From 4d40c1a8b97b0ee2d973c094696215c8e54f59f3 Mon Sep 17 00:00:00 2001
From: michael <operations@dangerousthings.com>
Date: Sun, 26 Apr 2026 20:46:28 -0700
Subject: [PATCH] feat: add Policy, StackPolicy, Storage, Firstrun types

---
 common/src/types.rs | 65 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/common/src/types.rs b/common/src/types.rs
index a57cc3a..8c30a81 100644
--- a/common/src/types.rs
+++ b/common/src/types.rs
@@ -1,4 +1,5 @@
 use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
 
 #[derive(
     Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, zvariant::Type,
@@ -42,6 +43,49 @@ pub struct Credential {
     pub created_unix: u64,
 }
 
+#[derive(
+    Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, zvariant::Type, Default,
+)]
+#[serde(rename_all = "kebab-case")]
+#[zvariant(signature = "s")]
+pub enum StorageBackend {
+    #[default]
+    PerUser,
+    Central,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, zvariant::Type)]
+pub struct StackPolicy {
+    pub mode: Mode,
+    pub methods: Vec<Method>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, zvariant::Type, Default)]
+pub struct Storage {
+    #[serde(default)]
+    pub backend: StorageBackend,
+    #[serde(default)]
+    pub central_path: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, zvariant::Type, Default)]
+pub struct Firstrun {
+    #[serde(default)]
+    pub default_required_methods: Vec<Method>,
+    #[serde(default)]
+    pub deadline_hours: u32,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, zvariant::Type, Default)]
+pub struct Policy {
+    #[serde(default)]
+    pub stacks: BTreeMap<String, StackPolicy>,
+    #[serde(default)]
+    pub storage: Storage,
+    #[serde(default)]
+    pub firstrun: Firstrun,
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -60,6 +104,27 @@ mod tests {
         assert_eq!(s, "\"fido2\"");
     }
 
+    #[test]
+    fn policy_default_is_all_disabled() {
+        let p = Policy::default();
+        assert!(p.stacks.is_empty());
+        assert_eq!(p.storage.backend, StorageBackend::PerUser);
+        assert!(p.firstrun.default_required_methods.is_empty());
+        assert_eq!(p.firstrun.deadline_hours, 0);
+    }
+
+    #[test]
+    fn policy_serde_via_json() {
+        let mut p = Policy::default();
+        p.stacks.insert(
+            "sudo".to_string(),
+            StackPolicy { mode: Mode::Required, methods: vec![Method::Fido2] },
+        );
+        let json = serde_json::to_string(&p).unwrap();
+        let back: Policy = serde_json::from_str(&json).unwrap();
+        assert_eq!(p, back);
+    }
+
     #[test]
     fn credential_roundtrips_via_serde() {
         let c = Credential {