use geth_types::{Capability, PrincipalId, ResourceId, SecretId, UnixMillis};
use serde::{Deserialize, Serialize};

pub const RESOURCE_SECRET_SIGNATURE_NAMESPACE: &str = "geth.resource-secret.v1@geth.local";

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct ResourceMasterSecret {
    pub id: SecretId,
    pub resource: ResourceId,
    pub epoch: u64,
    pub created_at: UnixMillis,
}

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct ResourceKeyEnvelope {
    pub secret: SecretId,
    pub recipient: PrincipalId,
    pub epoch: u64,
    pub algorithm: String,
    pub ciphertext: Vec<u8>,
}

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct BearerAccess {
    pub secret: SecretId,
    pub resource: ResourceId,
    pub capabilities: Vec<Capability>,
    pub expires_at: Option<UnixMillis>,
    pub may_delegate: bool,
}

impl BearerAccess {
    #[must_use]
    pub fn resource_scoped(
        secret: SecretId,
        resource: ResourceId,
        capabilities: Vec<Capability>,
    ) -> Self {
        Self {
            secret,
            resource,
            capabilities,
            expires_at: None,
            may_delegate: false,
        }
    }
}