connalert

type Alert struct {
	// Kind is the connection kind (mcp, api, graphql).
	Kind string
	// Name is the connection name within the kind.
	Name string
	// AuthorizedBy is the identity that authorized the connection, and the
	// address the first alert goes to.
	AuthorizedBy string
	// IDPHost is the host of the upstream that rejected the refresh. Empty
	// when the platform reached the verdict without calling it.
	IDPHost string
	// Reason is the stable short form the auth-event history records.
	Reason string
	// RevokedAt is when the credential was discarded, and the instant the
	// escalation window is measured from.
	RevokedAt time.Time
}

type AlertStore interface {
	// Open records a revocation and reports whether this call is the one that
	// recorded it. It loses when the connection already has an open
	// revocation, which is the whole de-duplication mechanism: a connection
	// that keeps being called is announced once rather than once per rejected
	// call.
	Open(ctx context.Context, a Alert) (bool, error)
	// Clear forgets a connection's open revocation. Called when the connection
	// is authorized again, which is what makes a later revocation news.
	Clear(ctx context.Context, kind, name string) error
	// ClaimEscalations stamps and returns every revocation older than window
	// that has not been escalated and whose connection is still unauthorized.
	// Stamping and selecting are one statement, so two replicas sweeping at
	// once cannot both claim a row.
	ClaimEscalations(ctx context.Context, window time.Duration, now time.Time) ([]Alert, error)
}

type Alerter struct {
	// contains filtered or unexported fields
}

type Config struct {
	// Settings holds the operator's escalation window and recipients.
	Settings SettingsStore
	// Alerts holds the open revocations.
	Alerts AlertStore
	// Enqueuer is the notification substrate's trigger-side entry point.
	Enqueuer *notification.Enqueuer
	// BaseURL is the portal's public base URL, for the alert's deep link.
	BaseURL string
	// Interval overrides DefaultSweepInterval. Testing hook.
	Interval time.Duration
	// Now overrides time.Now. Testing hook.
	Now func() time.Time
}

type Escalator struct {
	// contains filtered or unexported fields
}

type PostgresStore struct {
	// contains filtered or unexported fields
}

type Settings struct {
	// Enabled turns both alerts on. Off, a revocation is still recorded in the
	// auth-event history and on the status card exactly as before — what is
	// turned off is telling anyone.
	Enabled bool `json:"enabled"`
	// EscalateAfterHours is how long a revoked connection goes unauthorized
	// before Recipients are told. Zero or less applies
	// DefaultEscalateAfterHours.
	EscalateAfterHours int `json:"escalate_after_hours"`
	// Recipients are the addresses the escalation is delivered to, in
	// notification.NormalizeAddress form. Empty is the default and means no
	// escalation: the person who authorized the connection is still told, and
	// nobody else is.
	//
	// They are addresses rather than a role because the platform stores no
	// directory of administrators — admin is a claim on a token at request
	// time, so there is no set of people to resolve. Naming them is also what
	// makes the escalation a deliberate choice about who is accountable for a
	// connection rather than a broadcast.
	Recipients []string `json:"recipients"`
	// UpdatedBy and UpdatedAt describe the last admin write. They live in the
	// platform_settings audit columns, which are authoritative, so they are
	// excluded from the section value rather than written into it twice.
	UpdatedBy string    `json:"-"`
	UpdatedAt time.Time `json:"-"`
}

type SettingsInput struct {
	Enabled            bool     `json:"enabled" example:"true"`
	EscalateAfterHours int      `json:"escalate_after_hours" example:"24"`
	Recipients         []string `json:"recipients" example:"platform-admin@example.com"`
}

type SettingsStore interface {
	// Get returns the stored configuration, or ErrNotFound when the alert has
	// never been configured.
	Get(ctx context.Context) (*Settings, error)
	// Set upserts the configuration.
	Set(ctx context.Context, s Settings, author string) error
}

type SettingsView struct {
	Enabled            bool      `json:"enabled" example:"true"`
	EscalateAfterHours int       `json:"escalate_after_hours" example:"24"`
	Recipients         []string  `json:"recipients"`
	UpdatedBy          string    `json:"updated_by,omitempty" example:"admin@example.com"`
	UpdatedAt          time.Time `json:"updated_at"`
	// Warnings describes a configuration that saves cleanly but escalates
	// nowhere. They never block a save; they exist so the operator sees what
	// the setting does at the surface where it was chosen.
	Warnings []string `json:"warnings,omitempty"`
}