caskin

type Action = string

type Backend struct {
	Path        string `json:"path"        toml:"path"`
	Method      string `json:"method"      toml:"method"`
	Description string `json:"description" toml:"description"`
	Group       string `json:"group"       toml:"group"`
}

type CountDirectoryItem = func([]uint64) (map[uint64]uint64, error)

type CreatorObject struct {
	Name        string `json:"name"        toml:"name"`
	Type        string `json:"type"        toml:"type"`
	Description string `json:"description" toml:"description"`
}

type CreatorPolicy struct {
	Object string   `json:"object" toml:"object"`
	Role   string   `json:"role"   toml:"role"`
	Action []string `json:"action" toml:"action"`
}

type CreatorRole struct {
	Name        string `json:"name"        toml:"name"`
	Description string `json:"description" toml:"description"`
}

type DBOption struct {
	// DSN is the data source name (connection string) for the database.
	DSN string `json:"dsn"`
	// Type selects the database driver. Supported values: "sqlite", "mysql"
	// (default when empty), and "postgres".
	Type string `json:"type"`
}

type DictionaryOption struct {
	Dsn  string `json:"dsn"`
	Type string `json:"type"`
}

type Directory struct {
	Object
	// AllDirectoryCount is the total number of directory nodes in the subtree.
	AllDirectoryCount uint64 `json:"all_directory_count"`
	// AllItemCount is the total number of leaf items in the subtree.
	AllItemCount uint64 `json:"all_item_count"`
	// TopDirectoryCount is the number of direct child directories.
	TopDirectoryCount uint64 `json:"top_directory_count"`
	// TopItemCount is the number of direct child items.
	TopItemCount uint64 `json:"top_item_count"`
}

type DirectoryRequest struct {
	// To is the target parent object ID for move operations.
	To uint64 `json:"to,omitempty"`
	// ID is the list of object IDs to operate on.
	ID []uint64 `json:"id,omitempty"`
	// Type is the ObjectType filter.
	Type string `json:"type,omitempty"`
	// Policy is an optional policy filter string.
	Policy string `json:"policy,omitempty"`
	// SearchType controls the scope of the directory traversal;
	// see [DirectorySearchAll] and [DirectorySearchTop].
	SearchType string `json:"search_type,omitempty"`
	// CountDirectory is an optional callback that returns per-directory item counts.
	CountDirectory func([]uint64) (map[uint64]uint64, error)
	// ActionDirectory is an optional callback that performs a side effect on a set of directories.
	ActionDirectory func([]uint64) error
}

type DirectoryResponse struct {
	// DoneDirectoryCount is the number of directories already at the destination.
	DoneDirectoryCount uint64 `json:"done_directory_count,omitempty"`
	// DoneItemCount is the number of items already at the destination.
	DoneItemCount uint64 `json:"done_item_count,omitempty"`
	// ToDoDirectoryCount is the number of directories moved/copied.
	ToDoDirectoryCount uint64 `json:"to_do_directory_count,omitempty"`
	// ToDoItemCount is the number of items moved/copied.
	ToDoItemCount uint64 `json:"to_do_item_count,omitempty"`
}

type DirectorySearchType = string

type Domain interface {
	// contains filtered or unexported methods
}

type EdgeSorter[T cmp.Ordered] map[T]int

type Factory interface {
	// User decodes a casbin subject string into a User.
	User(string) (User, error)
	// Role decodes a casbin role string into a Role.
	Role(string) (Role, error)
	// Object decodes a casbin object string into an Object.
	Object(string) (Object, error)
	// Domain decodes a casbin domain string into a Domain.
	Domain(string) (Domain, error)
	// NewUser returns a zero-value User of the registered concrete type.
	NewUser() User
	// NewRole returns a zero-value Role of the registered concrete type.
	NewRole() Role
	// NewObject returns a zero-value Object of the registered concrete type.
	NewObject() Object
	// NewDomain returns a zero-value Domain of the registered concrete type.
	NewDomain() Domain
	// MetadataDB wraps the given GORM database with the registered type
	// information and returns a [MetaDB] implementation.
	MetadataDB(db *gorm.DB) MetaDB
}

