storage

type APIKeyStore struct {
	// contains filtered or unexported fields
}

type BackendConfig struct {
	Type       string
	SQLitePath string
	Postgres   PostgresConnectionConfig
	GatewayID  string
}

type ConfigStore struct {
	TopicManager *TopicManager
	// contains filtered or unexported fields
}

type LazyResource struct {
	// ID uniquely identifies this resource within its type
	ID string `json:"id" yaml:"id"`

	// ResourceType identifies the type of resource (e.g., "LlmProviderTemplate")
	ResourceType string `json:"resource_type" yaml:"resource_type"`

	// Resource contains the actual resource data as a map
	Resource map[string]interface{} `json:"resource" yaml:"resource"`
}

type LazyResourceStore struct {
	// contains filtered or unexported fields
}

type PolicyStore struct {
	// contains filtered or unexported fields
}

type PostgresConnectionConfig struct {
	DSN             string
	Host            string
	Port            int
	Database        string
	User            string
	Password        string
	SSLMode         string
	ConnectTimeout  time.Duration
	MaxOpenConns    int
	MaxIdleConns    int
	ConnMaxLifetime time.Duration
	ConnMaxIdleTime time.Duration
	ApplicationName string
}

type PostgresStorage struct {
	// contains filtered or unexported fields
}

type RuntimeConfigStore struct {
	// contains filtered or unexported fields
}

type SQLiteStorage struct {
	// contains filtered or unexported fields
}

type Storage interface {
	// SaveConfig persists a new API configuration.
	//
	// Returns an error if a configuration with the same name and version already exists.
	// Implementations should ensure this operation is atomic (all-or-nothing).
	SaveConfig(cfg *models.StoredConfig) error

	// UpdateConfig updates an existing API configuration.
	//
	// Returns an error if the configuration does not exist.
	// Implementations should ensure this operation is atomic and thread-safe.
	UpdateConfig(cfg *models.StoredConfig) error

	// UpsertConfig performs a timestamp-guarded insert-or-update of an API configuration.
	// It inserts the config if it does not exist, or updates it only if the incoming
	// deployed_at timestamp is newer than the existing one. This prevents stale events
	// (from sync or WebSocket) from overwriting newer data.
	//
	// Returns (true, nil) if the row was actually inserted or updated.
	// Returns (false, nil) if the row exists with a newer deployed_at (stale event — no-op).
	// Returns (false, error) on database errors.
	UpsertConfig(cfg *models.StoredConfig) (bool, error)

	// DeleteConfig removes an API configuration by ID.
	//
	// Returns an error if the configuration does not exist.
	// Implementations should ensure related data (if any) is cleaned up.
	DeleteConfig(id string) error

	// GetConfig retrieves an API configuration by ID.
	//
	// Returns an error if the configuration is not found.
	// This is the fastest lookup method (O(1) for most databases).
	GetConfig(id string) (*models.StoredConfig, error)

	// GetConfigByKindAndHandle retrieves an API configuration by kind and handle.
	//
	// Returns an error if the configuration is not found.
	// The handle is the metadata.name from the API YAML configuration.
	// The kind filter prevents cross-kind reads (e.g. fetching a WebSub API when a REST API is expected).
	// This is the recommended lookup method for REST API endpoints.
	GetConfigByKindAndHandle(kind string, handle string) (*models.StoredConfig, error)

	// GetConfigByKindNameAndVersion retrieves an API configuration by kind, display name, and version.
	//
	// Returns an error if the configuration is not found.
	GetConfigByKindNameAndVersion(kind, displayName, version string) (*models.StoredConfig, error)

	// GetAllConfigs retrieves all API configurations.
	//
	// Returns an empty slice if no configurations exist.
	// May be expensive for large datasets; consider pagination in future versions.
	GetAllConfigs() ([]*models.StoredConfig, error)

	// GetAllConfigsByKind retrieves all API configurations of a specific kind.
	//
	// Returns an empty slice if no configurations of the specified kind exist.
	// May be expensive for large datasets; consider pagination in future versions.
	GetAllConfigsByKind(kind string) ([]*models.StoredConfig, error)

	// GetAllConfigsByOrigin retrieves artifact metadata for all configs with the
	// given origin. Only the artifacts table is queried (no resource-table JOINs),
	// so the Configuration field will be nil. This is intended for sync diff
	// computation where only metadata (UUID, Kind, DesiredState, DeployedAt) is needed.
	//
	// Returns an empty slice if no configurations of the specified origin exist.
	GetAllConfigsByOrigin(origin models.Origin) ([]*models.StoredConfig, error)

	// SaveLLMProviderTemplate persists a new LLM provider template.
	//
	// Returns an error if a template with the same name already exists.
	// Implementations should ensure this operation is atomic (all-or-nothing).
	SaveLLMProviderTemplate(template *models.StoredLLMProviderTemplate) error

