clientcreds

type Hooks struct {
	// Lock serialises a write to an existing record (the orphaned mark) with
	// a rotation of the same client. A secrets adapter whose conditional
	// write is a read and then a write (ssm) needs it. Nil runs unserialised,
	// which is right only for one process.
	Lock Locker
	// Orphaned is called once for each record newly found with no generated
	// client in the policy. See [ReconcileOrphans].
	Orphaned func(ctx context.Context, clientID string)
	// Outcome is called once per client per pass. err is set for
	// OutcomeUnsupported and OutcomeFailed.
	Outcome func(ctx context.Context, clientID string, outcome Outcome, err error)
}

type Input interface {
	Get(ctx context.Context, name string) (string, error)
}

type Locker interface {
	Do(ctx context.Context, kind, target string, fn func(ctx context.Context)) (ran bool, err error)
}

type Lookup interface {
	// Resolve returns the client's secrets, false when it has none.
	Resolve(ctx context.Context, clientID string) (Secrets, bool)
}

type Manager struct {
	Store port.Secrets
	// Lock serialises writers of one client's record (see [KindLease]). Nil
	// runs unserialised, which is right only for one process.
	Lock Locker
	// Resolver is told to forget a client after its record changes, so this
	// replica serves the new value at once; another replica's cache lapses
	// within [CacheTTL]. May be nil.
	Resolver *Resolver
	// Generated says whether the policy in force declares the client with
	// `secret: {generate: true}`.
	Generated func(clientID string) bool
	// Now replaces the clock, for a test.
	Now func() time.Time
	Log *slog.Logger
}

type Meta struct {
	// Exists is false when the client has no record.
	Exists bool
	// Generated is whether the policy in force declares the client generated.
	Generated          bool
	Created, Rotated   time.Time
	HasPrevious        bool
	PreviousValidUntil time.Time
	// PreviousActive is whether the previous secret is still accepted now.
	PreviousActive bool
	Orphaned       time.Time
}

type Outcome string

type Overlapper interface{ Overlap() time.Duration }

type Record struct {
	V       int    `json:"v"`
	Current string `json:"current"`
	// Previous is the secret Current replaced, accepted until
	// PreviousValidUntil so a rotation does not cut a relying party off.
	Previous           string    `json:"previous,omitempty"`
	PreviousValidUntil time.Time `json:"previous_valid_until,omitzero"`
	Created            time.Time `json:"created"`
	Rotated            time.Time `json:"rotated,omitzero"`
	// Orphaned is when reconcile first found the record with no generated
	// client of that id in the policy. It is how the finding is reported once;
	// a client that comes back clears it and keeps the record as it is.
	Orphaned time.Time `json:"orphaned,omitzero"`
}

type Resolver struct {
	// contains filtered or unexported fields
}

type Result struct {
	Outcomes map[string]Outcome
}

type Rotation struct {
	Rotated            time.Time
	Overlap            time.Duration
	PreviousValidUntil time.Time
	// DiscardedPrevious is set when a rotation was made while the one before
	// still had an open overlap: that older secret stopped being accepted.
	DiscardedPrevious bool
}

type Secrets struct {
	Current string
	// Previous is the secret Current replaced; empty when there is none.
	// It is accepted only while now is before PreviousValidUntil.
	Previous           string
	PreviousValidUntil time.Time
}