package buscompose

import (
	"time"

	"git.novox.be/novox/mesh-delivery/modules/mesh-grants/grantsstate"
)

// **The accounts the grants part wants, and the one shape a held account takes** (novox/hq ADR 0561 §1, §2; issue 774).
//
// The bus composer derives every user from assignments, the manifests and the wants. For each account the mesh mints (a
// module's, a module's process's, a machine's provisioner client's), the grants part writes one key of its state
// `accounts`, keyed by the bus user, holding the account's fields that are not secret: what the controller's credential
// carries today beside the password. The vault watches that state, mints the user it holds no value for, and keeps the
// value as the module's own secret on that node, built by HeldCredential, which gives byte for byte the controller's
// shape, so a runtime reads it unchanged. The state is read by the vault alone (NamedReaders), as `bus-accounts` is read
// by the grants part alone.
//
// The node accounts, the controller's own, an enrolment user and a person are never wanted here: the vault mints none
// of them (ADR 0561 §4, §5).

// The layout of the state is the grants part's published package (grantsstate; ADR 0634 §1): the vault imports it from there, and
// this composer names it.
const (
	AccountsState  = grantsstate.AccountsState
	GrantsAccounts = grantsstate.GrantsAccounts
	LedgersSecret  = grantsstate.LedgersSecret
)

type (
	ClaimedSeat   = grantsstate.ClaimedSeat
	WantedAccount = grantsstate.WantedAccount
)

var (
	ReadWantedAccount = grantsstate.ReadWantedAccount
	HeldCredential    = grantsstate.HeldCredential
)

// AccountsBucket is the bucket the state lives in.
var AccountsBucket = BucketName(GrantsModule, AccountsState)

// AccountsSubject is the subject of one wanted account's key: `$KV.mesh-grants_accounts.<user>`.
func AccountsSubject(user string) string { return "$KV." + AccountsBucket + "." + user }

// AccountIssuedEvent is what the vault says when it minted an account: AccountIssued, never a value or a hash.
const AccountIssuedEvent = "account-issued"

// AccountIssuedSubject is where it says it, as the runtime addresses mesh-vault's events.
const AccountIssuedSubject = "mesh.mod." + VaultSeat + ".event." + AccountIssuedEvent

// AccountIssued is the vault's account-issued: which account it minted, and its generation. Never a value or a hash.
type AccountIssued struct {
	User       string    `json:"user"`
	Kind       Kind      `json:"kind"`
	Node       string    `json:"node"`
	Module     string    `json:"module"`
	Process    string    `json:"process,omitempty"`
	Generation int       `json:"generation"`
	At         time.Time `json:"at"`
}