namespace DodoSSH.Contracts;

/// <summary>
/// The kind of vault item a sync change refers to.
/// </summary>
/// <remarks>
/// Values are persisted in the change log and are part of the wire contract. Append only;
/// never renumber. These mirror <c>CryptoSpec.AadResourceType</c> for the item types, but are
/// a separate enum because only syncable items appear here.
/// </remarks>
public enum SyncEntityType
{
    /// <summary>Not a legal value.</summary>
    Unspecified = 0,

    /// <summary>An SSH host.</summary>
    Host = 1,

    /// <summary>A credential.</summary>
    Credential = 2,

    /// <summary>An SSH key pair.</summary>
    SshKey = 3,

    /// <summary>A host group.</summary>
    HostGroup = 4,

    /// <summary>A tag.</summary>
    Tag = 5,

    /// <summary>A host-to-tag association.</summary>
    HostTag = 6,

    /// <summary>A host-to-credential association.</summary>
    HostCredential = 7,

    /// <summary>A command snippet.</summary>
    Snippet = 8,

    /// <summary>A port forward.</summary>
    PortForward = 9,

    /// <summary>A known SSH host key.</summary>
    KnownHostKey = 10,

    /// <summary>One connection that was made, and how long it lasted.</summary>
    /// <remarks>
    /// The first member added here since the contract was frozen; every one before it was reserved in
    /// advance. Logs are synced items rather than local files because they are audit records — an
    /// administrator has to be able to read a shared vault's history once teams land, and a log kept only on
    /// the machine that produced it can be neither read nor trusted by anybody else. See ADR 0001 for what
    /// that costs in metadata.
    /// </remarks>
    ConnectionLogEntry = 11,

    /// <summary>One create, edit or delete of a vault item.</summary>
    /// <inheritdoc cref="ConnectionLogEntry" path="/remarks" />
    ActivityLogEntry = 12,

    /// <summary>
    /// An S3-compatible bucket, and the credentials that reach it.
    /// </summary>
    /// <remarks>
    /// Named for the protocol's shape rather than for Amazon, because what it addresses is any service
    /// speaking S3 — MinIO, R2, Backblaze, Ceph — and a member called <c>S3</c> would read as a claim about
    /// the vendor. The interface says S3, which is what people call the protocol.
    /// </remarks>
    ObjectStore = 13,

    /// <summary>
    /// A Spelunk API key, and the one Spelunk address it may be sent to.
    /// </summary>
    /// <remarks>
    /// An item of its own rather than a credential's password, because the address is the point: a link from
    /// Spelunk can be sent by anything on the machine, so a key may only go where the user said it goes, and
    /// only an item that carries both can say so. See <c>SpelunkKeySecret</c>.
    /// </remarks>
    SpelunkKey = 14,
}