batata-consul-client 0.0.2

use std::sync::Arc;

use serde::{Deserialize, Serialize};

use crate::client::HttpClient;
use crate::error::Result;
use crate::types::{QueryMeta, QueryOptions, WriteMeta, WriteOptions};

/// ACL token type
#[derive(Clone, Debug, Serialize, Deserialize)]
pub enum ACLTokenType {
    #[serde(rename = "client")]
    Client,
    #[serde(rename = "management")]
    Management,
}

/// ACL policy
#[derive(Clone, Debug, Serialize, Deserialize)]
#[serde(rename_all = "PascalCase")]
pub struct ACLPolicy {
    /// Policy ID
    #[serde(rename = "ID")]
    #[serde(skip_serializing_if = "Option::is_none")]
    pub id: Option<String>,
    /// Policy name
    pub name: String,
    /// Policy description
    #[serde(default)]
    #[serde(skip_serializing_if = "String::is_empty")]
    pub description: String,
    /// Policy rules (HCL or JSON)
    #[serde(default)]
    #[serde(skip_serializing_if = "String::is_empty")]
    pub rules: String,
    /// Datacenters this policy applies to
    #[serde(default)]
    #[serde(skip_serializing_if = "Vec::is_empty")]
    pub datacenters: Vec<String>,
    /// Hash of the policy
    #[serde(default)]
    pub hash: String,
    /// Create index
    #[serde(default)]
    pub create_index: u64,
    /// Modify index
    #[serde(default)]
    pub modify_index: u64,
}

impl ACLPolicy {
    pub fn new(name: &str) -> Self {
        Self {
            id: None,
            name: name.to_string(),
            description: String::new(),
            rules: String::new(),
            datacenters: Vec::new(),
            hash: String::new(),
            create_index: 0,
            modify_index: 0,
        }
    }

    pub fn with_description(mut self, description: &str) -> Self {
        self.description = description.to_string();
        self
    }

    pub fn with_rules(mut self, rules: &str) -> Self {
        self.rules = rules.to_string();
        self
    }

    pub fn with_datacenters(mut self, datacenters: Vec<String>) -> Self {
        self.datacenters = datacenters;
        self
    }
}

/// ACL token policy link
#[derive(Clone, Debug, Serialize, Deserialize)]
#[serde(rename_all = "PascalCase")]
pub struct ACLTokenPolicyLink {
    /// Policy ID
    #[serde(rename = "ID")]
    #[serde(skip_serializing_if = "Option::is_none")]
    pub id: Option<String>,
    /// Policy name
    #[serde(skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
}

impl ACLTokenPolicyLink {
    pub fn by_id(id: &str) -> Self {
        Self {
            id: Some(id.to_string()),
            name: None,
        }
    }

    pub fn by_name(name: &str) -> Self {
        Self {
            id: None,
            name: Some(name.to_string()),
        }
    }
}

/// ACL token role link
#[derive(Clone, Debug, Serialize, Deserialize)]
#[serde(rename_all = "PascalCase")]
pub struct ACLTokenRoleLink {
    /// Role ID
    #[serde(rename = "ID")]
    #[serde(skip_serializing_if = "Option::is_none")]
    pub id: Option<String>,
    /// Role name
    #[serde(skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
}

/// ACL token
#[derive(Clone, Debug, Serialize, Deserialize)]
#[serde(rename_all = "PascalCase")]
pub struct ACLToken {
    /// Token accessor ID (public ID)
    #[serde(rename = "AccessorID")]
    #[serde(skip_serializing_if = "Option::is_none")]
    pub accessor_id: Option<String>,
    /// Token secret ID (private, used for authentication)
    #[serde(rename = "SecretID")]
    #[serde(skip_serializing_if = "Option::is_none")]
    pub secret_id: Option<String>,
    /// Token description
    #[serde(default)]
    #[serde(skip_serializing_if = "String::is_empty")]
    pub description: String,
    /// Policies attached to token
    #[serde(default)]
    #[serde(skip_serializing_if = "Vec::is_empty")]
    pub policies: Vec<ACLTokenPolicyLink>,
    /// Roles attached to token
    #[serde(default)]
    #[serde(skip_serializing_if = "Vec::is_empty")]
    pub roles: Vec<ACLTokenRoleLink>,
    /// Service identities
    #[serde(default)]
    #[serde(skip_serializing_if = "Vec::is_empty")]
    pub service_identities: Vec<ACLServiceIdentity>,
    /// Node identities
    #[serde(default)]
    #[serde(skip_serializing_if = "Vec::is_empty")]
    pub node_identities: Vec<ACLNodeIdentity>,
    /// Whether this is a local token
    #[serde(default)]
    pub local: bool,
    /// Token expiration time
    #[serde(skip_serializing_if = "Option::is_none")]
    pub expiration_time: Option<String>,
    /// Token expiration TTL
    #[serde(rename = "ExpirationTTL")]
    #[serde(skip_serializing_if = "Option::is_none")]
    pub expiration_ttl: Option<String>,
    /// Hash of the token
    #[serde(default)]
    pub hash: String,
    /// Create index
    #[serde(default)]
    pub create_index: u64,
    /// Modify index
    #[serde(default)]
    pub modify_index: u64,
}

