const OASVersion = "3.0.2"

const WALPrefix = "wal/"

var OASStdRespNoContent = &OASResponse{
    Description: "empty body",
}

var OASStdRespOK = &OASResponse{
    Description: "OK",
}

type Backend struct {
    // Help is the help text that is shown when a help request is made
    // on the root of this resource. The root help is special since we
    // show all the paths that can be requested.
    Help string

    // Paths are the various routes that the backend responds to.
    // This cannot be modified after construction (i.e. dynamically changing
    // paths, including adding or removing, is not allowed once the
    // backend is in use).
    //
    // PathsSpecial is the list of path patterns that denote the
    // paths above that require special privileges. These can't be
    // regular expressions, it is either exact match or prefix match.
    // For prefix match, append '*' as a suffix.
    Paths        []*Path
    PathsSpecial *logical.Paths

    // Secrets is the list of secret types that this backend can
    // return. It is used to automatically generate proper responses,
    // and ease specifying callbacks for revocation, renewal, etc.
    Secrets []*Secret

    // InitializeFunc is the callback, which if set, will be invoked via
    // Initialize() just after a plugin has been mounted.
    InitializeFunc InitializeFunc

    // PeriodicFunc is the callback, which if set, will be invoked when the
    // periodic timer of RollbackManager ticks. This can be used by
    // backends to do anything it wishes to do periodically.
    //
    // PeriodicFunc can be invoked to, say to periodically delete stale
    // entries in backend's storage, while the backend is still being used.
    // (Note the different of this action from what `Clean` does, which is
    // invoked just before the backend is unmounted).
    PeriodicFunc periodicFunc

    // WALRollback is called when a WAL entry (see wal.go) has to be rolled
    // back. It is called with the data from the entry.
    //
    // WALRollbackMinAge is the minimum age of a WAL entry before it is attempted
    // to be rolled back. This should be longer than the maximum time it takes
    // to successfully create a secret.
    WALRollback       WALRollbackFunc
    WALRollbackMinAge time.Duration

    // Clean is called on unload to clean up e.g any existing connections
    // to the backend, if required.
    Clean CleanupFunc

    // Invalidate is called when a keys is modified if required
    Invalidate InvalidateFunc

    // AuthRenew is the callback to call when a RenewRequest for an
    // authentication comes in. By default, renewal won't be allowed.
    // See the built-in AuthRenew helpers in lease.go for common callbacks.
    AuthRenew OperationFunc

    // Type is the logical.BackendType for the backend implementation
    BackendType logical.BackendType
    // contains filtered or unexported fields
}

type CleanupFunc func(context.Context)

type DisplayAttributes struct {
    // Name is the name of the field suitable as a label or documentation heading.
    Name string `json:"name,omitempty"`

    // Value is a sample value to display for this field. This may be used
    // to indicate a default value, but it is for display only and completely separate
    // from any Default member handling.
    Value interface{} `json:"value,omitempty"`

    // Sensitive indicates that the value should be masked by default in the UI.
    Sensitive bool `json:"sensitive,omitempty"`

    // Navigation indicates that the path should be available as a navigation tab
    Navigation bool `json:"navigation,omitempty"`

    // Group is the suggested UI group to place this field in.
    Group string `json:"group,omitempty"`

    // Action is the verb to use for the operation.
    Action string `json:"action,omitempty"`
}

type ExistenceFunc func(context.Context, *logical.Request, *FieldData) (bool, error)

type FieldData struct {
    Raw    map[string]interface{}
    Schema map[string]*FieldSchema
}

type FieldSchema struct {
    Type        FieldType
    Default     interface{}
    Description string
    Required    bool
    Deprecated  bool

    // Query indicates this field will be sent as a query parameter:
    //
    //   /v1/foo/bar?some_param=some_value
    //
    // It doesn't affect handling of the value, but may be used for documentation.
    Query bool

    // AllowedValues is an optional list of permitted values for this field.
    // This constraint is not (yet) enforced by the framework, but the list is
    // output as part of OpenAPI generation and may effect documentation and
    // dynamic UI generation.
    AllowedValues []interface{}

