personaaccess

type Assignment struct {
	Roles []string `json:"roles"`
	// RoleMapping are the roles personas.role_mapping assigns to this
	// persona outright, before roles and priority are compared.
	RoleMapping []string `json:"role_mapping"`
	// FolderReaderRoles make a person a member of the persona's folder and
	// prompts: any of them, whatever persona the person resolves to.
	FolderReaderRoles []string `json:"folder_reader_roles"`
	// FolderWriterRole writes the persona's folder; administrators do too.
	FolderWriterRole string        `json:"folder_writer_role"`
	RoleOverlaps     []RoleOverlap `json:"role_overlaps"`
}

type Config struct {
	// Personas is the live registry: the other personas and their roles.
	Personas *persona.Registry
	// AdminPersona is the configured administrator persona's name.
	AdminPersona string
	// RoleMapping is personas.role_mapping.oidc_to_persona.
	RoleMapping map[string]string
	// ExcludedFromCalls is calls.exclude_personas.
	ExcludedFromCalls []string
	// Inventory reads what the deployment serves now.
	Inventory func(ctx context.Context) Inventory
	// DB holds the references; nil reports none.
	DB *sql.DB
	// FileKeyRoles are the roles of the API keys the configuration declares.
	FileKeyRoles [][]string
}

type ConnAccess struct {
	Name    string `json:"name"`
	Allowed bool   `json:"allowed"`
}

type ConnItem struct {
	Name           string   `json:"name"`
	Kind           string   `json:"kind"`
	Decision       string   `json:"decision"`
	Matched        string   `json:"matched,omitempty"`
	Exact          bool     `json:"exact"`
	Scratch        *Scratch `json:"scratch,omitempty"`
	UsedByChannels []string `json:"used_by_channels"`
}

type ConnSummary struct {
	Total   int        `json:"total"`
	Allowed int        `json:"allowed"`
	Items   []ConnItem `json:"items"`
}

type Connection struct {
	Name     string
	Kind     string
	Scratch  *Scratch
	Channels []string
}

type Draft struct {
	Name                      string                 `json:"name" example:"analyst"`
	DisplayName               string                 `json:"display_name,omitempty"`
	Description               string                 `json:"description,omitempty"`
	Roles                     []string               `json:"roles"`
	AllowTools                []string               `json:"allow_tools"`
	DenyTools                 []string               `json:"deny_tools,omitempty"`
	AllowConnections          []string               `json:"allow_connections,omitempty"`
	DenyConnections           []string               `json:"deny_connections,omitempty"`
	Priority                  int                    `json:"priority,omitempty"`
	DescriptionPrefix         string                 `json:"description_prefix,omitempty"`
	DescriptionOverride       string                 `json:"description_override,omitempty"`
	AgentInstructionsSuffix   string                 `json:"agent_instructions_suffix,omitempty"`
	AgentInstructionsOverride string                 `json:"agent_instructions_override,omitempty"`
	APIRoutes                 []persona.APIRouteRule `json:"api_routes,omitempty"`
	ServiceAccount            bool                   `json:"service_account,omitempty"`
	Portal                    *persona.PortalAccess  `json:"portal,omitempty"`
	External                  bool                   `json:"external,omitempty"`
	AllowSharing              *bool                  `json:"allow_sharing,omitempty"`
}

type Inventory struct {
	Tools       []Tool
	Connections []Connection
	Operations  []Operation
	// Registrations counts the scratch tables registered on each connection.
	Registrations map[string]int
}

type OpItem struct {
	Connection string `json:"connection"`
	Method     string `json:"method"`
	Path       string `json:"path"`
	Decision   string `json:"decision"`
	RuleIndex  int    `json:"rule_index"`
	Callable   bool   `json:"callable"`
}

type OpSummary struct {
	Total    int      `json:"total"`
	Callable int      `json:"callable"`
	Items    []OpItem `json:"items"`
}

type Operation struct {
	Connection string
	Method     string
	Path       string
}