type Feature struct {
	Name        string `json:"name"        toml:"name"`
	Description string `json:"description" toml:"description"`
	Group       string `json:"group"       toml:"group"`
}

type Frontend struct {
	Name        string `json:"name"        toml:"name"`
	Type        string `json:"type"        toml:"type"`
	Description string `json:"description" toml:"description"`
	Group       string `json:"group"       toml:"group"`
}

type IBaseService interface {
	// AddSuperadmin adds a superadmin user
	AddSuperadmin(User) error
	// DeleteSuperadmin deletes a superadmin user
	DeleteSuperadmin(User) error
	// GetSuperadmin gets all superadmin users
	GetSuperadmin() ([]User, error)

	// CreateUser creates a new user
	CreateUser(User) error
	// RecoverUser recovers a deleted user
	RecoverUser(User) error
	// DeleteUser deletes a user
	DeleteUser(User) error
	// UpdateUser updates a user
	UpdateUser(User) error

	// CreateDomain creates a new domain
	CreateDomain(Domain) error
	// RecoverDomain recovers a deleted domain
	RecoverDomain(Domain) error
	// DeleteDomain deletes a domain
	DeleteDomain(Domain) error
	// UpdateDomain updates a domain
	UpdateDomain(Domain) error
	// GetDomain gets all domains
	GetDomain() ([]Domain, error)
	// ResetDomain resets a domain to its initial state
	ResetDomain(Domain) error

	// CreateObject creates a new object in a domain
	CreateObject(User, Domain, Object) error
	// RecoverObject recovers a deleted object in a domain
	RecoverObject(User, Domain, Object) error
	// DeleteObject deletes an object in a domain
	DeleteObject(User, Domain, Object) error
	// UpdateObject updates an object in a domain
	UpdateObject(User, Domain, Object) error
	// GetObject gets all objects in a domain that the user can perform an action on
	GetObject(User, Domain, Action, ...ObjectType) ([]Object, error)
	// GetObjectHierarchyLevel gets the hierarchy level of an object in a domain
	GetObjectHierarchyLevel(user User, domain Domain, object Object) (int, error)

	// CreateRole creates a new role in a domain
	CreateRole(User, Domain, Role) error
	// RecoverRole recovers a deleted role in a domain
	RecoverRole(User, Domain, Role) error
	// DeleteRole deletes a role in a domain
	DeleteRole(User, Domain, Role) error
	// UpdateRole updates a role in a domain
	UpdateRole(User, Domain, Role) error
	// GetRole gets all roles in a domain
	GetRole(User, Domain) ([]Role, error)

	// AddUserRole adds user-role pairs in a domain
	AddUserRole(User, Domain, []*UserRolePair) error
	// RemoveUserRole removes user-role pairs in a domain
	RemoveUserRole(User, Domain, []*UserRolePair) error
	// AddRoleG adds a role inheritance relation in a domain
	AddRoleG(User, Domain, Role, Role) error
	// RemoveRoleG removes a role inheritance relation in a domain
	RemoveRoleG(User, Domain, Role, Role) error

	// GetUserByDomain gets all users in a domain
	GetUserByDomain(Domain) ([]User, error)
	// GetDomainByUser gets all domains that a user belongs to
	GetDomainByUser(User) ([]Domain, error)

	// GetUserRole gets all user-role pairs in a domain
	GetUserRole(User, Domain) ([]*UserRolePair, error)
	// GetUserRoleByUser gets all user-role pairs in a domain for a specific user
	GetUserRoleByUser(User, Domain, User) ([]*UserRolePair, error)
	// GetUserRoleByRole gets all user-role pairs in a domain for a specific role
	GetUserRoleByRole(User, Domain, Role) ([]*UserRolePair, error)
	// ModifyUserRolePerUser modifies the user-role pairs in a domain for a specific user
	ModifyUserRolePerUser(User, Domain, User, []*UserRolePair) error
	// ModifyUserRolePerRole modifies the user-role pairs in a domain for a specific role
	ModifyUserRolePerRole(User, Domain, Role, []*UserRolePair) error