    // DisplayAttrs provides hints for UI and documentation generators. They
    // will be included in OpenAPI output if set.
    DisplayAttrs *DisplayAttributes
}

type FieldType uint

const (
    TypeInvalid FieldType = 0
    TypeString  FieldType = iota
    TypeInt
    TypeBool
    TypeMap

    // TypeDurationSecond represent as seconds, this can be either an
    // integer or go duration format string (e.g. 24h)
    TypeDurationSecond

    // TypeSignedDurationSecond represents a positive or negative duration
    // as seconds, this can be either an integer or go duration format
    // string (e.g. 24h).
    TypeSignedDurationSecond

    // TypeSlice represents a slice of any type
    TypeSlice

    // TypeStringSlice is a helper for TypeSlice that returns a sanitized
    // slice of strings
    TypeStringSlice

    // TypeCommaStringSlice is a helper for TypeSlice that returns a sanitized
    // slice of strings and also supports parsing a comma-separated list in
    // a string field
    TypeCommaStringSlice

    // TypeLowerCaseString is a helper for TypeString that returns a lowercase
    // version of the provided string
    TypeLowerCaseString

    // TypeNameString represents a name that is URI safe and follows specific
    // rules.  These rules include start and end with an alphanumeric
    // character and characters in the middle can be alphanumeric or . or -.
    TypeNameString

    // TypeKVPairs allows you to represent the data as a map or a list of
    // equal sign delimited key pairs
    TypeKVPairs

    // TypeCommaIntSlice is a helper for TypeSlice that returns a sanitized
    // slice of Ints
    TypeCommaIntSlice

    // TypeHeader is a helper for sending request headers through to Vault.
    // For instance, the AWS and AliCloud credential plugins both act as a
    // benevolent MITM for a request, and the headers are sent through and
    // parsed.
    TypeHeader
)

type InitializeFunc func(context.Context, *logical.InitializationRequest) error

type InvalidateFunc func(context.Context, string)

type OASContent map[string]*OASMediaTypeObject

type OASDocument struct {
    Version string                  `json:"openapi" mapstructure:"openapi"`
    Info    OASInfo                 `json:"info"`
    Paths   map[string]*OASPathItem `json:"paths"`
}

type OASInfo struct {
    Title       string     `json:"title"`
    Description string     `json:"description"`
    Version     string     `json:"version"`
    License     OASLicense `json:"license"`
}

type OASLicense struct {
    Name string `json:"name"`
    URL  string `json:"url"`
}

type OASMediaTypeObject struct {
    Schema *OASSchema `json:"schema,omitempty"`
}

type OASOperation struct {
    Summary     string               `json:"summary,omitempty"`
    Description string               `json:"description,omitempty"`
    OperationID string               `json:"operationId,omitempty"`
    Tags        []string             `json:"tags,omitempty"`
    Parameters  []OASParameter       `json:"parameters,omitempty"`
    RequestBody *OASRequestBody      `json:"requestBody,omitempty"`
    Responses   map[int]*OASResponse `json:"responses"`
    Deprecated  bool                 `json:"deprecated,omitempty"`
}

type OASParameter struct {
    Name        string     `json:"name"`
    Description string     `json:"description,omitempty"`
    In          string     `json:"in"`
    Schema      *OASSchema `json:"schema,omitempty"`
    Required    bool       `json:"required,omitempty"`
    Deprecated  bool       `json:"deprecated,omitempty"`
}

type OASPathItem struct {
    Description       string             `json:"description,omitempty"`
    Parameters        []OASParameter     `json:"parameters,omitempty"`
    Sudo              bool               `json:"x-vault-sudo,omitempty" mapstructure:"x-vault-sudo"`
    Unauthenticated   bool               `json:"x-vault-unauthenticated,omitempty" mapstructure:"x-vault-unauthenticated"`
    CreateSupported   bool               `json:"x-vault-createSupported,omitempty" mapstructure:"x-vault-createSupported"`
    DisplayNavigation bool               `json:"x-vault-displayNavigation,omitempty" mapstructure:"x-vault-displayNavigation"`
    DisplayAttrs      *DisplayAttributes `json:"x-vault-displayAttrs,omitempty" mapstructure:"x-vault-displayAttrs"`

