// Package query contains typed repository filters for access-manager reads.
package query

import (
	"github.com/google/uuid"

	"github.com/codex-k8s/kodex/services/internal/access-manager/internal/domain/types/enum"
	"github.com/codex-k8s/kodex/services/internal/access-manager/internal/domain/types/value"
)

// CommandIdentity identifies one idempotent mutation command.
type CommandIdentity struct {
	CommandID      uuid.UUID
	IdempotencyKey string
}

// MembershipGraphFilter selects memberships for subject-side graph expansion.
type MembershipGraphFilter struct {
	Subject  value.SubjectRef
	Statuses []enum.MembershipStatus
}

// MembershipTargetFilter selects memberships that point to a graph target.
type MembershipTargetFilter struct {
	Target   value.SubjectRef
	Statuses []enum.MembershipStatus
}

// MembershipIdentity is the natural key of a membership edge.
type MembershipIdentity struct {
	SubjectType enum.MembershipSubjectType
	SubjectID   uuid.UUID
	TargetType  enum.MembershipTargetType
	TargetID    uuid.UUID
}

// AccessRuleFilter selects policy rules applicable to an access check.
type AccessRuleFilter struct {
	Subjects     []value.SubjectRef
	ActionKey    string
	ResourceType string
	ResourceID   string
	Scope        value.ScopeRef
}

// AccessRuleIdentity is the stable business identity of one policy rule.
type AccessRuleIdentity struct {
	Effect       enum.AccessEffect
	SubjectType  enum.AccessSubjectType
	SubjectID    string
	ActionKey    string
	ResourceType string
	ResourceID   string
	ScopeType    string
	ScopeID      string
}

// ExternalAccountUsageFilter selects an account binding for a requested usage.
type ExternalAccountUsageFilter struct {
	ExternalAccountID uuid.UUID
	ActionKey         string
	UsageScope        value.ScopeRef
}

// ExternalAccountBindingIdentity is the stable business identity of account usage binding.
type ExternalAccountBindingIdentity struct {
	ExternalAccountID uuid.UUID
	UsageScope        value.ScopeRef
}

// PackageInstallationSecretRefsFilter selects secret refs for a package installation.
type PackageInstallationSecretRefsFilter struct {
	PackageInstallationID uuid.UUID
	InstallationScope     value.ScopeRef
	LogicalKeys           []string
}

// PendingAccessFilter selects operator-visible access items that need attention.
type PendingAccessFilter struct {
	Scope  value.ScopeRef
	Limit  int
	Offset int
}