impl ACLToken {
    pub fn new() -> Self {
        Self {
            accessor_id: None,
            secret_id: None,
            description: String::new(),
            policies: Vec::new(),
            roles: Vec::new(),
            service_identities: Vec::new(),
            node_identities: Vec::new(),
            local: false,
            expiration_time: None,
            expiration_ttl: None,
            hash: String::new(),
            create_index: 0,
            modify_index: 0,
        }
    }

    pub fn with_description(mut self, description: &str) -> Self {
        self.description = description.to_string();
        self
    }

    pub fn with_policy(mut self, policy: ACLTokenPolicyLink) -> Self {
        self.policies.push(policy);
        self
    }

    pub fn with_role(mut self, role: ACLTokenRoleLink) -> Self {
        self.roles.push(role);
        self
    }

    pub fn with_service_identity(mut self, identity: ACLServiceIdentity) -> Self {
        self.service_identities.push(identity);
        self
    }

    pub fn local_only(mut self) -> Self {
        self.local = true;
        self
    }
}

impl Default for ACLToken {
    fn default() -> Self {
        Self::new()
    }
}

/// ACL service identity
#[derive(Clone, Debug, Serialize, Deserialize)]
#[serde(rename_all = "PascalCase")]
pub struct ACLServiceIdentity {
    /// Service name
    pub service_name: String,
    /// Datacenters
    #[serde(default)]
    #[serde(skip_serializing_if = "Vec::is_empty")]
    pub datacenters: Vec<String>,
}

impl ACLServiceIdentity {
    pub fn new(service_name: &str) -> Self {
        Self {
            service_name: service_name.to_string(),
            datacenters: Vec::new(),
        }
    }

    pub fn with_datacenters(mut self, datacenters: Vec<String>) -> Self {
        self.datacenters = datacenters;
        self
    }
}

/// ACL node identity
#[derive(Clone, Debug, Serialize, Deserialize)]
#[serde(rename_all = "PascalCase")]
pub struct ACLNodeIdentity {
    /// Node name
    pub node_name: String,
    /// Datacenter
    pub datacenter: String,
}

impl ACLNodeIdentity {
    pub fn new(node_name: &str, datacenter: &str) -> Self {
        Self {
            node_name: node_name.to_string(),
            datacenter: datacenter.to_string(),
        }
    }
}

/// ACL role
#[derive(Clone, Debug, Serialize, Deserialize)]
#[serde(rename_all = "PascalCase")]
pub struct ACLRole {
    /// Role ID
    #[serde(rename = "ID")]
    #[serde(skip_serializing_if = "Option::is_none")]
    pub id: Option<String>,
    /// Role name
    pub name: String,
    /// Role description
    #[serde(default)]
    #[serde(skip_serializing_if = "String::is_empty")]
    pub description: String,
    /// Policies attached to role
    #[serde(default)]
    #[serde(skip_serializing_if = "Vec::is_empty")]
    pub policies: Vec<ACLTokenPolicyLink>,
    /// Service identities
    #[serde(default)]
    #[serde(skip_serializing_if = "Vec::is_empty")]
    pub service_identities: Vec<ACLServiceIdentity>,
    /// Node identities
    #[serde(default)]
    #[serde(skip_serializing_if = "Vec::is_empty")]
    pub node_identities: Vec<ACLNodeIdentity>,
    /// Hash
    #[serde(default)]
    pub hash: String,
    /// Create index
    #[serde(default)]
    pub create_index: u64,
    /// Modify index
    #[serde(default)]
    pub modify_index: u64,
}

impl ACLRole {
    pub fn new(name: &str) -> Self {
        Self {
            id: None,
            name: name.to_string(),
            description: String::new(),
            policies: Vec::new(),
            service_identities: Vec::new(),
            node_identities: Vec::new(),
            hash: String::new(),
            create_index: 0,
            modify_index: 0,
        }
    }

    pub fn with_description(mut self, description: &str) -> Self {
        self.description = description.to_string();
        self
    }

    pub fn with_policy(mut self, policy: ACLTokenPolicyLink) -> Self {
        self.policies.push(policy);
        self
    }
}

