(ns ird.sharing
  "Delegated access grants: invite other customers to manage parts of a
  domain, and handle invites you receive. Inviting/revoking on a domain is
  subject to the client's domain gate (ird.gate) when configured.

  NOTE: every operation here requires an account JWT (see
  ird.auth/device-login); API keys are not accepted. Every function returns a
  channel (see ird.async)."
  (:require [ird.gate :as gate]
            [ird.transport :as transport]))

(defn list-domain-grants
  "GET /domains/registrations/{id}/grants — Who has delegated access to
  this domain (outgoing)."
  [client id]
  (transport/request client :get ["domains" "registrations" id "grants"]))

(defn invite
  "POST /domains/registrations/{id}/grants — Invite another customer to
  manage parts of this domain. BODY keys include :email, :scopes, :payer,
  :totp_code."
  [client id body]
  (gate/request client "POST /domains/registrations/{id}/grants" {:registration-id id}
                :post ["domains" "registrations" id "grants"] {:body body}))

(defn revoke-grant
  "DELETE /domains/registrations/{id}/grants/{grant-id} — Revoke delegated
  access."
  [client id grant-id]
  (gate/request client "DELETE /domains/registrations/{id}/grants/{grant-id}" {:registration-id id}
                :delete ["domains" "registrations" id "grants" grant-id]))

(defn list-grants
  "GET /grants — Domains shared with this account (incoming)."
  [client]
  (transport/request client :get "/grants"))

(defn accept-grant
  "POST /grants/{id}/accept — Accept a delegated-access invite."
  [client id]
  (transport/request client :post ["grants" id "accept"]))

(defn decline-grant
  "POST /grants/{id}/decline — Decline a delegated-access invite."
  [client id]
  (transport/request client :post ["grants" id "decline"]))

(defn leave-grant
  "POST /grants/{id}/leave — Walk away from an active grant."
  [client id]
  (transport/request client :post ["grants" id "leave"]))