namespace ZB.MOM.WW.OtOpcUa.Security.Ldap;

/// <summary>Outcome of an LDAP bind attempt. <see cref="Roles"/> is the mapped-set of Admin roles.</summary>
public sealed record LdapAuthResult(
    bool Success,
    string? DisplayName,
    string? Username,
    IReadOnlyList<string> Groups,
    IReadOnlyList<string> Roles,
    string? Error)
{
    /// <summary>
    ///     <c>true</c> when this failure is a SYSTEM-side directory fault (the directory is unreachable or
    ///     the service account is misconfigured) rather than a user-credential deny. Feeds the OPC UA
    ///     data-plane authenticator's outage circuit (03/S2): a run of consecutive system-side failures
    ///     opens the circuit and fails fast, whereas user-side denies never trip it. Always <c>false</c>
    ///     on success and on user-side denies; set only on the delegated real path for the library's
    ///     directory-unreachable bucket.
    /// </summary>
    public bool IsSystemFailure { get; init; }
}