	// GetPolicy gets all policies in a domain
	GetPolicy(User, Domain) ([]*Policy, error)
	// GetPolicyByRole gets all policies in a domain for a specific role
	GetPolicyByRole(User, Domain, Role) ([]*Policy, error)
	// ModifyPolicyPerRole modifies the policies in a domain for a specific role
	ModifyPolicyPerRole(User, Domain, Role, []*Policy) error

	// CreateObjectData creates a new object data in a domain with an object type
	CreateObjectData(User, Domain, ObjectData, ObjectType) error
	// RecoverObjectData recovers a deleted object data in a domain
	RecoverObjectData(User, Domain, ObjectData) error
	// DeleteObjectData deletes an object data in a domain
	DeleteObjectData(User, Domain, ObjectData) error
	// UpdateObjectData updates an object data in a domain with an object type
	UpdateObjectData(User, Domain, ObjectData, ObjectType) error

	// CheckCreateObjectData checks if the user can create an object data in a domain with an object type
	CheckCreateObjectData(User, Domain, ObjectData, ObjectType) error
	// CheckRecoverObjectData checks if the user can recover an object data in a domain
	CheckRecoverObjectData(User, Domain, ObjectData) error
	// CheckDeleteObjectData checks if the user can delete an object data in a domain
	CheckDeleteObjectData(User, Domain, ObjectData) error
	// CheckWriteObjectData checks if the user can write an object data in a domain with an object type
	CheckWriteObjectData(User, Domain, ObjectData, ObjectType) error
	// CheckUpdateObjectData checks if the user can update an object data in a domain with an object type
	CheckUpdateObjectData(User, Domain, ObjectData, ObjectType) error
	// CheckModifyObjectData checks if the user can modify an object data in a domain
	CheckModifyObjectData(User, Domain, ObjectData) error
	// CheckGetObjectData checks if the user can get an object data in a domain
	CheckGetObjectData(User, Domain, ObjectData) error
}

type ICreatorDictionary interface {
	// GetCreatorObject returns the object templates to seed into a new domain.
	GetCreatorObject() ([]*CreatorObject, error)
	// GetCreatorRole returns the role templates to seed into a new domain.
	GetCreatorRole() ([]*CreatorRole, error)
	// GetCreatorPolicy returns the policy templates to seed into a new domain.
	GetCreatorPolicy() ([]*CreatorPolicy, error)
}

type ICurrentService interface {
	// SetCurrent sets the current user and domain for the service and returns a new service instance
	SetCurrent(User, Domain) IService

	// CreateObjectDataWithCurrent creates a new object data in the current domain with an object type
	CreateObjectDataWithCurrent(ObjectData, ObjectType) error
	// RecoverObjectDataWithCurrent recovers a deleted object data in the current domain
	RecoverObjectDataWithCurrent(ObjectData) error
	// DeleteObjectDataWithCurrent deletes an object data in the current domain
	DeleteObjectDataWithCurrent(ObjectData) error
	// UpdateObjectDataWithCurrent updates an object data in the current domain with an object type
	UpdateObjectDataWithCurrent(ObjectData, ObjectType) error

	// CheckCreateObjectDataWithCurrent checks if the current user can create an object data in the current domain with an object type
	CheckCreateObjectDataWithCurrent(ObjectData, ObjectType) error
	// CheckRecoverObjectDataWithCurrent checks if the current user can recover an object data in the current domain
	CheckRecoverObjectDataWithCurrent(ObjectData) error
	// CheckDeleteObjectDataWithCurrent checks if the current user can delete an object data in the current domain
	CheckDeleteObjectDataWithCurrent(ObjectData) error
	// CheckWriteObjectDataWithCurrent checks if the current user can write an object data in the current domain with an object type
	CheckWriteObjectDataWithCurrent(ObjectData, ObjectType) error
	// CheckUpdateObjectDataWithCurrent checks if the current user can update an object data in the current domain with an object type
	CheckUpdateObjectDataWithCurrent(ObjectData, ObjectType) error
	// CheckModifyObjectDataWithCurrent checks if the current user can modify an object data in the current domain
	CheckModifyObjectDataWithCurrent(ObjectData) error
	// CheckGetObjectDataWithCurrent checks if the current user can get an object data in the current domain
	CheckGetObjectDataWithCurrent(ObjectData) error
}

