environment

type CloneRequest struct {
	// SourceEnvID is the environment to clone from.
	SourceEnvID id.EnvironmentID

	// Name for the new environment (required).
	Name string

	// Slug for the new environment (required).
	Slug string

	// Type for the new environment (required).
	Type Type

	// Description for the new environment (optional).
	Description string

	// SettingsOverride merges on top of the source environment's settings (optional).
	SettingsOverride *Settings

	// WebhookURLOverride replaces webhook URLs in cloned webhooks (optional).
	WebhookURLOverride string
}

type CloneResult struct {
	// Environment is the newly created environment.
	Environment *Environment

	// RoleIDMap maps old role IDs to new role IDs.
	RoleIDMap map[string]string

	// PermissionIDMap maps old permission IDs to new permission IDs.
	PermissionIDMap map[string]string

	// WebhookIDMap maps old webhook IDs to new webhook IDs.
	WebhookIDMap map[string]string

	// RolesCloned is the number of roles cloned.
	RolesCloned int

	// PermissionsCloned is the number of permissions cloned.
	PermissionsCloned int

	// WebhooksCloned is the number of webhooks cloned.
	WebhooksCloned int
}

type CloneSource interface {
	// ListRolesForClone returns all roles in the source environment.
	ListRolesForClone(ctx context.Context, appID id.AppID, envID id.EnvironmentID) ([]*RoleForClone, error)

	// ListPermissionsForClone returns all permissions for one of the app's roles.
	ListPermissionsForClone(ctx context.Context, appID, roleID string) ([]*PermissionForClone, error)

	// ListWebhooksForClone returns all webhooks in the source environment.
	ListWebhooksForClone(ctx context.Context, appID id.AppID, envID id.EnvironmentID) ([]*WebhookForClone, error)
}

type CloneTarget interface {
	// CreateClonedRole creates a role in the target environment.
	CreateClonedRole(ctx context.Context, r *RoleForClone) error

	// CreateClonedPermission creates a permission in the target environment.
	CreateClonedPermission(ctx context.Context, p *PermissionForClone) error

	// CreateClonedWebhook creates a webhook in the target environment.
	CreateClonedWebhook(ctx context.Context, w *WebhookForClone) error
}

type Cloner struct {
	// contains filtered or unexported fields
}

type Environment struct {
	ID          id.EnvironmentID `json:"id"`
	AppID       id.AppID         `json:"app_id"`
	Name        string           `json:"name"`
	Slug        string           `json:"slug"`
	Type        Type             `json:"type"`
	IsDefault   bool             `json:"is_default"`
	Color       string           `json:"color,omitempty"`
	Description string           `json:"description,omitempty"`
	Settings    *Settings        `json:"settings,omitempty"`
	ClonedFrom  id.EnvironmentID `json:"cloned_from,omitempty"`
	Metadata    Metadata         `json:"metadata,omitempty"`
	CreatedAt   time.Time        `json:"created_at"`
	UpdatedAt   time.Time        `json:"updated_at"`
}

type List struct {
	Environments []*Environment `json:"environments"`
	Total        int            `json:"total"`
}

type Metadata map[string]string

type OAuthProviderOverride struct {
	ClientID     string `json:"client_id"`
	ClientSecret string `json:"client_secret,omitempty"`
	RedirectURL  string `json:"redirect_url,omitempty"`
}

type PermissionForClone struct {
	ID       string
	AppID    string
	RoleID   string
	Action   string
	Resource string
}

type Query struct {
	AppID id.AppID `json:"app_id"`
	Type  Type     `json:"type,omitempty"`
}

type RoleForClone struct {
	ID          string
	AppID       string
	EnvID       string
	ParentID    string
	Name        string
	Slug        string
	Description string
}

type Settings struct {
	// Auth behavior overrides.
	SkipEmailVerification *bool `json:"skip_email_verification,omitempty"`
	AllowTestCredentials  *bool `json:"allow_test_credentials,omitempty"`

	// Session overrides.
	TokenTTLSeconds        *int `json:"token_ttl_seconds,omitempty"`
	RefreshTokenTTLSeconds *int `json:"refresh_token_ttl_seconds,omitempty"`
	// TokenExchangeTTLSeconds caps RFC 8693 token exchange for this env.
	TokenExchangeTTLSeconds *int `json:"token_exchange_ttl_seconds,omitempty"`

	// Password policy overrides.
	PasswordMinLength *int  `json:"password_min_length,omitempty"`
	CheckBreached     *bool `json:"check_breached,omitempty"`

	// Rate limit overrides.
	RateLimitEnabled    *bool `json:"rate_limit_enabled,omitempty"`
	SignInRateLimit     *int  `json:"signin_rate_limit,omitempty"`
	SignUpRateLimit     *int  `json:"signup_rate_limit,omitempty"`
	RateLimitWindowSecs *int  `json:"rate_limit_window_seconds,omitempty"`

	// Lockout overrides.
	LockoutEnabled     *bool `json:"lockout_enabled,omitempty"`
	LockoutMaxAttempts *int  `json:"lockout_max_attempts,omitempty"`

	// Webhook URL override (for dev/staging webhook receivers).
	WebhookURLOverride string `json:"webhook_url_override,omitempty"`

	// Social/OAuth provider overrides (different client IDs per environment).
	OAuthOverrides map[string]OAuthProviderOverride `json:"oauth_overrides,omitempty"`
}

type Store interface {
	// CreateEnvironment persists a new environment.
	CreateEnvironment(ctx context.Context, e *Environment) error

	// GetEnvironment retrieves an environment by ID.
	GetEnvironment(ctx context.Context, envID id.EnvironmentID) (*Environment, error)

	// GetEnvironmentBySlug retrieves an environment by app ID and slug.
	GetEnvironmentBySlug(ctx context.Context, appID id.AppID, slug string) (*Environment, error)

	// GetDefaultEnvironment retrieves the default environment for an app.
	GetDefaultEnvironment(ctx context.Context, appID id.AppID) (*Environment, error)

	// UpdateEnvironment updates an existing environment.
	UpdateEnvironment(ctx context.Context, e *Environment) error

	// DeleteEnvironment removes an environment by ID.
	// Returns an error if the environment is the default for its app.
	DeleteEnvironment(ctx context.Context, envID id.EnvironmentID) error

	// ListEnvironments returns all environments for an app.
	ListEnvironments(ctx context.Context, appID id.AppID) ([]*Environment, error)

	// SetDefaultEnvironment sets the given environment as the default for its app,
	// clearing the default flag on any previously default environment.
	SetDefaultEnvironment(ctx context.Context, appID id.AppID, envID id.EnvironmentID) error
}

type Type string

type WebhookForClone struct {
	ID     string
	AppID  string
	EnvID  string
	URL    string
	Events []string
	Secret string
	Active bool
}