"""Abstract storage backend contract.

All storage backends must be thread-safe for concurrent access.
"""

from abc import ABC, abstractmethod

from pyauthz.models.policy import Policy
from pyauthz.models.role import Role


class StorageBackend(ABC):
    """Abstract base class for policy and role storage.

    Implementations must be safe for concurrent reads and writes from
    multiple threads (WSGI workers) and async tasks.
    """

    @abstractmethod
    def get_policies(self) -> list[Policy]:
        """Return all stored policies."""

    @abstractmethod
    def add_policy(self, policy: Policy) -> None:
        """Add a policy. Raises ConfigError if a policy with the same name exists."""

    @abstractmethod
    def remove_policy(self, name: str) -> None:
        """Remove a policy by name. Raises ConfigError if not found."""

    @abstractmethod
    def replace_policies(self, policies: list[Policy]) -> None:
        """Atomically replace all policies."""

    @abstractmethod
    def get_roles(self) -> dict[str, Role]:
        """Return all stored roles as a name -> Role mapping."""

    @abstractmethod
    def add_role(self, role: Role) -> None:
        """Add a role. Raises ConfigError if a role with the same name exists."""

    @abstractmethod
    def remove_role(self, name: str) -> None:
        """Remove a role by name. Raises ConfigError if not found."""

    @abstractmethod
    def replace_roles(self, roles: list[Role]) -> None:
        """Atomically replace all roles."""
