// Copyright (c) Tailscale Inc & contributors
// SPDX-License-Identifier: BSD-3-Clause

// Package peercap defines the capabilities that can be granted to peer nodes.
package peercap

// Cap represents a capability granted to a peer by a [tailscale.com/tailcfg.FilterRule]
// when the peer communicates with the node that has this rule.
// Its meaning is application-defined.
//
// It must be a URL like "https://tailscale.com/cap/file-send"
// or "tailscale.com/cap/webui".
type Cap string

// Prefix is a prefix for [tailscale.com/tailcfg.PeerCapMap] keys that share a
// common namespace, where each entry represents a distinct named instance (e.g.
// one per App definition). The full key is formed by concatenating the prefix
// with the instance name.
type Prefix string

// ToAttribute returns the full [Cap] key for the given value under this prefix,
// of the form prefix+value.
func (p Prefix) ToAttribute(value string) Cap {
	return Cap(string(p) + value)
}

const (
	// FileSharingTarget grants the current node the ability to send
	// files to the peer which has this capability.
	FileSharingTarget Cap = "https://tailscale.com/cap/file-sharing-target"
	// FileSharingSend grants the ability to receive files from a
	// node that's owned by a different user.
	FileSharingSend Cap = "https://tailscale.com/cap/file-send"
	// DebugPeer grants the ability for a peer to read this node's
	// goroutines, metrics, magicsock internal state, etc.
	DebugPeer Cap = "https://tailscale.com/cap/debug-peer"
	// WakeOnLAN grants the ability to send a Wake-On-LAN packet.
	WakeOnLAN Cap = "https://tailscale.com/cap/wake-on-lan"
	// Ingress grants the ability for a peer to send ingress traffic.
	Ingress Cap = "https://tailscale.com/cap/ingress"
	// WebUI grants the ability for a peer to edit features from the
	// device Web UI.
	WebUI Cap = "tailscale.com/cap/webui"
	// Taildrive grants the ability for a peer to access Taildrive
	// shares.
	Taildrive Cap = "tailscale.com/cap/drive"
	// TaildriveSharer indicates that a peer has the ability to
	// share folders with us.
	TaildriveSharer Cap = "tailscale.com/cap/drive-sharer"

	// Kubernetes grants a peer Kubernetes-specific
	// capabilities, such as the ability to impersonate specific Tailscale
	// user groups as Kubernetes user groups. This capability is read by
	// peers that are Tailscale Kubernetes operator instances.
	Kubernetes Cap = "tailscale.com/cap/kubernetes"

	// Relay grants the ability for a peer to allocate relay
	// endpoints.
	Relay Cap = "tailscale.com/cap/relay"
	// RelayTarget grants the current node the ability to allocate
	// relay endpoints to the peer which has this capability.
	RelayTarget Cap = "tailscale.com/cap/relay-target"

	// TsIDP grants a peer tsidp-specific
	// capabilities, such as the ability to add user groups to the OIDC
	// claim
	TsIDP Cap = "tailscale.com/cap/tsidp"
)

const (
	// Conn25Prefix is the prefix for per-app [Cap] names that grant a peer
	// access to an app provided by a conn25 app connector.
	// Actual capabilities look like "tailscale.com/cap/conn25/example" for
	// an app named "example".
	// Each value under such a key is a [tailscale.com/tailcfg.ProtoPortRange].
	// If multiple values are present, the union of all protocol/port
	// combinations described shall be permitted.
	Conn25Prefix Prefix = "tailscale.com/cap/conn25/"
)