readable items the source holds.
	Source int `json:"source"`
	// Unreadable is how many it holds that its store cannot present: they are
	// listed and not copied.
	Unreadable int `json:"unreadable,omitempty"`
	// New is how many the destination lacks, Present how many it already holds
	// with the same value, and Conflicts how many it holds with another.
	New       int `json:"new"`
	Present   int `json:"present"`
	Conflicts int `json:"conflicts,omitempty"`
	// Copied is how many were written: New, and with Overwrite the Conflicts.
	Copied int `json:"copied"`
	// Verified is how many matched on the second read; Mismatched how many did
	// not.
	Verified   int `json:"verified"`
	Mismatched int `json:"mismatched,omitempty"`
	// Refused is how many the destination would refuse (an item over a size
	// limit, an invalid key): they are listed under refused and stop the run
	// before anything is written.
	Refused int `json:"refused,omitempty"`
	// Bytes is the size of the readable source items (a record with its
	// credentials, a blob, a State value); Secrets and SecretBytes are the
	// credentials among them, which go to the Secrets port.
	Bytes       int `json:"bytes"`
	Secrets     int `json:"secrets,omitempty"`
	SecretBytes int `json:"secretBytes,omitempty"`
}