accounts

type Account struct {
	hz.ObjectMeta `json:"metadata,omitempty" cue:""`

	Spec   *AccountSpec   `json:"spec,omitempty"`
	Status *AccountStatus `json:"status,omitempty"`
}

type AccountReconciler struct {
	hz.Client
	Conn *nats.Conn

	OpKeyPair         nkeys.KeyPair
	RootAccountPubKey string
}

type AccountSpec struct{}

type AccountStatus struct {
	Ready bool `json:"ready"`
	// ID of the account, which for NATS is the public key of the account
	// and the subject of the account's JWT.
	ID string `json:"id,omitempty"`
	// Seed of the account.
	// The "seed" can be converted into the account public
	// and private keys.
	Seed string `json:"seed,omitempty"`
	// SigningKeySeed is the seed of the account signing key.
	// The account signing key should be used for signing all the user JWTs
	// (credentials) for the account.
	SigningKeySeed string `json:"signing_key_seed,omitempty"`
	JWT            string `json:"jwt,omitempty" cue:",opt"`
}

type GroupRef struct {
	Name *string `json:"name,omitempty" cue:""`
}

type Member struct {
	hz.ObjectMeta `json:"metadata,omitempty"`

	Spec MemberSpec `json:"spec,omitempty" cue:""`
}

type MemberSpec struct {
	GroupRef *GroupRef `json:"groupRef,omitempty" cue:""`
	UserRef  *UserRef  `json:"userRef,omitempty" cue:""`
}

type User struct {
	hz.ObjectMeta `json:"metadata"`

	Spec   UserSpec   `json:"spec"`
	Status UserStatus `json:"status"`
}

type UserClaims struct {
	Sub     *string  `json:"sub,omitempty" cue:""`
	Iss     *string  `json:"iss,omitempty" cue:""`
	Name    *string  `json:"name,omitempty" cue:""`
	Email   *string  `json:"email,omitempty" cue:""`
	Groups  []string `json:"groups,omitempty"`
	Picture *string  `json:"picture,omitempty"`
}

type UserCreateAction struct {
	hz.Client
}

type UserRef struct {
	Name *string `json:"name,omitempty" cue:""`
}

type UserSpec struct {
	Claims *UserClaims `json:"claims,omitempty" cue:""`
}

type UserStatus struct {
	// ID of the user, which for NATS is the public key.
	ID string `json:"id"`
	// Seed of the user.
	// The Seed (or "seed") can be converted into the user public
	// and private keys. The public key must match the user ID.
	Seed string `json:"nkey"`
	// JWT of the user.
	// The JWT contains the user claims (i.e. name, config, limits, etc.)
	// and is signed using an account NKey.
	JWT string `json:"jwt"`
}