gunnar-server 2.0.0

//! **The owner's enterprise list on the real stores** (2026-10-05):
//! `gunnar_grpc::enterprise::EnterprisePlane` over `gunnar_core`'s account
//! audit logs, its name filter and the identity table's shield and looks.

use gunnar_core::account_audit::{to_csv, to_json, AccountEntry, AccountEvent, AuditQuery, Outcome};
use gunnar_core::name_filter::{NameKind, NameReview, Verdict};
use gunnar_core::{OperatorAccess, OperatorAccessState};
use gunnar_grpc::enterprise::{
    AccountAuditEvent, AccountAuditQuery, EnterprisePlane, NameVerdict, OperatorAccessDecision,
};
use gunnar_grpc::{ControlError, ControlResult};

use super::{internal, CoreControlPlane};

fn entry_out(e: AccountEntry) -> gunnar_proto::AuditEntry {
    gunnar_proto::AuditEntry {
        seq: e.seq,
        at_unix_ms: e.at_unix_ms,
        kind: e.kind,
        actor: e.actor,
        actor_role: e.actor_role,
        target: e.target,
        detail: e.detail,
        outcome: e.outcome,
        prev: e.prev,
        hash: e.hash,
    }
}

fn query_in(q: &AccountAuditQuery) -> AuditQuery {
    AuditQuery {
        kinds: q.kinds.clone(),
        actor: q.actor.clone(),
        since_unix_ms: q.since_unix_ms,
        until_unix_ms: q.until_unix_ms,
        text: q.text.clone(),
        before_seq: q.before_seq,
        limit: q.limit as usize,
    }
}

fn look_out(row: OperatorAccess) -> gunnar_proto::OperatorAccess {
    let state = match row.state {
        OperatorAccessState::Pending => gunnar_proto::OperatorAccessState::Pending,
        OperatorAccessState::Approved => gunnar_proto::OperatorAccessState::Approved,
        OperatorAccessState::Refused => gunnar_proto::OperatorAccessState::Refused,
        OperatorAccessState::Revoked => gunnar_proto::OperatorAccessState::Revoked,
        OperatorAccessState::Expired => gunnar_proto::OperatorAccessState::Expired,
    };
    gunnar_proto::OperatorAccess {
        request_id: row.id,
        code: row.code,
        account: row.account,
        operator: row.operator,
        reason: row.reason,
        minutes: row.minutes,
        requested_at_unix_ms: row.requested_at_unix_ms,
        request_expires_at_unix_ms: row.request_expires_at_unix_ms,
        state: state as i32,
        granted_until_unix_ms: row.granted_until_unix_ms,
        decided_by: row.decided_by,
        decided_at_unix_ms: row.decided_at_unix_ms,
    }
}

fn review_out(r: NameReview) -> gunnar_proto::NameReview {
    gunnar_proto::NameReview {
        id: r.id,
        account: r.account,
        kind: r.kind,
        name: r.name,
        actor: r.actor,
        verdict: r.verdict,
        state: r.state.as_str().to_owned(),
        at_unix_ms: r.at_unix_ms,
        decided_by: r.decided_by,
        decided_at_unix_ms: r.decided_at_unix_ms,
    }
}

fn kind_in(kind: &str) -> ControlResult<NameKind> {
    NameKind::parse(kind).ok_or_else(|| {
        ControlError::InvalidArgument(format!("{kind:?} is not a kind of name: account, member, namespace or repo"))
    })
}

fn lists_out(l: gunnar_core::name_filter::NameLists) -> gunnar_proto::NameLists {
    gunnar_proto::NameLists {
        blocked: l.blocked,
        borderline: l.borderline,
        reserved: l.reserved,
        reserved_prefixes: l.reserved_prefixes,
        allowed: l.allowed,
    }
}

impl CoreControlPlane {
    /// What `actor` is to `account` (`AuthTable::role_in_account`); a machine
    /// that authenticated as one is named so even where the table says less.
    fn role_in(&self, actor: &str, machine: bool, account: &str) -> &'static str {
        match self.stores.auth().role_in_account(actor, account) {
            Ok("outsider" | "operator") if machine => "machine",
            Ok(role) => role,
            Err(_) => "unknown",
        }
    }
}

impl EnterprisePlane for CoreControlPlane {
    fn account_of_namespace(&self, namespace: &str) -> ControlResult<Option<String>> {
        self.stores.auth().account_of_namespace(namespace).map_err(internal)
    }

    fn account_of_principal(&self, principal_id: &str) -> ControlResult<Option<String>> {
        self.stores.auth().account_of_principal(principal_id).map_err(internal)
    }

    fn is_account_admin(&self, principal_id: &str, account: &str) -> ControlResult<bool> {
        self.stores.auth().is_account_admin(principal_id, account).map_err(internal)
    }

    fn shielded(&self, principal_id: &str, namespace: &str) -> ControlResult<bool> {
        self.stores.auth().shielded(principal_id, namespace).map_err(internal)
    }