/// ACL replication status
#[derive(Clone, Debug, Deserialize)]
#[serde(rename_all = "PascalCase")]
pub struct ACLReplicationStatus {
    /// Whether replication is enabled
    pub enabled: bool,
    /// Whether this is the primary datacenter
    pub running: bool,
    /// Source datacenter
    pub source_datacenter: String,
    /// Replicated index
    pub replicated_index: u64,
    /// Replicated token index
    pub replicated_token_index: u64,
    /// Last success time
    pub last_success: String,
    /// Last error time
    pub last_error: String,
}

/// ACL API client
pub struct ACL {
    client: Arc<HttpClient>,
}

impl ACL {
    /// Create a new ACL client
    pub fn new(client: Arc<HttpClient>) -> Self {
        Self { client }
    }

    // Token operations

    /// Create a new token
    pub async fn token_create(&self, token: &ACLToken, opts: Option<&WriteOptions>) -> Result<(ACLToken, WriteMeta)> {
        let mut builder = self.client.put("/v1/acl/token").json(token);

        if let Some(opts) = opts {
            builder = self.client.apply_write_options(builder, opts);
        }

        self.client.write(builder).await
    }

    /// Update an existing token
    pub async fn token_update(&self, token: &ACLToken, opts: Option<&WriteOptions>) -> Result<(ACLToken, WriteMeta)> {
        let accessor_id = token.accessor_id.as_ref().ok_or_else(|| {
            crate::error::ConsulError::InvalidConfig("accessor_id is required for update".to_string())
        })?;

        let path = format!("/v1/acl/token/{}", accessor_id);
        let mut builder = self.client.put(&path).json(token);

        if let Some(opts) = opts {
            builder = self.client.apply_write_options(builder, opts);
        }

        self.client.write(builder).await
    }

    /// Clone an existing token
    pub async fn token_clone(&self, accessor_id: &str, description: Option<&str>, opts: Option<&WriteOptions>) -> Result<(ACLToken, WriteMeta)> {
        let path = format!("/v1/acl/token/{}/clone", accessor_id);

        let body = if let Some(desc) = description {
            serde_json::json!({"Description": desc})
        } else {
            serde_json::json!({})
        };

        let mut builder = self.client.put(&path).json(&body);

        if let Some(opts) = opts {
            builder = self.client.apply_write_options(builder, opts);
        }

        self.client.write(builder).await
    }

    /// Delete a token
    pub async fn token_delete(&self, accessor_id: &str, opts: Option<&WriteOptions>) -> Result<(bool, WriteMeta)> {
        let path = format!("/v1/acl/token/{}", accessor_id);
        let mut builder = self.client.delete(&path);

        if let Some(opts) = opts {
            builder = self.client.apply_write_options(builder, opts);
        }

        self.client.write_bool(builder).await
    }

    /// Read a token by accessor ID
    pub async fn token_read(&self, accessor_id: &str, opts: Option<&QueryOptions>) -> Result<(ACLToken, QueryMeta)> {
        let path = format!("/v1/acl/token/{}", accessor_id);
        let mut builder = self.client.get(&path);

        if let Some(opts) = opts {
            builder = self.client.apply_query_options(builder, opts);
        }

        self.client.query(builder).await
    }

    /// Get the current token (self)
    pub async fn token_read_self(&self, opts: Option<&QueryOptions>) -> Result<(ACLToken, QueryMeta)> {
        let mut builder = self.client.get("/v1/acl/token/self");

        if let Some(opts) = opts {
            builder = self.client.apply_query_options(builder, opts);
        }

        self.client.query(builder).await
    }

    /// List all tokens
    pub async fn token_list(&self, opts: Option<&QueryOptions>) -> Result<(Vec<ACLToken>, QueryMeta)> {
        let mut builder = self.client.get("/v1/acl/tokens");

        if let Some(opts) = opts {
            builder = self.client.apply_query_options(builder, opts);
        }

        self.client.query(builder).await
    }

    // Policy operations

    /// Create a new policy
    pub async fn policy_create(&self, policy: &ACLPolicy, opts: Option<&WriteOptions>) -> Result<(ACLPolicy, WriteMeta)> {
        let mut builder = self.client.put("/v1/acl/policy").json(policy);

        if let Some(opts) = opts {
            builder = self.client.apply_write_options(builder, opts);
        }

        self.client.write(builder).await
    }

    /// Update an existing policy
    pub async fn policy_update(&self, policy: &ACLPolicy, opts: Option<&WriteOptions>) -> Result<(ACLPolicy, WriteMeta)> {
        let id = policy.id.as_ref().ok_or_else(|| {
            crate::error::ConsulError::InvalidConfig("id is required for update".to_string())
        })?;

        let path = format!("/v1/acl/policy/{}", id);
        let mut builder = self.client.put(&path).json(policy);

        if let Some(opts) = opts {
            builder = self.client.apply_write_options(builder, opts);
        }

