projectprovision

type AuthMode uint8

type Client struct {
	// contains filtered or unexported fields
}

type ConformanceVector struct {
	// Name is stable; quote it in the receiver's test so a failure is greppable across
	// repositories.
	Name string
	// Secret is the per-target HMAC secret the receiver should be configured with for
	// this vector. Note that WrongSecret's signature was produced with a DIFFERENT
	// secret — the receiver still uses Secret and must reject.
	Secret string
	// Method / Path / Timestamp / EventID / Body are the request as it arrives on the
	// wire. Body is the exact byte sequence; do not reformat the JSON.
	Method    string
	Path      string
	Timestamp string
	EventID   string
	Body      string
	// Signature is the X-Octo-Signature header value as sent.
	Signature string
	// NowUnix is the receiver's clock when the request arrives. With
	// MaxSkewSeconds as the configured window, MustAccept is the required verdict.
	NowUnix int64
	// MustAccept is the verdict. False means the request must be refused — with a 4xx,
	// and without creating or touching any container.
	MustAccept bool
	// Why records which MUST clause the vector exercises.
	Why string
}

type DriveRequest struct {
	Name          string `json:"name"`
	OctoSpaceID   string `json:"octo_space_id"`
	SuperAdminUID string `json:"super_admin_uid"`
	ProjectID     string `json:"project_id"`
}

type DriveSpaceResponse struct {
	Duplicate bool
}

type EnsureError struct {
	Category string
	Status   int
	// Detail is a bounded, container-id-free reason. It is either derived from a
	// transport inner error or a fixed response-classification constant; it is
	// never derived from a request or a response body.
	//
	// It exists because category-plus-status is empty for the failure an operator hits
	// first. A target that is down produced `last_error = "transport_failed:
	// projectprovision: transport_failed"` — the outcome label twice — while the actual
	// reason (connection refused vs DNS vs TLS vs deadline) sat in `cause`, reachable
	// only through Unwrap, which nothing calls. That field is what the runbook sends a
	// human to read, the sweep was deliberately changed to APPEND to it because it is the
	// only durable per-row evidence, and this package has no logger by design — so for an
	// OOM-killed pod there is no log line to fall back on either.
	//
	// Why a separate field rather than folding `cause` into Error(): `cause` is whatever
	// the standard library produced, and at two of the construction sites that is a
	// function of OUR request — encode_failed wraps a json.Marshal error over an
	// EnsureRequest, which carries the container id. json.Marshal of an all-string struct
	// cannot realistically fail, but "cannot realistically" is not the bar for a value the
	// package comment calls a capability. Transport-derived Detail comes only from the
	// transport error's INNER error, which describes the network and structurally cannot
	// contain the request. Response classifications use fixed constants rather than parsing
	// errors, because a parser error can quote response-body bytes. The container-id-freedom
	// of last_error stays a property of construction, not an argument about stdlib formatting.
	Detail string
	// contains filtered or unexported fields
}

type EnsureRequest struct {
	ContainerID string `json:"container_id"`
	ProjectID   string `json:"project_id"`
	OctoSpaceID string `json:"octo_space_id"`
	Name        string `json:"name"`
	IssuePrefix string `json:"issue_prefix,omitempty"`
}

type EnsureResponse struct {
	ContainerID string `json:"container_id"`
	Slug        string `json:"slug,omitempty"`
}

type Target struct {
	// Name is the low-cardinality target label ("fleet" / "drive"). It reaches
	// metrics and log lines, so it must stay an enum and never be a URL.
	Name string
	// EnsureURL is the absolute POST endpoint. Fleet uses its HMAC ensure route;
	// Drive uses /v1/internal/drive/spaces with AuthInternalToken.
	EnsureURL string
	// Auth selects the target's wire authentication. The zero value is HMAC.
	Auth AuthMode
	// Secret is the per-target Fleet HMAC secret.
	Secret string
	// InternalToken is the Drive internal-route token. It must not be used as
	// an HMAC secret or sent to the Fleet route.
	InternalToken string
	// Timeout bounds one call; zero means defaultTimeout.
	Timeout time.Duration
}