    fn account_audit_record(&self, account: &str, event: &AccountAuditEvent) -> ControlResult<()> {
        let role = self.role_in(&event.actor, event.actor_machine, account);
        self.stores
            .account_audit()
            .append(
                account,
                AccountEvent {
                    kind: &event.kind,
                    actor: &event.actor,
                    actor_role: role,
                    target: &event.target,
                    detail: &event.detail,
                    outcome: if event.refused { Outcome::Refused } else { Outcome::Ok },
                },
                gunnar_core::now_ms(),
            )
            .map(|_| ())
            .map_err(internal)
    }

    fn account_audit_log(&self, account: &str, query: &AccountAuditQuery) -> ControlResult<gunnar_proto::AuditLogResponse> {
        let log = self.stores.account_audit();
        let page = log.query(account, &query_in(query)).map_err(internal)?;
        // The chain is checked on the FIRST page: every entry hashed once,
        // what an admin sees beside the newest entries.
        let chain = if query.before_seq.is_none() {
            let report = log.verify(account).map_err(internal)?;
            Some(gunnar_proto::AuditChain {
                holds: report.holds,
                entries: report.entries,
                tip_hash: report.tip_hash,
                anchor_seq: report.anchor_seq,
                broken_at_seq: report.broken_at_seq,
                what: report.what,
            })
        } else {
            None
        };
        let (written, _) = log.head(account).map_err(internal)?;
        Ok(gunnar_proto::AuditLogResponse {
            account: account.to_owned(),
            entries: page.entries.into_iter().map(entry_out).collect(),
            next_before_seq: page.next_before_seq,
            chain,
            retention_days: log.retention_days(),
            written,
        })
    }

    fn account_audit_export(
        &self,
        account: &str,
        query: &AccountAuditQuery,
        format: gunnar_proto::AuditExportFormat,
    ) -> ControlResult<gunnar_proto::ExportAuditLogResponse> {
        let entries = self.stores.account_audit().all(account, &query_in(query)).map_err(internal)?;
        let day = gunnar_core::iso8601_utc(gunnar_core::now_ms());
        let day = &day[..10];
        let (body, content_type, ext) = match format {
            gunnar_proto::AuditExportFormat::Json => (to_json(&entries), "application/json", "json"),
            _ => (to_csv(&entries), "text/csv; charset=utf-8", "csv"),
        };
        Ok(gunnar_proto::ExportAuditLogResponse {
            body: body.into_bytes(),
            content_type: content_type.to_owned(),
            file_name: format!("audit-{account}-{day}.{ext}"),
            entries: entries.len() as u64,
        })
    }

    fn aggregates(&self) -> ControlResult<gunnar_proto::AggregatesResponse> {
        let auth = self.stores.auth();
        let mut out = gunnar_proto::AggregatesResponse {
            at_unix_ms: gunnar_core::now_ms(),
            ..Default::default()
        };
        let mut accounts = std::collections::BTreeSet::new();
        let mut employers = std::collections::BTreeSet::new();
        for p in auth.principals().map_err(internal)? {
            if p.kind != gunnar_core::PrincipalKind::User {
                continue;
            }
            match auth.employer_of(&p.id).map_err(internal)? {
                Some(employer) => {
                    out.members += 1;
                    employers.insert(employer);
                }
                // A person who is an account — not the box's own first
                // identity, whose namespace is the estate's.
                None if auth.account_of_principal(&p.id).map_err(internal)?.as_deref() == Some(p.id.as_str()) => {
                    accounts.insert(p.id);
                }
                None => {}
            }
        }
        out.accounts = accounts.len() as u64;
        out.enterprise_accounts = employers.iter().filter(|a| accounts.contains(*a)).count() as u64;
        // A CLAN's namespace is inside the accounts too (clans + the
        // enterprise list, 2026-10-05): its repositories are its members',
        // never the operator's. A clan is no account of its own in the count.
        let in_account = |ns: &str| {
            let first = ns.split('/').next().unwrap_or("");
            accounts.contains(first) || auth.is_clan(first).unwrap_or(false)
        };
        // ★ **The WHOLE estate** (round 5.3; the owner on test2 2026-10-08:
        // "Repositories 0 (0 public) · Storage used 0 B · Room held —" over
        // the seven repositories, ~205 MB, the release functest seeded into
        // the operator's `nordisk`). Repositories, the public ones among them,
        // the stored bytes and the room held are every namespace's — the
        // operator's own forge included — as numbers, never names.
        // `operator_repos` is the operator's SHARE of `repos`: what is not
        // inside an account.
        for repo in self.stores.catalog().list(None).map_err(internal)? {
            out.repos += 1;
            if repo.visibility == gunnar_core::Visibility::Public {
                out.public_repos += 1;
            }
            if !in_account(&repo.namespace) {
                out.operator_repos += 1;
            }
        }
        if let Ok(rows) = gunnar_grpc::ControlPlane::usage(self, None) {
            out.stored_bytes = rows.iter().map(|row| row.pack_bytes.saturating_add(row.lfs_bytes)).sum();
        }
        #[cfg(feature = "metered")]
        if let Ok(facts) = gunnar_grpc::ControlPlane::entitlement_list(self) {
            for fact in &facts {
                out.sold_bytes = out.sold_bytes.saturating_add(fact.caps.get("pack_bytes").copied().unwrap_or(0));
                // Accounts holding a paid plan are ACCOUNTS: the operator's
                // forge is none.
                let state = gunnar_proto::EntitlementState::try_from(fact.state).unwrap_or_default();
                if in_account(&fact.namespace) && matches!(state, gunnar_proto::EntitlementState::Paid | gunnar_proto::EntitlementState::Grace) {
                    out.paid_accounts += 1;
                }
            }
        }
        for look in auth.operator_access(None).map_err(internal)? {
            match look.state {
                OperatorAccessState::Approved => out.looks_live += 1,
                OperatorAccessState::Pending => out.looks_pending += 1,
                _ => {}
            }
        }
        let alarms = gunnar_grpc::ControlPlane::health_alarms(self);
        out.health_alarms = alarms.len() as u32;
        out.health = if alarms.is_empty() { "ok".to_owned() } else { "alarm".to_owned() };
        Ok(out)
    }

