middleware

type AuditEvent struct {
	Timestamp    time.Time      `json:"timestamp"`
	RequestID    string         `json:"request_id"`
	UserID       string         `json:"user_id"`
	UserEmail    string         `json:"user_email"`
	Persona      string         `json:"persona"`
	ToolName     string         `json:"tool_name"`
	ToolkitKind  string         `json:"toolkit_kind"`
	ToolkitName  string         `json:"toolkit_name"`
	Connection   string         `json:"connection"`
	Parameters   map[string]any `json:"parameters"`
	Success      bool           `json:"success"`
	ErrorMessage string         `json:"error_message,omitempty"`
	DurationMS   int64          `json:"duration_ms"`
}

type AuditLogger interface {
	// Log records an audit event.
	Log(ctx context.Context, event AuditEvent) error
}

type Authenticator interface {
	// Authenticate validates credentials and returns user info.
	Authenticate(ctx context.Context) (*UserInfo, error)
}

type Authorizer interface {
	// IsAuthorized checks if the user can use the tool.
	// Returns:
	//   - authorized: whether the user is authorized
	//   - personaName: the resolved persona name (for audit logging)
	//   - reason: reason for denial (empty if authorized)
	IsAuthorized(ctx context.Context, userID string, roles []string, toolName string) (authorized bool, personaName string, reason string)
}

type EnrichmentConfig struct {
	// EnrichTrinoResults adds semantic context to Trino tool results.
	EnrichTrinoResults bool

	// EnrichDataHubResults adds query context to DataHub tool results.
	EnrichDataHubResults bool

	// EnrichS3Results adds semantic context to S3 tool results.
	EnrichS3Results bool

	// EnrichDataHubStorageResults adds storage context to DataHub tool results.
	EnrichDataHubStorageResults bool
}

type NoopAuditLogger struct{}

type NoopAuthenticator struct {
	DefaultUserID string
	DefaultRoles  []string
}

type NoopAuthorizer struct{}

type PlatformContext struct {
	// Request identification
	RequestID string
	StartTime time.Time

	// User information
	UserID      string
	UserEmail   string
	UserClaims  map[string]any
	Roles       []string
	PersonaName string

	// Tool information
	ToolName    string
	ToolkitKind string
	ToolkitName string
	Connection  string

	// Authorization
	Authorized bool
	AuthzError string

	// Results (populated after handler)
	Success      bool
	ErrorMessage string
	Duration     time.Duration
}

type TableRef struct {
	Catalog  string
	Schema   string
	Table    string
	FullPath string
	Source   string // "FROM", "JOIN", "TABLE_FUNCTION"
}

type ToolkitLookup interface {
	// GetToolkitForTool returns toolkit info (kind, name, connection) for a tool.
	// Returns found=false if the tool is not found in any registered toolkit.
	GetToolkitForTool(toolName string) (kind, name, connection string, found bool)
}

type UserInfo struct {
	UserID   string
	Email    string
	Claims   map[string]any
	Roles    []string
	AuthType string // "oidc", "apikey", etc.
}