package objstore

import "context"

// Provisioner is the backend seam (§3): everything the console needs a
// backend to do, and nothing an app ever calls. Every method is idempotent —
// "already exists" and "already gone" are successes — because every walk
// that drives one must be re-runnable after a half-failure (§5).
//
// v1 ships the AWS implementation and this package's in-memory fake. A
// Hetzner/R2/Minio provisioner arrives here later without touching a walk.
type Provisioner interface {
	// EnsureBucket creates the bucket if absent and answers its region.
	EnsureBucket(ctx context.Context, name string) (region string, err error)
	// EnsureUser creates the credential principal if absent, scoped to
	// exactly bucketARN (ListBucket on it; Get/Put/DeleteObject under it).
	// deny, when non-nil, adds a Deny on reading an object tagged infected.
	// It is threaded from the RECORD rather than asked of a Scanner, so a
	// repair walk on a deployment with no engine built can still write the
	// policy the record asks for instead of silently dropping enforcement.
	EnsureUser(ctx context.Context, name, path, bucketARN string, deny *DenyTag) (arn string, err error)
	MintKey(ctx context.Context, user string) (id, secret string, err error)
	DeleteKey(ctx context.Context, user, id string) error
	// ReapKeys deletes every access key of user NOT named in keep. The grant
	// walk's crash-safety depends on it: a key minted before a failed
	// delivery is recorded nowhere, so only list-and-delete can find it.
	ReapKeys(ctx context.Context, user string, keep []string) error
	// EmptyBucket deletes every object; paginated and resumable.
	EmptyBucket(ctx context.Context, name string) error
	DeleteBucket(ctx context.Context, name string) error
	// DeleteUser removes the user's keys and inline policy first.
	DeleteUser(ctx context.Context, user string) error
}