using ZB.MOM.WW.OtOpcUa.Configuration.Enums;

namespace ZB.MOM.WW.OtOpcUa.Configuration.Entities;

/// <summary>
///     One ACL grant: a principal gets a set of <see cref="NodePermissions"/> at a specific scope.
///     Generation-versioned per decision. See <c>acl-design.md</c> for evaluation algorithm.
/// </summary>
public sealed class NodeAcl
{
    /// <summary>Gets or sets the database row ID for this ACL entry.</summary>
    public Guid NodeAclRowId { get; set; }

    /// <summary>Gets or sets the logical ID of this ACL entry.</summary>
    public required string NodeAclId { get; set; }

    /// <summary>Gets or sets the cluster ID for this ACL entry.</summary>
    public required string ClusterId { get; set; }

    /// <summary>Gets or sets the principal (API-key principal name, or the reserved <c>anonymous</c>) this ACL entry grants to.</summary>
    public required string Principal { get; set; }

    /// <summary>Gets or sets the scope kind for this ACL entry.</summary>
    public required NodeAclScopeKind ScopeKind { get; set; }

    /// <summary>NULL when <see cref="ScopeKind"/> = <see cref="NodeAclScopeKind.Cluster"/>; otherwise the scoped entity's logical ID.</summary>
    public string? ScopeId { get; set; }

    /// <summary>Bitmask of <see cref="NodePermissions"/>. Stored as int in SQL.</summary>
    public required NodePermissions PermissionFlags { get; set; }

    /// <summary>Gets or sets optional notes for this ACL entry.</summary>
    public string? Notes { get; set; }

    /// <summary>Optimistic concurrency token for last-write-wins detection in the v2 live-edit model.</summary>
    public byte[] RowVersion { get; set; } = Array.Empty<byte>();
}