scripttoken

type Authority func(roles []string) (persona string, admin bool)

type Binding struct {
	Endpoint string
	ScriptID string
}

type Caller interface {
	CallTool(ctx context.Context, name string, args map[string]any) (map[string]any, error)
}

type DecryptRequest struct {
	Form    string
	Payload map[string]any
	Persona string
	Admin   bool
	At      Binding
}

type Decrypter interface {
	Decrypt(ctx context.Context, req DecryptRequest) (values map[string]any, opened []string, err error)
}

type Host struct {
	// Ctx is the run's context.
	Ctx context.Context //nolint:containedctx // the run's lifetime, which both members read
	// Testing is a test or a replay: calls go to Replay.
	Testing bool
	// Replay answers a test's calls, from the recording or a declared answer.
	Replay Caller
	// Live answers a run's calls; nil where this deployment issues no tokens.
	Live Caller
	// Record records a run's call and its answer, nil when nothing records.
	Record func(tool string, args, out map[string]any, err error)
}

type Issuer struct {
	Keys KeyReader
	Uses Uses
	// Authority resolves a run's roles to its persona; nil resolves none, so
	// only a key naming no personas can be used.
	Authority Authority
	// Now is the clock; nil is time.Now.
	Now func() time.Time
	// contains filtered or unexported fields
}

type KeyReader func(ctx context.Context, name, persona string, admin bool) (string, error)

type Mint struct {
	Claims map[string]any
	TTL    time.Duration
	// Endpoints names the endpoints the token verifies at; empty binds it to
	// where it was minted.
	Endpoints []string
	SingleUse bool
}

type PostgresUses struct {
	// contains filtered or unexported fields
}

type Token struct {
	Claims    map[string]any
	Expires   time.Time
	ID        string
	SingleUse bool
}

type Uses interface {
	// Use records the token's id until it expires and reports whether this
	// was its first use.
	Use(ctx context.Context, id string, expires time.Time) (bool, error)
	// Sweep deletes the records of tokens that have expired.
	Sweep(ctx context.Context, now time.Time) (int64, error)
}