export type ServiceGrantTargetType = "client" | "group" | "user";
export type ServiceAppRole = "viewer" | "member" | "admin" | "owner";
export type ServiceGrantStatus = "active" | "disabled";

export interface ServiceGrant {
  id: string;
  serviceId: string;
  targetType: ServiceGrantTargetType;
  targetId: string;
  appRole: ServiceAppRole;
  status: ServiceGrantStatus;
  createdAt: string;
  updatedAt: string;
}

export type ServiceAccessExceptionType = "deny" | "allow";

export interface ServiceAccessException {
  id: string;
  serviceId: string;
  userId: string;
  type: ServiceAccessExceptionType;
  reason?: string | null;
  createdAt: string;
  updatedAt: string;
}

export interface EffectiveAccessResult {
  serviceId: string;
  userId: string;
  allowed: boolean;
  visible: boolean;
  openEnabled: boolean;
  appRole?: ServiceAppRole;
  reason: string;
  source?: ServiceGrantTargetType | "exception";
  sourceId?: string;
}

export type ServiceModuleId = "codex_agents";

export interface ServiceModuleEntitlement {
  id: string;
  clientId: string;
  serviceId: string;
  userId: string;
  moduleId: ServiceModuleId;
  enabled: boolean;
  createdByUserId?: string | null;
  createdAt: string;
  updatedAt: string;
}
