api

type MEKProvider interface {
	Provision(ctx context.Context, b vaultmek.Bundle) (vaultmek.Ref, error)
	Load(ctx context.Context, ref vaultmek.Ref) ([]byte, error)
	Unwrap(ctx context.Context, ref vaultmek.Ref, ciphertext, iv []byte) ([]byte, error)
	// RefreshTees is the data owner's measurement approval: replace the
	// key's pinned TEE profile with the grant's (the app's current
	// measurement), authenticated as the key owner.
	RefreshTees(ctx context.Context, ref vaultmek.Ref, grant, ownerBearer string) error
	// Regenerate re-creates the tenant's key (same material) at the next
	// handle generation under a fresh grant — the renewal for the vault's
	// fixed expires_at, and the ride off a retiring constellation.
	Regenerate(ctx context.Context, ref vaultmek.Ref, b vaultmek.Bundle) (vaultmek.Ref, error)
}

type Principal struct {
	Sub   string
	Via   authVia
	ID    *oidc.Identity   // non-nil for users
	Grant *grants.Grant    // non-nil for app principals
	Env   *grants.Envelope // non-nil for app principals
	// Bearer is the caller's raw platform token, kept for the bearer
	// path alone. Funding a recipient's attribute disclosure is an act
	// the control plane attributes to the caller's OWN account, which it
	// resolves from the token, so Drive has to present the caller's
	// token rather than its app identity. Empty on every other path,
	// which is why a sealed-session sharer cannot fund a share.
	Bearer string
	// AIGrant marks an assistant principal that came from a files.ai grant
	// rather than the trusted assistant enclave: it acts for the holder who
	// minted the grant, may read and search their AI scope, and nothing more
	// (no open_link, no settings changes).
	AIGrant bool
}

type SealedBucketCred struct {
	// KeyRef addresses the operator key on the constellation (handle,
	// endpoints, MRENCLAVE, attestation server + token).
	KeyRef vaultmek.Ref `json:"key_ref"`
	// CiphertextB64 / IvB64 are the sealed credential (raw-url base64).
	CiphertextB64 string `json:"ciphertext_b64"`
	IvB64         string `json:"iv_b64"`
	// ContentType labels the credential for the object backend
	// (e.g. "gcs-sa-json", "s3-keypair", "ovh-token").
	ContentType string `json:"content_type"`
	// Bucket is the target bucket name (plaintext metadata, not secret);
	// the sealed plaintext holds only the credential material.
	Bucket string `json:"bucket"`
}

type Server struct {
	Store    *store.Store
	Backend  objectstore.Backend
	Grants   *grants.Repo
	Verifier oidc.Verifier
	MEK      []byte // single tenant MEK for `--dev`. Production: fetched per tenant from vault.

	// Revoked rejects tokens whose IdP session was revoked (long-lived
	// API keys). Nil disables the check.
	Revoked *oidc.RevokedSet

	// AttrRef reads the IdP's canonical attribute referential, which is
	// what tells a government-backed attribute key from the self-asserted
	// twin that answers the same question for free. Nil where no issuer is
	// configured, which is fail-closed everywhere an attribute can be
	// billed: a share requiring one is refused rather than stored at an
	// assurance nobody chose.
	AttrRef *attrref.Client

	// MEKs provisions and loads per-tenant vault-held MEKs. Nil
	// disables vault-held tenant keys (tenants stay on the instance
	// MEK).
	MEKs MEKProvider

	// Platform is the enclave-manager environment (empty off-platform).
	Platform platform.Env
	// StateDir persists the instance config (the sealed /data volume on
	// the platform).
	StateDir string
	// DevMode relaxes the configure-authz role check (dev verifier runs
	// without platform roles).
	DevMode bool
	Version string
	// WebDir holds the UI's static export (webui.go); empty serves the API
	// only.
	WebDir string
	// contains filtered or unexported fields
}

type WorkspaceFile struct {
	Path string `json:"path"`
	Size int64  `json:"size"`
	Mode string `json:"mode,omitempty"`
	Blob string `json:"blob"`
}

type WorkspaceManifest struct {
	Version int             `json:"version"`
	App     string          `json:"app,omitempty"`
	SavedAt string          `json:"saved_at,omitempty"`
	Files   []WorkspaceFile `json:"files"`
}