modules

type AccessListFeature struct {
	// Limit for the number of access list creatable when feature is
	// not enabled.
	CreateLimit int
}

type AccessListGetter interface {
	GetAccessList(ctx context.Context, name string) (*accesslist.AccessList, error)
}

type AccessListSuggestionClient interface {
	GetUser(ctx context.Context, userName string, withSecrets bool) (types.User, error)
	RoleGetter

	GetAccessRequestAllowedPromotions(ctx context.Context, req types.AccessRequest) (*types.AccessRequestAllowedPromotions, error)
	GetAccessRequests(ctx context.Context, filter types.AccessRequestFilter) ([]types.AccessRequest, error)
}

type AccessMonitoringFeature struct {
	// True if enabled in the auth service config: [auth_service.access_monitoring.enabled].
	Enabled bool
	// Defines the max number of days to include in an access report.
	MaxReportRangeLimit int
}

type AccessRequestsFeature struct {
	// MonthlyRequestLimit is the usage-based limit for the number of
	// access requests created in a calendar month.
	MonthlyRequestLimit int
}

type AccessResourcesGetter interface {
	ListAccessLists(context.Context, int, string) ([]*accesslist.AccessList, string, error)
	ListResources(ctx context.Context, req proto.ListResourcesRequest) (*types.ListResourcesResponse, error)

	ListAccessListMembers(ctx context.Context, accessList string, pageSize int, pageToken string) (members []*accesslist.AccessListMember, nextToken string, err error)
	GetAccessListMember(ctx context.Context, accessList string, memberName string) (*accesslist.AccessListMember, error)

	GetUser(ctx context.Context, userName string, withSecrets bool) (types.User, error)
	GetRole(ctx context.Context, name string) (types.Role, error)

	GetLock(ctx context.Context, name string) (types.Lock, error)
	GetLocks(ctx context.Context, inForceOnly bool, targets ...types.LockTarget) ([]types.Lock, error)
}

type DeviceTrustFeature struct {
	// Currently this flag is to gate actions from OSS clusters.
	//
	// Determining support for device trust is currently determined by:
	//   1) Enterprise + [Features.IdentityGovernanceSecurity] == true, new flag
	//   introduced with Enterprise Usage Based (EUB) product.
	//   2) Enterprise + [Features.IsUsageBasedBilling] == false, legacy support
	//   where before EUB, it was unlimited.
	Enabled bool
	// DevicesUsageLimit is the usage-based limit for the number of
	// registered/enrolled devices, at the implementation's discretion.
	DevicesUsageLimit int
}

type Features struct {
	// Kubernetes enables Kubernetes Access product
	Kubernetes bool
	// App enables Application Access product
	App bool
	// DB enables database access product
	DB bool
	// OIDC enables OIDC connectors
	OIDC bool
	// SAML enables SAML connectors
	SAML bool
	// AccessControls enables FIPS access controls
	AccessControls bool
	// Currently this flag is to gate actions from OSS clusters.
	//
	// Determining support for access request is currently determined by:
	//   1) Enterprise + [Features.IdentityGovernanceSecurity] == true, new flag
	//   introduced with Enterprise Usage Based (EUB) product.
	//   2) Enterprise + [Features.IsUsageBasedBilling] == false, legacy support
	//   where before EUB, it was unlimited.
	//
	// AdvancedAccessWorkflows is currently set to true for all
	// enterprise editions (team, cloud, on-prem). Historically, access request
	// was only available for enterprise cloud and enterprise on-prem.
	AdvancedAccessWorkflows bool
	// Cloud enables some cloud-related features
	Cloud bool
	// HSM enables PKCS#11 HSM support
	HSM bool
	// Desktop enables desktop access product
	Desktop bool
	// RecoveryCodes enables account recovery codes
	RecoveryCodes bool
	// Plugins enables hosted plugins
	Plugins bool
	// AutomaticUpgrades enables automatic upgrades of agents/services.
	AutomaticUpgrades bool
	// IsUsageBasedBilling enables some usage-based billing features
	IsUsageBasedBilling bool
	// Assist enables Assistant feature
	Assist bool
	// DeviceTrust holds its namesake feature settings.
	DeviceTrust DeviceTrustFeature
	// FeatureHiding enables hiding features from being discoverable for users who don't have the necessary permissions.
	FeatureHiding bool
	// AccessRequests holds its namesake feature settings.
	AccessRequests AccessRequestsFeature
	// CustomTheme holds the name of WebUI custom theme.
	CustomTheme string

	// AccessGraph enables the usage of access graph.
	// NOTE: this is a legacy flag that is currently used to signal
	// that Access Graph integration is *enabled* on a cluster.
	// *Access* to the feature is gated on the `Policy` flag.
	// TODO(justinas): remove this field once "TAG enabled" status is moved to a resource in the backend.
	AccessGraph bool
	// IdentityGovernanceSecurity indicates whether IGS related features are enabled:
	// access list, access request, access monitoring, device trust.
	IdentityGovernanceSecurity bool
	// AccessList holds its namesake feature settings.
	AccessList AccessListFeature
	// AccessMonitoring holds its namesake feature settings.
	AccessMonitoring AccessMonitoringFeature
	// ProductType describes the product being used.
	ProductType ProductType
	// Policy holds settings for the Teleport Policy feature set.
	// At the time of writing, this includes Teleport Access Graph (TAG).
	Policy PolicyFeature
}

type Modules interface {
	// PrintVersion prints teleport version
	PrintVersion()
	// IsBoringBinary checks if the binary was compiled with BoringCrypto.
	IsBoringBinary() bool
	// Features returns supported features
	Features() Features
	// SetFeatures set features queried from Cloud
	SetFeatures(Features)
	// BuildType returns build type (OSS or Enterprise)
	BuildType() string
	// AttestHardwareKey attests a hardware key and returns its associated private key policy.
	AttestHardwareKey(context.Context, interface{}, *keys.AttestationStatement, crypto.PublicKey, time.Duration) (*keys.AttestationData, error)
	// GenerateAccessRequestPromotions generates a list of valid promotions for given access request.
	GenerateAccessRequestPromotions(context.Context, AccessResourcesGetter, types.AccessRequest) (*types.AccessRequestAllowedPromotions, error)
	// GetSuggestedAccessLists generates a list of valid promotions for given access request.
	GetSuggestedAccessLists(ctx context.Context, identity *tlsca.Identity, clt AccessListSuggestionClient, accessListGetter AccessListGetter, requestID string) ([]*accesslist.AccessList, error)
	// EnableRecoveryCodes enables the usage of recovery codes for resetting forgotten passwords
	EnableRecoveryCodes()
	// EnablePlugins enables the hosted plugins runtime
	EnablePlugins()
	// EnableAccessGraph enables the usage of access graph.
	EnableAccessGraph()
	// EnableAccessMonitoring enables the usage of access monitoring.
	EnableAccessMonitoring()
}

type PolicyFeature struct {
	// Enabled is set to `true` if Teleport Policy is enabled in the license.
	Enabled bool
}

type ProductType int32

type RoleGetter interface {
	GetRole(ctx context.Context, name string) (types.Role, error)
}

type TestModules struct {
	// TestBuildType is returned from the BuiltType function.
	TestBuildType string
	// TestFeatures is returned from the Features function.
	TestFeatures Features

	// MockAttestationData is fake attestation data to return
	// during tests when hardware key support is enabled.
	MockAttestationData *keys.AttestationData
	// contains filtered or unexported fields
}