hostkey

type HostKey struct {
	Meta meta.Metadata `json:"metadata" yaml:"metadata"`
	Spec Spec          `json:"spec"     yaml:"spec"`

	// Resolved is the cleartext value reconstructed at load time (read from
	// the env var or decrypted from PG). Runtime-only; never serialized.
	Resolved string `json:"-" yaml:"-"`
	// KeyHash is sha256 hex (first 6 bytes) of Resolved, for telemetry.
	KeyHash string `json:"-" yaml:"-"`

	// Derived: populated by the control-API enrich step from the catalog
	// snapshot; not stored and not loaded from YAML. Lists every user
	// Policy whose Spec.HostKeyIDs references this HostKey, so the admin
	// UI can show where a key is in use.
	Policies []PolicyRef `json:"policies,omitempty" yaml:"-"`
}

type PolicyRef struct {
	ID   string `json:"id"`
	Name string `json:"name"`
}

type RotateResult struct {
	Rotated    int
	NewVersion int32
}

type Spec struct {
	// HostID is the id of the Host this key authenticates to. Required.
	// Replaces the pre-refactor Meta.Owner pointing at a Host.
	HostID string `json:"hostId" yaml:"hostId" validate:"required"`

	// PolicyID is the id of the host-owned tier Policy this key mirrors.
	// Required: every key must declare an upstream tier so the pipeline
	// has rate-limit rules to apply. The referenced Policy must be host-
	// owned (Owner.Kind=host) AND its Owner.ID must equal HostID — i.e.
	// a key can only mirror a policy belonging to its own host. Cross-
	// entity validation lives in the composition layer.
	PolicyID    string    `json:"policyId" yaml:"policyId" validate:"required"`
	ValueFrom   ValueFrom `json:"valueFrom"             yaml:"valueFrom"             validate:"required"`
	DefaultTier string    `json:"defaultTier,omitempty" yaml:"defaultTier,omitempty" validate:"omitempty,slug"`
	Enabled     *bool     `json:"enabled,omitempty"     yaml:"enabled,omitempty"` // nil = true

	// Value is cleartext on the write path for ValueKindStored. Accepted
	// from JSON and YAML inputs; never returned on reads — Store.Get
	// never repopulates it, and marshalSpec strips it before any JSONB
	// persistence. The `omitempty` tag combined with that read-side
	// invariant keeps cleartext out of GET responses.
	Value string `json:"value,omitempty" yaml:"value,omitempty"`
}

type Store struct {
	// contains filtered or unexported fields
}

type ValueFrom struct {
	Kind ValueKind `json:"kind"          yaml:"kind"          validate:"required,oneof=env stored"`
	Env  string    `json:"env,omitempty" yaml:"env,omitempty"`
}

type ValueKind string