adminapi

type Authorizer interface {
	Authorize(ctx context.Context, capability string) (allowed bool, err error)
}

type AuthorizerFunc func(ctx context.Context, capability string) (bool, error)

type Extension struct {
	forge.BaseExtension
	// contains filtered or unexported fields
}

type IssuedKey struct {
	ID     string
	Prefix string
	Key    string
}

type KeyRecord struct {
	ID            string
	Prefix        string
	TenantID      string
	Label         string
	CanManageKeys bool
	CreatedAt     time.Time
	RevokedAt     *time.Time
	// ExpiresAt is nil for keys that never expire. Session tokens (issued via
	// IssueSession) always set it; the authn middleware denies a resolved key
	// once ExpiresAt is in the past, mirroring how RevokedAt is enforced.
	ExpiresAt *time.Time
}

type KeySpec struct {
	Label         string
	TenantID      string
	CanManageKeys bool
}

type KeyStore interface {
	// Issue mints a new key, persists its hash, and returns the plaintext once.
	Issue(ctx context.Context, spec KeySpec) (IssuedKey, error)
	// IssueSession mints a multi-tenant, manage-keys session token that
	// expires after ttl. It is the foundation for dashboard login: a session
	// is just an expiring KeyStore row, validated by the same middleware path
	// as any other API key.
	IssueSession(ctx context.Context, ttl time.Duration) (IssuedKey, error)
	// Lookup resolves a key by its sha256 hex hash with NO tenant scoping.
	// Revoked keys still return (found=true): revocation is enforced by the
	// middleware, not by hiding the row.
	Lookup(ctx context.Context, keyHash string) (rec KeyRecord, found bool, err error)
	// List returns every key as a redacted KeyRecord (no hash/plaintext).
	List(ctx context.Context) ([]KeyRecord, error)
	// Revoke stamps revoked_at on the key. The row stays visible to Lookup.
	Revoke(ctx context.Context, id string) error
}

type Option func(*config)