type PortalSummary struct {
	Stored           persona.PortalAccess `json:"stored"`
	Effective        persona.PortalAccess `json:"effective"`
	CappedByExternal []string             `json:"capped_by_external"`
}

type References struct {
	Secrets        SecretRefs `json:"secrets"`
	ScriptGrants   int        `json:"script_grants"`
	ScriptVersions int        `json:"script_versions"`
	Prompts        int        `json:"prompts"`
	Shares         int        `json:"shares"`
	WebhookSources []string   `json:"webhook_sources"`
	APIKeys        int        `json:"api_keys"`
	// People are the addresses of the signed-in people whose recorded roles
	// resolve to the persona (#2290).
	People []string `json:"people"`
}

type Report struct {
	IsAdmin bool `json:"is_admin"`
	// AdminPersona is the configured administrator persona's name, which is
	// never external.
	AdminPersona          string        `json:"admin_persona"`
	AccountType           string        `json:"account_type"`
	CallsExcludedByConfig bool          `json:"calls_excluded_by_config"`
	Assignment            Assignment    `json:"assignment"`
	Tools                 ToolSummary   `json:"tools"`
	Connections           ConnSummary   `json:"connections"`
	APIOperations         OpSummary     `json:"api_operations"`
	Scratch               []ScratchItem `json:"scratch"`
	Portal                PortalSummary `json:"portal"`
	Sharing               bool          `json:"sharing"`
	ResourceScopes        []string      `json:"resource_scopes"`
	References            References    `json:"references"`
	Unscoped              Unscoped      `json:"unscoped"`
}

type RoleOverlap struct {
	Role     string `json:"role"`
	Persona  string `json:"persona"`
	Priority int    `json:"priority"`
}

type Scratch struct {
	Catalog string `json:"catalog"`
	Schema  string `json:"schema"`
	// Writes reports whether the connection accepts writes, which registering
	// a table and changing one through SQL both need.
	Writes bool `json:"-"`
}

type ScratchItem struct {
	Connection string `json:"connection"`
	Catalog    string `json:"catalog"`
	Schema     string `json:"schema"`
	// List and Register are the portal's scratch-table routes.
	List     bool `json:"list"`
	Register bool `json:"register"`
	// DropViaSQL is trino_execute on the connection, whose Trino user holds
	// every privilege on the scratch catalog: any registered table can be
	// dropped or replaced, whoever registered it.
	DropViaSQL    bool `json:"drop_via_sql"`
	Registrations int  `json:"registrations"`
	// QueryableFrom are the connections trino_query reaches that read every
	// registered table when their Trino user reads the scratch catalog.
	QueryableFrom []string `json:"queryable_from"`
}

type SecretRefs struct {
	Named        []string `json:"named"`
	Unrestricted int      `json:"unrestricted"`
}

type Service struct {
	// contains filtered or unexported fields
}

type Subject struct {
	Persona *persona.Persona
	// Admin reports the persona is the administrator persona.
	Admin bool
	// Others are the other registered personas, for role overlaps.
	Others []*persona.Persona
	// RoleMapping is personas.role_mapping.oidc_to_persona.
	RoleMapping map[string]string
	// ExcludedFromCalls is calls.exclude_personas.
	ExcludedFromCalls []string
}

type Tool struct {
	Name       string
	Kind       string
	Connection string
}

type ToolItem struct {
	Name        string       `json:"name"`
	Kind        string       `json:"kind,omitempty"`
	Decision    string       `json:"decision"`
	Matched     string       `json:"matched,omitempty"`
	Exact       bool         `json:"exact"`
	Connections []ConnAccess `json:"connections"`
	Callable    bool         `json:"callable"`
}

type ToolSummary struct {
	Total    int        `json:"total"`
	Callable int        `json:"callable"`
	Items    []ToolItem `json:"items"`
}

type Unscoped struct {
	// SignedInEndpoints admit any signed-in account, external included.
	SignedInEndpoints int `json:"signed_in_endpoints"`
}