plugin

type AuthSkipPathProvider interface {
	AuthSkipPaths() []string
}

type Deps struct {
	DB       *database.DB
	Config   *config.Server
	Logger   *slog.Logger
	EventHub eventhub.EventHub

	// ArtifactTableRegistry allows plugins to register their own artifact-backed
	// tables so that cross-table UNION queries in the core repos include them.
	ArtifactTableRegistry *repository.ArtifactTableRegistry

	// Core repositories shared with plugins (interfaces).
	GatewayRepo    repository.GatewayRepository
	OrgRepo        repository.OrganizationRepository
	ProjectRepo    repository.ProjectRepository
	ArtifactRepo   repository.ArtifactRepository
	DeploymentRepo repository.DeploymentRepository
	APIKeyRepo     repository.APIKeyRepository
	AuditRepo      repository.AuditRepository
	SecretRepo     repository.SecretRepository
	APIRepo        repository.APIRepository

	// Core services shared with plugins.
	GatewayEventsService *service.GatewayEventsService
	APIKeyService        *service.APIKeyService
	IdentityService      *service.IdentityService

	// DBEncryptionKey is the derived hex key used for encrypted DB columns.
	DBEncryptionKey string
}

type EventArtifactPlugin interface {
	Plugin
	GetWebSubAPIRepo() repository.WebSubAPIRepository
	GetWebBrokerAPIRepo() repository.WebBrokerAPIRepository
	GetHmacSecretService() HmacSecretServicer
}

type HmacSecretServicer interface {
	ListByArtifactUUID(artifactUUID string) ([]*model.WebSubAPIHmacSecret, error)
	DecryptSecret(s *model.WebSubAPIHmacSecret) (string, error)
}

type MiddlewareProvider interface {
	Middleware() []pdk.PositionedMiddleware
}

type Plugin interface {
	// Name returns a short identifier for the plugin (e.g. "eventgateway").
	Name() string

	// Init receives shared platform infrastructure and wires the plugin's own
	// internal components (repos, services, handlers). Called once at startup
	// before routes are registered.
	Init(deps *Deps) error

	// RegisterRoutes adds the plugin's HTTP routes to the shared mux.
	// Only called after Init has succeeded.
	RegisterRoutes(mux *http.ServeMux)

	// OpenAPISpec returns the plugin's OpenAPI 3.x YAML bytes used to merge
	// scope requirements into the platform scope registry. It is mandatory:
	// returning empty bytes or bytes the registry loader rejects aborts startup.
	//
	// The merged registry is what ScopeEnforcer consults on each request, keyed
	// by the matched route pattern. Declare the scopes each route requires
	// (GO-AUTH-007).
	OpenAPISpec() []byte

	// Shutdown is called during graceful server shutdown.
	Shutdown(ctx context.Context) error
}