package models

// PrincipalClaims is verified identity from JWT (OPA must use this for RBAC).
type PrincipalClaims struct {
	Sub     string   `json:"sub"`
	AgentID string   `json:"agent_id"`
	Roles   []string `json:"roles,omitempty"`
	Scopes  []string `json:"scopes,omitempty"`
}

// AgentRegistryInfo enriches OPA input from the lightweight agent registry (#2).
type AgentRegistryInfo struct {
	DisplayName string         `json:"display_name,omitempty"`
	Tenant      string         `json:"tenant,omitempty"`
	Status      string         `json:"status,omitempty"`
	Roles       []string       `json:"roles,omitempty"`
	Metadata    map[string]any `json:"metadata,omitempty"`
}

// PolicyInput is sent to OPA as the "input" document.
type PolicyInput struct {
	AgentID   string             `json:"agent_id"`
	Tool      string             `json:"tool"`
	Action    string             `json:"action"`
	Amount    *int64             `json:"amount,omitempty"`
	RiskScore *float64           `json:"risk_score,omitempty"`
	TraceID   string             `json:"trace_id"`
	Principal *PrincipalClaims   `json:"principal,omitempty"`
	Agent     *AgentRegistryInfo `json:"agent,omitempty"`
	Extra     map[string]any     `json:"extra,omitempty"`
}

// PolicyDecision is the normalized outcome from policy evaluation.
type PolicyDecision struct {
	Decision string `json:"decision"`
	Reason   string `json:"reason,omitempty"`
	Policy   string `json:"policy,omitempty"`
}
