package namedcredential

import "time"

// Definition holds the endpoint and auth-type metadata for a named credential.
// Secret values are stored separately in the _System_NamedCredentialSecret table
// and are never embedded in this struct.
type Definition struct {
	ID               string
	DeveloperName    string
	Label            string
	Endpoint         string
	PrincipalType    string
	AuthType         string
	Description      string
	OwnerPack        string
	CreatedByID      string
	CreatedDate      time.Time
	LastModifiedDate time.Time
}

// Secret holds the plaintext credential value for a specific kind of secret
// bound to a named credential. Only returned by GetSecret with the
// ManageNamedCredentials permission.
type Secret struct {
	ID                string
	NamedCredentialID string
	SecretKind        string
	SecretValue       string // plaintext IN MEMORY ONLY; persisted under envelope encryption (SecretCipher) in _System_NamedCredentialSecret.SecretValue. Never serialize this field to any external surface.
	MaskedHint        string
	RotatedAt         time.Time
	CreatedDate       time.Time
	LastModifiedDate  time.Time
}

// SecretMetadata is the safe projection of a secret used by setup-facing APIs.
// It never contains SecretValue.
type SecretMetadata struct {
	SecretKind string
	MaskedHint string
	RotatedAt  time.Time
}

const (
	// PrincipalTypeNamedPrincipal is the only supported principal type initially.
	// Per-user principal flows are out of #336 scope.
	PrincipalTypeNamedPrincipal = "NamedPrincipal"

	// AuthTypeOAuth2 represents OAuth 2.0 credential auth.
	AuthTypeOAuth2 = "OAuth2"
	// AuthTypeBasicAuth represents HTTP Basic Auth credentials.
	AuthTypeBasicAuth = "BasicAuth"
	// AuthTypeBearerToken represents a static bearer token credential.
	AuthTypeBearerToken = "BearerToken"
	// AuthTypeCustom represents a custom/arbitrary credential structure.
	AuthTypeCustom = "Custom"
)