checklog

type Entry struct {
	ID            id.CheckLogID  `json:"id" db:"id"`
	TenantID      string         `json:"tenant_id" db:"tenant_id"`
	NamespacePath string         `json:"namespace_path,omitempty" db:"namespace_path"`
	AppID         string         `json:"app_id" db:"app_id"`
	SubjectKind   string         `json:"subject_kind" db:"subject_kind"`
	SubjectID     string         `json:"subject_id" db:"subject_id"`
	Action        string         `json:"action" db:"action"`
	ResourceType  string         `json:"resource_type" db:"resource_type"`
	ResourceID    string         `json:"resource_id" db:"resource_id"`
	Decision      string         `json:"decision" db:"decision"`
	Reason        string         `json:"reason,omitempty" db:"reason"`
	MatchedBy     []MatchRef     `json:"matched_by,omitempty" db:"matched_by"`
	Obligations   []string       `json:"obligations,omitempty" db:"obligations"`
	EvalTimeNs    int64          `json:"eval_time_ns" db:"eval_time_ns"`
	RequestIP     string         `json:"request_ip,omitempty" db:"request_ip"`
	RequestID     string         `json:"request_id,omitempty" db:"request_id"`
	TraceID       string         `json:"trace_id,omitempty" db:"trace_id"`
	Cached        bool           `json:"cached" db:"cached"`
	Error         string         `json:"error,omitempty" db:"error"`
	Metadata      map[string]any `json:"metadata,omitempty" db:"metadata"`
	CreatedAt     time.Time      `json:"created_at" db:"created_at"`
}

type MatchRef struct {
	Source string `json:"source" db:"source"`
	RuleID string `json:"rule_id,omitempty" db:"rule_id"`
	Detail string `json:"detail,omitempty" db:"detail"`
}

type QueryFilter struct {
	TenantID        string  `json:"tenant_id,omitempty"`
	NamespacePath   *string `json:"namespace_path,omitempty"`
	NamespacePrefix string  `json:"namespace_prefix,omitempty"`
	SubjectKind     string  `json:"subject_kind,omitempty"`
	SubjectID       string  `json:"subject_id,omitempty"`
	Action          string  `json:"action,omitempty"`
	ResourceType    string  `json:"resource_type,omitempty"`
	ResourceID      string  `json:"resource_id,omitempty"`
	Decision        string  `json:"decision,omitempty"`
	// Cached narrows to rows served from the result cache (true) or rows
	// the engine evaluated (false). Nil means either.
	Cached *bool      `json:"cached,omitempty"`
	After  *time.Time `json:"after,omitempty"`
	Before *time.Time `json:"before,omitempty"`
	Limit  int        `json:"limit,omitempty"`
	Offset int        `json:"offset,omitempty"`
}

type Store interface {
	// CreateCheckLog persists a new check log entry.
	CreateCheckLog(ctx context.Context, e *Entry) error

	// GetCheckLog retrieves a check log entry by ID within a tenant. Returns
	// ErrCheckLogNotFound when the entry is not in the tenant.
	GetCheckLog(ctx context.Context, tenantID string, logID id.CheckLogID) (*Entry, error)

	// ListCheckLogs returns check log entries matching the filter.
	ListCheckLogs(ctx context.Context, filter *QueryFilter) ([]*Entry, error)

	// CountCheckLogs returns the number of entries matching the filter.
	CountCheckLogs(ctx context.Context, filter *QueryFilter) (int64, error)

	// PurgeCheckLogs removes check log entries older than the given time, in
	// every tenant.
	PurgeCheckLogs(ctx context.Context, before time.Time) (int64, error)

	// PurgeCheckLogsForTenant removes one tenant's check log entries older
	// than the given time and reports how many rows it removed. No other
	// tenant's entries are touched. An empty tenantID returns
	// wardenerr.ErrTenantRequired and deletes nothing; it never means every
	// tenant.
	PurgeCheckLogsForTenant(ctx context.Context, tenantID string, before time.Time) (int64, error)

	// DeleteCheckLogsBySubject removes a tenant's check logs for one subject
	// and reports how many rows it removed. Used to service erasure requests.
	DeleteCheckLogsBySubject(ctx context.Context, tenantID, subjectKind, subjectID string) (int64, error)

	// DeleteCheckLogsByTenant removes all check logs for a tenant.
	DeleteCheckLogsByTenant(ctx context.Context, tenantID string) error
}