        self.client.write(builder).await
    }

    /// Delete a policy
    pub async fn policy_delete(&self, id: &str, opts: Option<&WriteOptions>) -> Result<(bool, WriteMeta)> {
        let path = format!("/v1/acl/policy/{}", id);
        let mut builder = self.client.delete(&path);

        if let Some(opts) = opts {
            builder = self.client.apply_write_options(builder, opts);
        }

        self.client.write_bool(builder).await
    }

    /// Read a policy by ID
    pub async fn policy_read(&self, id: &str, opts: Option<&QueryOptions>) -> Result<(ACLPolicy, QueryMeta)> {
        let path = format!("/v1/acl/policy/{}", id);
        let mut builder = self.client.get(&path);

        if let Some(opts) = opts {
            builder = self.client.apply_query_options(builder, opts);
        }

        self.client.query(builder).await
    }

    /// Read a policy by name
    pub async fn policy_read_by_name(&self, name: &str, opts: Option<&QueryOptions>) -> Result<(ACLPolicy, QueryMeta)> {
        let path = format!("/v1/acl/policy/name/{}", name);
        let mut builder = self.client.get(&path);

        if let Some(opts) = opts {
            builder = self.client.apply_query_options(builder, opts);
        }

        self.client.query(builder).await
    }

    /// List all policies
    pub async fn policy_list(&self, opts: Option<&QueryOptions>) -> Result<(Vec<ACLPolicy>, QueryMeta)> {
        let mut builder = self.client.get("/v1/acl/policies");

        if let Some(opts) = opts {
            builder = self.client.apply_query_options(builder, opts);
        }

        self.client.query(builder).await
    }

    // Role operations

    /// Create a new role
    pub async fn role_create(&self, role: &ACLRole, opts: Option<&WriteOptions>) -> Result<(ACLRole, WriteMeta)> {
        let mut builder = self.client.put("/v1/acl/role").json(role);

        if let Some(opts) = opts {
            builder = self.client.apply_write_options(builder, opts);
        }

        self.client.write(builder).await
    }

    /// Update an existing role
    pub async fn role_update(&self, role: &ACLRole, opts: Option<&WriteOptions>) -> Result<(ACLRole, WriteMeta)> {
        let id = role.id.as_ref().ok_or_else(|| {
            crate::error::ConsulError::InvalidConfig("id is required for update".to_string())
        })?;

        let path = format!("/v1/acl/role/{}", id);
        let mut builder = self.client.put(&path).json(role);

        if let Some(opts) = opts {
            builder = self.client.apply_write_options(builder, opts);
        }

        self.client.write(builder).await
    }

    /// Delete a role
    pub async fn role_delete(&self, id: &str, opts: Option<&WriteOptions>) -> Result<(bool, WriteMeta)> {
        let path = format!("/v1/acl/role/{}", id);
        let mut builder = self.client.delete(&path);

        if let Some(opts) = opts {
            builder = self.client.apply_write_options(builder, opts);
        }

        self.client.write_bool(builder).await
    }

    /// Read a role by ID
    pub async fn role_read(&self, id: &str, opts: Option<&QueryOptions>) -> Result<(ACLRole, QueryMeta)> {
        let path = format!("/v1/acl/role/{}", id);
        let mut builder = self.client.get(&path);

        if let Some(opts) = opts {
            builder = self.client.apply_query_options(builder, opts);
        }

        self.client.query(builder).await
    }

    /// Read a role by name
    pub async fn role_read_by_name(&self, name: &str, opts: Option<&QueryOptions>) -> Result<(ACLRole, QueryMeta)> {
        let path = format!("/v1/acl/role/name/{}", name);
        let mut builder = self.client.get(&path);

        if let Some(opts) = opts {
            builder = self.client.apply_query_options(builder, opts);
        }

        self.client.query(builder).await
    }

    /// List all roles
    pub async fn role_list(&self, opts: Option<&QueryOptions>) -> Result<(Vec<ACLRole>, QueryMeta)> {
        let mut builder = self.client.get("/v1/acl/roles");

        if let Some(opts) = opts {
            builder = self.client.apply_query_options(builder, opts);
        }

        self.client.query(builder).await
    }

    // Other ACL operations

    /// Bootstrap the ACL system
    pub async fn bootstrap(&self) -> Result<(ACLToken, WriteMeta)> {
        let builder = self.client.put("/v1/acl/bootstrap");
        self.client.write(builder).await
    }

    /// Get ACL replication status
    pub async fn replication(&self, opts: Option<&QueryOptions>) -> Result<(ACLReplicationStatus, QueryMeta)> {
        let mut builder = self.client.get("/v1/acl/replication");

        if let Some(opts) = opts {
            builder = self.client.apply_query_options(builder, opts);
        }

        self.client.query(builder).await
    }
}