type IDictionary interface {
	IFeatureDictionary
	ICreatorDictionary
}

type IDirectory interface {
	Search(uint64, DirectorySearchType) []*Directory
}

type IDirectoryService interface {
	// CreateDirectory creates a new directory for an object in a domain
	CreateDirectory(User, Domain, Object) error
	// UpdateDirectory updates an existing directory for an object in a domain
	UpdateDirectory(User, Domain, Object) error
	// DeleteDirectory deletes a directory and its subdirectories in a domain based on a request
	DeleteDirectory(User, Domain, *DirectoryRequest) error
	// GetDirectory gets all directories and their subdirectories in a domain based on a request
	GetDirectory(User, Domain, *DirectoryRequest) ([]*Directory, error)
	// MoveDirectory moves a directory and its subdirectories to another directory in a domain based on a request and returns the updated directory structure
	MoveDirectory(User, Domain, *DirectoryRequest) (*DirectoryResponse, error)
	// MoveItem moves an object data to another directory in a domain based on a request and returns the updated directory structure
	MoveItem(User, Domain, ObjectData, *DirectoryRequest) (*DirectoryResponse, error)
	// CopyItem copies an object data to another directory in a domain based on a request and returns the updated directory structure
	CopyItem(User, Domain, ObjectData, *DirectoryRequest) (*DirectoryResponse, error)
}

type IEnforcer interface {
	// Enforce checks whether user u can perform action on object o within domain d.
	Enforce(User, Object, Domain, Action) (bool, error)
	// EnforceRole checks whether son inherits from parent within domain.
	EnforceRole(son Role, parent Role, domain Domain) (bool, error)
	// EnforceObject checks whether son is a descendant of parent within domain.
	EnforceObject(son Object, parent Object, domain Domain) (bool, error)
	// IsSuperadmin returns true if user is a global superadmin.
	IsSuperadmin(User) (bool, error)

	// GetDomainsIncludeUser returns every domain the user belongs to.
	GetDomainsIncludeUser(User) []Domain

	// GetRolesForUserInDomain returns the roles directly assigned to user in domain.
	GetRolesForUserInDomain(User, Domain) []Role
	// GetUsersForRoleInDomain returns the users that have role in domain.
	GetUsersForRoleInDomain(Role, Domain) []User
	// GetParentsForRoleInDomain returns the parent roles of role in domain.
	GetParentsForRoleInDomain(Role, Domain) []Role
	// GetChildrenForRoleInDomain returns the child roles of role in domain.
	GetChildrenForRoleInDomain(Role, Domain) []Role
	// GetParentsForObjectInDomain returns the parent objects of object in domain.
	GetParentsForObjectInDomain(Object, Domain) []Object
	// GetChildrenForObjectInDomain returns the child objects of object in domain.
	GetChildrenForObjectInDomain(Object, Domain) []Object
	// GetPoliciesForRoleInDomain returns all policies granted to role in domain.
	GetPoliciesForRoleInDomain(Role, Domain) []*Policy
	// GetPoliciesForObjectInDomain returns all policies that reference object in domain.
	GetPoliciesForObjectInDomain(Object, Domain) []*Policy

	// RemoveUserInDomain removes all role assignments for user within domain.
	RemoveUserInDomain(User, Domain) error
	// RemoveRoleInDomain removes all policies, inheritance edges, and user
	// assignments associated with role within domain.
	RemoveRoleInDomain(Role, Domain) error
	// RemoveObjectInDomain removes all policies and hierarchy edges associated
	// with object within domain.
	RemoveObjectInDomain(Object, Domain) error

	// AddPolicyInDomain grants role the given action on object within domain.
	AddPolicyInDomain(Role, Object, Domain, Action) error
	// RemovePolicyInDomain revokes role's action on object within domain.
	RemovePolicyInDomain(Role, Object, Domain, Action) error

	// AddRoleForUserInDomain assigns role to user within domain.
	AddRoleForUserInDomain(User, Role, Domain) error
	// RemoveRoleForUserInDomain unassigns role from user within domain.
	RemoveRoleForUserInDomain(User, Role, Domain) error

