#[derive(Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(transparent)]
pub struct ConsentId(Uuid);

#[must_use]
pub fn generate() -> Self;

#[must_use]
pub const fn from_uuid(uuid: Uuid) -> Self;

#[must_use]
pub const fn as_uuid(&self) -> &Uuid;

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ConsentRecord {
/// Unique consent record ID

pub consent_id: ConsentId,
/// Tenant this consent record belongs to (multi-tenant isolation)

pub tenant_id: TenantId,
/// DID of the agent granted access

pub agent_did: String,
/// DID of the human who granted consent

pub human_root_did: String,
/// Template variable names the agent may access

pub variables: Vec<String>,
/// Target domains the agent may reach with these credentials

pub destination_domains: Vec<String>,
/// Scopes the consent covers

pub scopes: Vec<String>,
/// Human-readable identifier of who granted consent

pub granted_by: String,
/// When consent was granted

pub granted_at: chrono::DateTime<chrono::Utc>,
/// When this consent expires

pub expires_at: chrono::DateTime<chrono::Utc>,
/// Ed25519 signature by the human over canonical record bytes

pub signature: Vec<u8>,
/// Whether this consent can be revoked (always true)

#[serde(default = "default_revocable")]
pub revocable: bool,
/// Whether this consent has been revoked

#[serde(default)]
pub revoked: bool,
/// When this consent was revoked, if applicable

#[serde(default, skip_serializing_if = "Option::is_none")]
pub revoked_at: Option<chrono::DateTime<chrono::Utc>>
}

#[must_use]
pub fn is_valid(&self) -> bool;

#[must_use]
pub fn covers_variable(&self, variable: &str) -> bool;

#[must_use]
pub fn covers_domain(&self, domain: &str) -> bool;

pub fn revoke(&mut self);

pub fn signing_bytes(&self) -> ArsenalResult<Vec<u8>>;

#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum ConsentPolicy {
    /// Consent required for each individual variable
    #[default]
    PerVariable,
    /// Consent required per provider/service
    PerProvider,
    /// Consent required per agent (blanket consent)
    PerAgent,
}

#[must_use]
pub const fn as_str(&self) -> &'static str;

#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum ConsentStatus {
    /// Consent was pre-approved (e.g., by policy)
    PreApproved,
    /// Consent has been explicitly approved by a human
    Approved,
    /// Consent is pending human review
    Pending,
    /// Consent was explicitly denied
    Denied,
    /// Consent was previously granted but has been revoked
    Revoked,
    /// Consent is not required for this operation
    NotRequired,
}

#[must_use]
pub const fn allows_operation(&self) -> bool;

#[must_use]
pub const fn as_str(&self) -> &'static str;

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ConsentRequest {
/// Unique request ID

pub request_id: Uuid,
/// DID of the requesting agent

pub agent_did: String,
/// DID of the human who must approve

pub human_root_did: String,
/// Variables the agent wants to access

pub variables: Vec<String>,
/// Destination domains the agent wants to reach

pub destination_domains: Vec<String>,
/// Scopes being requested

pub scopes: Vec<String>,
/// When this request was created

pub created_at: chrono::DateTime<chrono::Utc>,
/// When this request expires if not acted upon

pub expires_at: chrono::DateTime<chrono::Utc>
}

pub fn new(
        agent_did: impl Into<String>,
        human_root_did: impl Into<String>,
        variables: Vec<String>,
        destination_domains: Vec<String>,
        scopes: Vec<String>,
    ) -> ArsenalResult<Self>;

#[must_use]
pub fn is_expired(&self) -> bool;