	// UpdateLLMProviderTemplate updates an existing LLM provider template.
	//
	// Returns an error if the template does not exist.
	// Implementations should ensure this operation is atomic and thread-safe.
	UpdateLLMProviderTemplate(template *models.StoredLLMProviderTemplate) error

	// DeleteLLMProviderTemplate removes an LLM provider template by ID.
	//
	// Returns an error if the template does not exist.
	DeleteLLMProviderTemplate(id string) error

	// GetLLMProviderTemplate retrieves an LLM provider template by ID.
	//
	// Returns an error if the template is not found.
	// This is the fastest lookup method (O(1) for most databases).
	GetLLMProviderTemplate(id string) (*models.StoredLLMProviderTemplate, error)

	// GetAllLLMProviderTemplates retrieves all LLM provider templates.
	//
	// Returns an empty slice if no templates exist.
	// May be expensive for large datasets; consider pagination in future versions.
	GetAllLLMProviderTemplates() ([]*models.StoredLLMProviderTemplate, error)

	// GetLLMProviderTemplateByHandle retrieves an LLM provider template by handle.
	//
	// Returns an error if the template is not found.
	GetLLMProviderTemplateByHandle(handle string) (*models.StoredLLMProviderTemplate, error)

	// SaveAPIKey persists a new API key.
	//
	// Returns an error if an API key with the same key value already exists.
	// Implementations should ensure this operation is atomic (all-or-nothing).
	SaveAPIKey(apiKey *models.APIKey) error

	// UpsertAPIKey inserts or updates an API key identified by (gateway_id, artifact_uuid, name).
	//
	// If a key with the same name already exists for the artifact, it is updated only when the
	// incoming record's updated_at is strictly newer than the stored one — preventing a slow
	// bulk-sync goroutine from overwriting a more recent event-driven write.
	// The existing source and external_ref_id are preserved when the incoming values are absent.
	UpsertAPIKey(apiKey *models.APIKey) error

	// GetAPIKeyByID retrieves an API key by its ID.
	//
	// Returns an error if the API key is not found.
	// This is used for API key validation during authentication.
	GetAPIKeyByID(id string) (*models.APIKey, error)

	// GetAPIKeyByUUID retrieves an API key by its platform UUID.
	//
	// Returns an error if the API key is not found.
	GetAPIKeyByUUID(uuid string) (*models.APIKey, error)

	// GetAPIKeyByKey retrieves an API key by its key value.
	//
	// Returns an error if the API key is not found.
	// This is used for API key validation during authentication.
	GetAPIKeyByKey(key string) (*models.APIKey, error)

	// GetAPIKeysByAPI retrieves all API keys for a specific API.
	//
	// Returns an empty slice if no API keys exist for the API.
	// Used for listing API keys associated with an API.
	GetAPIKeysByAPI(apiId string) ([]*models.APIKey, error)

	// GetAllAPIKeys retrieves all active API keys from the database.
	//
	// Returns an empty slice if no active API keys exist.
	// Used for loading active API keys into memory on startup.
	GetAllAPIKeys() ([]*models.APIKey, error)

	// GetAPIKeysByAPIAndName retrieves an API key by its name within a specific API.
	//
	// Returns an error if the API key is not found.
	// Used for retrieving specific API keys by name.
	GetAPIKeysByAPIAndName(apiId, name string) (*models.APIKey, error)

	// UpdateAPIKey updates an existing API key (e.g., to revoke or expire it).
	//
	// Returns an error if the API key does not exist.
	// Implementations should ensure this operation is atomic and thread-safe.
	UpdateAPIKey(apiKey *models.APIKey) error

	// DeleteAPIKey removes an API key by its key value.
	//
	// Returns an error if the API key does not exist.
	DeleteAPIKey(key string) error

	// RemoveAPIKeysAPI removes all API keys for a specific API.
	//
	// Returns an error if API key removal fails.
	RemoveAPIKeysAPI(apiId string) error

	// RemoveAPIKeyAPIAndName removes an API key by its API apiId and name.
	//
	// Returns an error if the API key does not exist.
	RemoveAPIKeyAPIAndName(apiId, name string) error

	// CountActiveAPIKeysByUserAndAPI counts active API keys for a specific user and API.
	//
	// Returns the count of active API keys and an error if the operation fails.
	CountActiveAPIKeysByUserAndAPI(apiId, userID string) (int, error)

	// ListAPIKeysForArtifactsNotIn returns the minimal key info (uuid + artifact_uuid) for
	// keys whose artifact_uuid is in artifactUUIDs but whose own UUID is not in keyUUIDs.
	// Used to collect identifiers before deletion so callers can publish EventHub events.
	ListAPIKeysForArtifactsNotIn(artifactUUIDs []string, keyUUIDs []string) ([]*models.APIKey, error)

