using ZB.MOM.WW.OtOpcUa.Configuration.Enums;

namespace ZB.MOM.WW.OtOpcUa.Configuration.Entities;

/// <summary>
///     One ACL grant: an LDAP group gets a set of <see cref="NodePermissions"/> at a specific scope.
///     Generation-versioned per decision #130. See <c>acl-design.md</c> for evaluation algorithm.
/// </summary>
public sealed class NodeAcl
{
    public Guid NodeAclRowId { get; set; }

    public long GenerationId { get; set; }

    public required string NodeAclId { get; set; }

    public required string ClusterId { get; set; }

    public required string LdapGroup { get; set; }

    public required NodeAclScopeKind ScopeKind { get; set; }

    /// <summary>NULL when <see cref="ScopeKind"/> = <see cref="NodeAclScopeKind.Cluster"/>; otherwise the scoped entity's logical ID.</summary>
    public string? ScopeId { get; set; }

    /// <summary>Bitmask of <see cref="NodePermissions"/>. Stored as int in SQL.</summary>
    public required NodePermissions PermissionFlags { get; set; }

    public string? Notes { get; set; }

    public ConfigGeneration? Generation { get; set; }
}