package storage

import "time"

// RoleScope separates application-wide privileges from garden membership roles.
type RoleScope string

// Supported role scopes.
const (
	RoleScopeApplication RoleScope = "application"
	RoleScopeGarden      RoleScope = "garden"
)

// Role is a reusable, globally defined bundle of permissions.
type Role struct {
	Name        string    `json:"name"`
	Scope       RoleScope `json:"scope"`
	GardenID    *int      `json:"garden_id,omitempty"`
	Label       string    `json:"label"`
	System      bool      `json:"system"`
	Permissions []string  `json:"permissions"`
	CreatedAt   time.Time `json:"created_at"`
	UpdatedAt   time.Time `json:"updated_at"`
}

// GardenRolePermissionOverride grants or revokes one role permission in a
// single garden without modifying the shared role template.
type GardenRolePermissionOverride struct {
	GardenID   int    `json:"garden_id"`
	RoleName   string `json:"role_name"`
	Permission string `json:"permission"`
	Granted    bool   `json:"granted"`
}

// RoleModelInterface manages application roles, garden role templates, and
// garden-specific permission overrides.
type RoleModelInterface interface {
	List(scope RoleScope) ([]Role, error)
	ListForGarden(gardenID int) ([]Role, error)
	Get(name string) (Role, error)
	GetForGarden(gardenID int, name string) (Role, error)
	Create(role Role) (Role, error)
	Update(role Role) (Role, error)
	Delete(name string) error
	ListGardenOverrides(gardenID int) ([]GardenRolePermissionOverride, error)
	ReplaceGardenOverrides(gardenID int, roleName string, overrides []GardenRolePermissionOverride) error
}