	// DeleteAPIKeysByUUIDs removes API keys by their UUIDs. Used after ListAPIKeysForArtifactsNotIn
	// has already identified the stale keys, avoiding a redundant NOT IN query.
	DeleteAPIKeysByUUIDs(uuids []string) error

	SaveSubscriptionPlan(plan *models.SubscriptionPlan) error
	GetSubscriptionPlanByID(id, gatewayID string) (*models.SubscriptionPlan, error)
	ListSubscriptionPlans(gatewayID string) ([]*models.SubscriptionPlan, error)
	UpdateSubscriptionPlan(plan *models.SubscriptionPlan) error
	DeleteSubscriptionPlan(id, gatewayID string) error

	// DeleteSubscriptionPlansNotIn removes plans for this gateway whose IDs are not in the given set.
	// Used for bulk-sync reconciliation when plans were deleted on the control plane during downtime.
	DeleteSubscriptionPlansNotIn(ids []string) error

	// SaveSubscription persists a new subscription.
	SaveSubscription(sub *models.Subscription) error

	// GetSubscriptionByID retrieves a subscription by ID and gateway.
	GetSubscriptionByID(id, gatewayID string) (*models.Subscription, error)

	// ListSubscriptionsByAPI returns subscriptions for an API with optional filters.
	ListSubscriptionsByAPI(apiID, gatewayID string, applicationID *string, status *string) ([]*models.Subscription, error)

	// ListActiveSubscriptions returns all ACTIVE subscriptions for this gateway in one query.
	// Used for bulk snapshot generation to avoid N+1 per-API lookups.
	ListActiveSubscriptions() ([]*models.Subscription, error)

	// UpdateSubscription updates an existing subscription.
	UpdateSubscription(sub *models.Subscription) error

	// DeleteSubscription removes a subscription by ID and gateway.
	DeleteSubscription(id, gatewayID string) error

	// DeleteSubscriptionsForAPINotIn removes subscriptions for the given API whose IDs are not in the set.
	// Used for bulk-sync reconciliation when subscriptions were deleted on the control plane during downtime.
	DeleteSubscriptionsForAPINotIn(apiID string, ids []string) error
	// ReplaceApplicationAPIKeyMappings atomically replaces all API key mappings for an application.
	//
	// Existing mappings are removed and the supplied mapping set is inserted.
	ReplaceApplicationAPIKeyMappings(application *models.StoredApplication, mappings []*models.ApplicationAPIKeyMapping) error

	// SaveCertificate persists a new certificate.
	//
	// Returns an error if a certificate with the same name already exists.
	// Implementations should ensure this operation is atomic.
	SaveCertificate(cert *models.StoredCertificate) error

	// GetCertificate retrieves a certificate by ID.
	//
	// Returns an error if the certificate is not found.
	GetCertificate(id string) (*models.StoredCertificate, error)

	// GetCertificateByName retrieves a certificate by name.
	//
	// Returns an error if the certificate is not found.
	GetCertificateByName(name string) (*models.StoredCertificate, error)

	// ListCertificates retrieves all certificates ordered by creation time.
	//
	// Returns an empty slice if no certificates exist.
	ListCertificates() ([]*models.StoredCertificate, error)

	// DeleteCertificate removes a certificate by ID.
	//
	// Returns an error if the certificate does not exist.
	DeleteCertificate(id string) error

	// SaveSecret persists a new encrypted secret.
	//
	// Returns an error if a secret with the same handle already exists.
	// Implementations should ensure this operation is atomic.
	SaveSecret(secret *models.Secret) error

	// GetSecrets retrieves metadata for all secrets.
	//
	// Returns non-sensitive metadata (handle, display_name, timestamps) without
	// ciphertext or values. Returns an empty slice if no secrets exist.
	GetSecrets() ([]models.SecretMeta, error)

	// GetSecret retrieves a secret by handle.
	//
	// Returns error if the secret does not exist.
	GetSecret(handle string) (*models.Secret, error)

	// UpdateSecret updates an existing secret.
	//
	// Returns the updated secret (including database-assigned timestamps) or error
	// if the secret does not exist. Implementations should ensure this operation is atomic.
	UpdateSecret(secret *models.Secret) (*models.Secret, error)

	// DeleteSecret permanently removes a secret.
	//
	// Returns error if the secret does not exist.
	DeleteSecret(handle string) error

	// SecretExists checks if a secret with the given handle exists.
	//
	// Returns true if the secret exists, false otherwise.
	SecretExists(handle string) (bool, error)

	// GetDB returns the underlying *sql.DB for direct access.
	// Used by EventHub for event synchronization.
	// Returns nil for non-SQL backends.
	GetDB() *sql.DB

	// Close closes the storage connection and releases resources.
	//
	// Should be called during graceful shutdown.
	// Implementations should ensure all pending writes are flushed.
	Close() error
}

type TopicManager struct {
	// contains filtered or unexported fields
}