    Get    *OASOperation `json:"get,omitempty"`
    Post   *OASOperation `json:"post,omitempty"`
    Delete *OASOperation `json:"delete,omitempty"`
}

type OASRequestBody struct {
    Description string     `json:"description,omitempty"`
    Content     OASContent `json:"content,omitempty"`
}

type OASResponse struct {
    Description string     `json:"description"`
    Content     OASContent `json:"content,omitempty"`
}

type OASSchema struct {
    Type        string                `json:"type,omitempty"`
    Description string                `json:"description,omitempty"`
    Properties  map[string]*OASSchema `json:"properties,omitempty"`

    // Required is a list of keys in Properties that are required to be present. This is a different
    // approach than OASParameter (unfortunately), but is how JSONSchema handles 'required'.
    Required []string `json:"required,omitempty"`

    Items      *OASSchema    `json:"items,omitempty"`
    Format     string        `json:"format,omitempty"`
    Pattern    string        `json:"pattern,omitempty"`
    Enum       []interface{} `json:"enum,omitempty"`
    Default    interface{}   `json:"default,omitempty"`
    Example    interface{}   `json:"example,omitempty"`
    Deprecated bool          `json:"deprecated,omitempty"`
    //DisplayName      string             `json:"x-vault-displayName,omitempty" mapstructure:"x-vault-displayName,omitempty"`
    DisplayValue     interface{}        `json:"x-vault-displayValue,omitempty" mapstructure:"x-vault-displayValue,omitempty"`
    DisplaySensitive bool               `json:"x-vault-displaySensitive,omitempty" mapstructure:"x-vault-displaySensitive,omitempty"`
    DisplayGroup     string             `json:"x-vault-displayGroup,omitempty" mapstructure:"x-vault-displayGroup,omitempty"`
    DisplayAttrs     *DisplayAttributes `json:"x-vault-displayAttrs,omitempty" mapstructure:"x-vault-displayAttrs,omitempty"`
}

type OperationFunc func(context.Context, *logical.Request, *FieldData) (*logical.Response, error)

type OperationHandler interface {
    Handler() OperationFunc
    Properties() OperationProperties
}

type OperationProperties struct {
    // Summary is a brief (usually one line) description of the operation.
    Summary string

    // Description is extended documentation of the operation and may contain
    // Markdown-formatted text markup.
    Description string

    // Examples provides samples of the expected request data. The most
    // relevant example should be first in the list, as it will be shown in
    // documentation that supports only a single example.
    Examples []RequestExample

    // Responses provides a list of response description for a given response
    // code. The most relevant response should be first in the list, as it will
    // be shown in documentation that only allows a single example.
    Responses map[int][]Response

    // Unpublished indicates that this operation should not appear in public
    // documentation or help text. The operation may still have documentation
    // attached that can be used internally.
    Unpublished bool

    // Deprecated indicates that this operation should be avoided.
    Deprecated bool

    // DisplayAttrs provides hints for UI and documentation generators. They
    // will be included in OpenAPI output if set.
    DisplayAttrs *DisplayAttributes
}

type Path struct {
    // Pattern is the pattern of the URL that matches this path.
    //
    // This should be a valid regular expression. Named captures will be
    // exposed as fields that should map to a schema in Fields. If a named
    // capture is not a field in the Fields map, then it will be ignored.
    Pattern string

    // Fields is the mapping of data fields to a schema describing that
    // field. Named captures in the Pattern also map to fields. If a named
    // capture name matches a PUT body name, the named capture takes
    // priority.
    //
    // Note that only named capture fields are available in every operation,
    // whereas all fields are available in the Write operation.
    Fields map[string]*FieldSchema

    // Operations is the set of operations supported and the associated OperationsHandler.
    //
    // If both Create and Update operations are present, documentation and examples from
    // the Update definition will be used. Similarly if both Read and List are present,
    // Read will be used for documentation.
    Operations map[logical.Operation]OperationHandler