	// AddParentForRoleInDomain makes son inherit from parent within domain.
	AddParentForRoleInDomain(Role, Role, Domain) error
	// RemoveParentForRoleInDomain removes the son→parent inheritance in domain.
	RemoveParentForRoleInDomain(Role, Role, Domain) error

	// AddParentForObjectInDomain makes son a child of parent within domain.
	AddParentForObjectInDomain(Object, Object, Domain) error
	// RemoveParentForObjectInDomain removes the son→parent object edge in domain.
	RemoveParentForObjectInDomain(Object, Object, Domain) error

	// GetUsersInDomain returns all users that have any role in domain.
	GetUsersInDomain(Domain) []User
	// GetRolesInDomain returns all roles defined in domain.
	GetRolesInDomain(Domain) []Role
	// GetObjectsInDomain returns all objects defined in domain.
	GetObjectsInDomain(Domain) []Object
	// GetPoliciesInDomain returns all policies defined in domain.
	GetPoliciesInDomain(Domain) []*Policy

	// RemoveUsersInDomain removes all user→role assignments within domain,
	// effectively clearing the domain's user membership.
	RemoveUsersInDomain(Domain) error
}

type IFeatureDictionary interface {
	// GetFeature returns all registered features.
	GetFeature() ([]*Feature, error)
	// GetBackend returns all registered backend permission guards.
	GetBackend() ([]*Backend, error)
	// GetFrontend returns all registered frontend permission guards.
	GetFrontend() ([]*Frontend, error)
	// GetFeatureByKey looks up a feature by its unique key.
	GetFeatureByKey(key string) (*Feature, error)
	// GetBackendByKey looks up a backend guard by its unique key.
	GetBackendByKey(key string) (*Backend, error)
	// GetFrontendByKey looks up a frontend guard by its unique key.
	GetFrontendByKey(key string) (*Frontend, error)
	// GetPackage returns all feature packages (bundles of features).
	GetPackage() ([]*Package, error)
}

type IFeatureService interface {
	// AuthBackend authenticates a user for a backend in a domain
	AuthBackend(User, Domain, *Backend) error
	// AuthFrontend authenticates a user for frontends in a domain
	AuthFrontend(User, Domain) []*Frontend
	// GetFeature gets all features in a domain
	GetFeature(User, Domain) ([]*Feature, error)
	// GetFeaturePolicy gets all feature policies in a domain
	GetFeaturePolicy(User, Domain) ([]*Policy, error)
	// GetFeaturePolicyByRole gets all feature policies in a domain for a specific role
	GetFeaturePolicyByRole(User, Domain, Role) ([]*Policy, error)
	// ModifyFeaturePolicyPerRole modifies the feature policies in a domain for a specific role
	ModifyFeaturePolicyPerRole(User, Domain, Role, []*Policy) error
	// ResetFeature resets the features in a domain to their initial state
	ResetFeature(Domain) error
}

type IService interface {
	IBaseService      // basic CRUD operations for users, domains, objects and roles
	IDirectoryService // directory-related operations for objects and object data
	IFeatureService   // feature-related operations for backends, frontends and policies
	ICurrentService   // current user-related operations
}

type InheritanceEdge[T cmp.Ordered] struct {
	U T `json:"u"`
	V T `json:"v"`
}

type InheritanceGraph[T cmp.Ordered] map[T][]T

type MetaDB interface {
	// Create inserts a new record. The entity must not already exist (not
	// soft-deleted). Returns [ErrAlreadyExists] if a live record is found.
	Create(any) error
	// Recover undeletes a soft-deleted record. Returns [ErrNotExists] if no
	// deleted record is found.
	Recover(any) error
	// Update saves changes to an existing record.
	Update(any) error
	// UpsertType determines whether the next Upsert will create, recover, or
	// update; it does not perform any write itself.
	UpsertType(any) UpsertType
	// Take loads a single live (not soft-deleted) record by primary key.
	Take(any) error
	// TakeUnscoped loads a single record regardless of soft-delete status.
	TakeUnscoped(any) error
	// Find loads all matching records into the destination slice, with optional
	// filter conditions forwarded to the underlying ORM.
	Find(any, ...any) error
	// DeleteByID soft-deletes the record of the given type with the specified ID.
	DeleteByID(any, uint64) error