    fn operator_access_request(
        &self,
        account: &str,
        operator: &str,
        reason: &str,
        minutes: u32,
    ) -> ControlResult<gunnar_proto::OperatorAccess> {
        let row = self
            .stores
            .auth()
            .request_operator_access(account, operator, reason, minutes, gunnar_core::now_ms())
            .map_err(internal)?;
        Ok(look_out(row))
    }

    fn operator_access_list(&self, account: Option<&str>) -> ControlResult<Vec<gunnar_proto::OperatorAccess>> {
        Ok(self
            .stores
            .auth()
            .operator_access(account)
            .map_err(internal)?
            .into_iter()
            .map(look_out)
            .collect())
    }

    fn operator_access_get(&self, request_id: &str) -> ControlResult<Option<gunnar_proto::OperatorAccess>> {
        Ok(self.stores.auth().operator_access_by_id(request_id).map_err(internal)?.map(look_out))
    }

    fn operator_access_decide(&self, decision: &OperatorAccessDecision) -> ControlResult<gunnar_proto::OperatorAccess> {
        let step_up = decision
            .step_up
            .as_ref()
            .map(|(id, count)| (gunnar_grpc::webauthn::b64url(id), *count));
        let row = self
            .stores
            .auth()
            .decide_operator_access_stepped(
                &decision.request_id,
                &decision.approver,
                decision.approve,
                decision.minutes,
                step_up.as_ref().map(|(id, count)| (id.as_str(), *count)),
                gunnar_core::now_ms(),
            )
            .map_err(internal)?;
        Ok(look_out(row))
    }

    fn operator_access_revoke(&self, request_id: &str, by: &str) -> ControlResult<gunnar_proto::OperatorAccess> {
        let row = self
            .stores
            .auth()
            .revoke_operator_access(request_id, by, gunnar_core::now_ms())
            .map_err(internal)?;
        Ok(look_out(row))
    }

    fn name_check(&self, kind: &str, name: &str, account: &str) -> ControlResult<NameVerdict> {
        let kind = kind_in(kind)?;
        let verdict = self.stores.names().check(kind, name, account).map_err(internal)?;
        Ok(NameVerdict {
            verdict: verdict.as_str().to_owned(),
            sentence: if verdict == Verdict::Clean { String::new() } else { verdict.sentence(kind, name) },
        })
    }

    fn name_review_add(
        &self,
        kind: &str,
        name: &str,
        account: &str,
        actor: &str,
        hold: bool,
    ) -> ControlResult<gunnar_proto::NameReview> {
        let kind = kind_in(kind)?;
        let names = self.stores.names();
        let verdict = names.check(kind, name, account).map_err(internal)?;
        let now = gunnar_core::now_ms();
        let row = if hold {
            names.hold(kind, name, account, actor, &verdict, now)
        } else {
            names.note(kind, name, account, actor, &verdict, now)
        }
        .map_err(internal)?;
        Ok(review_out(row))
    }

    fn name_lists(&self) -> ControlResult<gunnar_proto::NameLists> {
        Ok(lists_out(self.stores.names().lists().map_err(internal)?))
    }

    fn set_name_lists(&self, lists: gunnar_proto::NameLists) -> ControlResult<gunnar_proto::NameLists> {
        let stored = self
            .stores
            .names()
            .set_lists(gunnar_core::name_filter::NameLists {
                blocked: lists.blocked,
                borderline: lists.borderline,
                reserved: lists.reserved,
                reserved_prefixes: lists.reserved_prefixes,
                allowed: lists.allowed,
            })
            .map_err(internal)?;
        Ok(lists_out(stored))
    }

    fn name_reviews(&self, account: &str) -> ControlResult<Vec<gunnar_proto::NameReview>> {
        Ok(self
            .stores
            .names()
            .reviews(account)
            .map_err(internal)?
            .into_iter()
            .map(review_out)
            .collect())
    }

    fn name_review_decide(&self, account: &str, id: &str, allow: bool, by: &str) -> ControlResult<gunnar_proto::NameReview> {
        let row = self
            .stores
            .names()
            .decide(id, account, allow, by, gunnar_core::now_ms())
            .map_err(internal)?;
        Ok(review_out(row))
    }
}