    // Callbacks are the set of callbacks that are called for a given
    // operation. If a callback for a specific operation is not present,
    // then logical.ErrUnsupportedOperation is automatically generated.
    //
    // The help operation is the only operation that the Path will
    // automatically handle if the Help field is set. If both the Help
    // field is set and there is a callback registered here, then the
    // callback will be called.
    //
    // Deprecated: Operations should be used instead and will take priority if present.
    Callbacks map[logical.Operation]OperationFunc

    // ExistenceCheck, if implemented, is used to query whether a given
    // resource exists or not. This is used for ACL purposes: if an Update
    // action is specified, and the existence check returns false, the action
    // is not allowed since the resource must first be created. The reverse is
    // also true. If not specified, the Update action is forced and the user
    // must have UpdateCapability on the path.
    ExistenceCheck ExistenceFunc

    // FeatureRequired, if implemented, will validate if the given feature is
    // enabled for the set of paths
    FeatureRequired license.Features

    // Deprecated denotes that this path is considered deprecated. This may
    // be reflected in help and documentation.
    Deprecated bool

    // Help is text describing how to use this path. This will be used
    // to auto-generate the help operation. The Path will automatically
    // generate a parameter listing and URL structure based on the
    // regular expression, so the help text should just contain a description
    // of what happens.
    //
    // HelpSynopsis is a one-sentence description of the path. This will
    // be automatically line-wrapped at 80 characters.
    //
    // HelpDescription is a long-form description of the path. This will
    // be automatically line-wrapped at 80 characters.
    HelpSynopsis    string
    HelpDescription string

    // DisplayAttrs provides hints for UI and documentation generators. They
    // will be included in OpenAPI output if set.
    DisplayAttrs *DisplayAttributes
}

type PathMap struct {
    Prefix        string
    Name          string
    Schema        map[string]*FieldSchema
    CaseSensitive bool
    Salt          *saltpkg.Salt
    SaltFunc      func(context.Context) (*saltpkg.Salt, error)
    // contains filtered or unexported fields
}

type PathOperation struct {
    Callback    OperationFunc
    Summary     string
    Description string
    Examples    []RequestExample
    Responses   map[int][]Response
    Unpublished bool
    Deprecated  bool
}

type PathStruct struct {
    Name            string
    Path            string
    Schema          map[string]*FieldSchema
    HelpSynopsis    string
    HelpDescription string

    Read bool
}

type PolicyMap struct {
    PathMap

    DefaultKey string
    PolicyKey  string
}

type RequestExample struct {
    Description string                 // optional description of the request
    Data        map[string]interface{} // map version of sample JSON request data

    // Optional example response to the sample request. This approach is considered
    // provisional for now, and this field may be changed or removed.
    Response *Response
}

type Response struct {
    Description string            // summary of the the response and should always be provided
    MediaType   string            // media type of the response, defaulting to "application/json" if empty
    Example     *logical.Response // example response data
}

type Secret struct {
    // Type is the name of this secret type. This is used to setup the
    // vault ID and to look up the proper secret structure when revocation/
    // renewal happens. Once this is set this should not be changed.
    //
    // The format of this must match (case insensitive): ^a-Z0-9_$
    Type string

    // Fields is the mapping of data fields and schema that comprise
    // the structure of this secret.
    Fields map[string]*FieldSchema

    // DefaultDuration is the default value for the duration of the lease for
    // this secret. This can be manually overwritten with the result of
    // Response().
    //
    // If these aren't set, Vault core will set a default lease period which
    // may come from a mount tuning.
    DefaultDuration time.Duration

    // Renew is the callback called to renew this secret. If Renew is
    // not specified then renewable is set to false in the secret.
    // See lease.go for helpers for this value.
    Renew OperationFunc

    // Revoke is the callback called to revoke this secret. This is required.
    Revoke OperationFunc
}

type WALEntry struct {
    ID        string      `json:"-"`
    Kind      string      `json:"type"`
    Data      interface{} `json:"data"`
    CreatedAt int64       `json:"created_at"`
}

type WALRollbackFunc func(context.Context, *logical.Request, string, interface{}) error