	// GetUserByID fetches [User] records for the given IDs.
	GetUserByID([]uint64) ([]User, error)
	// GetRoleInDomain fetches all [Role] records that belong to the given domain.
	GetRoleInDomain(Domain) ([]Role, error)
	// GetRoleByID fetches [Role] records for the given IDs.
	GetRoleByID([]uint64) ([]Role, error)
	// GetObjectInDomain fetches all [Object] records in the given domain,
	// optionally filtered by one or more [ObjectType] values.
	GetObjectInDomain(Domain, ...ObjectType) ([]Object, error)
	// GetObjectByID fetches [Object] records for the given IDs.
	GetObjectByID([]uint64) ([]Object, error)
	// GetDomainByID fetches [Domain] records for the given IDs.
	GetDomainByID([]uint64) ([]Domain, error)
	// GetAllDomain fetches every [Domain] record in the database.
	GetAllDomain() ([]Domain, error)
}

type NamedObject struct {
	Name string `json:"name"`
}

type Object interface {

	// GetObjectType returns the type tag for this object (e.g. "menu").
	GetObjectType() string
	// contains filtered or unexported methods
}

type ObjectChildrenGetFunc = func(Object, Domain) []Object

type ObjectData interface {

	// GetObjectID returns the ID of the protecting Object.
	GetObjectID() uint64
	// SetObjectID sets the ID of the protecting Object.
	SetObjectID(uint64)
	// contains filtered or unexported methods
}

type ObjectDeleteFunc = func(Object, Domain) error

type ObjectParentAddFunc = func(Object, Object, Domain) error

type ObjectParentDelFunc = func(Object, Object, Domain) error

type ObjectParentGetFunc = func(Object, Domain) []Object

type ObjectType = string

type Option func(*Options)

type Options struct {
	// DefaultSuperadminDomainName overrides the built-in superadmin domain name
	// (default: "superadmin_domain"). Must match the name used in the database.
	DefaultSuperadminDomainName string `json:"default_superadmin_domain_name"`
	// DefaultSuperadminRoleName overrides the built-in superadmin role name
	// (default: "superadmin_role"). Must match the name stored in casbin.
	DefaultSuperadminRoleName string `json:"default_superadmin_role_name"`
	// Dictionary configures the feature/creator dictionary backend. If nil,
	// an empty in-memory dictionary is used.
	Dictionary *DictionaryOption `json:"dictionary"`
	// DB configures the metadata database connection.
	DB *DBOption `json:"db"`
	// Watcher configures the optional casbin policy watcher (e.g. Redis).
	// When nil, no watcher is set up.
	Watcher *WatcherOption `json:"watcher"`
}

type Package struct {
	Key      string     `toml:"key"`
	Feature  [][]string `toml:"feature"`
	Backend  [][]string `toml:"backend"`
	Frontend [][]string `toml:"frontend"`
}

type Policy struct {
	Role   Role   `json:"role"`
	Object Object `json:"object"`
	Domain Domain `json:"domain"`
	Action Action `json:"action"`
}

type Role interface {
	ObjectData
	// contains filtered or unexported methods
}

type SampleSuperadminDomain struct {
	ID   uint64 `json:"id"`
	Name string `json:"name"`
}

type SampleSuperadminRole struct {
	ID   uint64 `json:"id"`
	Name string `json:"name"`
}

type UpsertType string

type User interface {
	// contains filtered or unexported methods
}

type UserRolePair struct {
	User User `json:"user"`
	Role Role `json:"role"`
}

type WatcherOption struct {
	// Type selects the watcher backend. Currently "redis" is supported.
	// An empty or unrecognised type falls back to auto-load polling when
	// AutoLoad > 0.
	Type string `json:"type"`
	// Address is the host:port of the watcher backend (e.g. "localhost:6379").
	Address string `json:"address"`
	// Password is the authentication password for the watcher backend.
	Password string `json:"password"`
	// Channel is the pub/sub channel name used by the Redis watcher.
	Channel string `json:"channel"`
	// AutoLoad, when > 0 and Type is not "redis", sets the interval in
	// seconds for the enforcer's built-in StartAutoLoadPolicy poller.
	AutoLoad int64 `json:"auto_load"`
}