// Package link is the control plane's side of the connection nodes hold open.
//
// novox/hq ADR 0002: nodes communicate over a message broker, not over HTTP. One exchange, and
// the control plane is the single consumer behind it — ADR 0006 makes that a property worth
// having rather than an accident, because two consumers sharing a queue silently split the
// traffic between them, each receiving half of what it expects. That has happened here before.
package link

// Exchange is where nodes publish everything they have to say.
const Exchange = "mesh"

// ControlQueue is what the control plane consumes. One queue, one consumer.
const ControlQueue = "control"

// Routing keys. A node may publish these; it may not publish anything else, because its broker
// account is scoped to this exchange and its own queue.
const (
	KeyEnrol = "enrol"
)

// QueueFor is the queue a node consumes from — the only one it may read.
func QueueFor(node string) string { return "node." + node }

// EnrolRequest is what a joining node says.
//
// It arrives on a connection the broker has already authenticated, because the account was
// created when the token was issued and the token's secret is its password. So this message is
// not how a node gets in — it is what it says once it is in.
type EnrolRequest struct {
	// Node is what this machine believes it is called. Checked against the token, never trusted.
	Node string `json:"node"`

	// Secret is the one-time right to join. The account password and this are the same string,
	// which is deliberate: the broker proves somebody holds the token, and this proves the same
	// thing to the control plane without the control plane having to ask the broker who connected.
	Secret string `json:"secret"`

	// PublicKey is what the mesh will believe from now on. The node generated it; the private
	// half has never left that machine (novox/hq ADR 0004).
	PublicKey []byte `json:"public_key"`

	// Profile is what this machine can be asked to do. The control plane cannot decide what a
	// node should run without it, so it arrives with enrolment rather than being asked for after.
	Profile map[string]any `json:"profile,omitempty"`
}

// EnrolReply is what the mesh says back.
type EnrolReply struct {
	// Accepted says whether the node is now known.
	Accepted bool `json:"accepted"`

	// Node is the name the mesh has for this machine, which settles any disagreement: the token
	// was issued for a node record, and that record's name wins over what the machine called
	// itself.
	Node string `json:"node,omitempty"`

	// Queue is where this node listens from now on.
	Queue string `json:"queue,omitempty"`

	// Refusal says why not, in words for a person. Deliberately the same for every reason a
	// token can fail — unknown, spent, expired — so that guessing learns nothing.
	Refusal string `json:"refusal,omitempty"`
}