type Query {
  # Returns REQUIRE_SETUP if config is missing.
  systemStatus: SystemStatus!

  # Fetch current configuration (admin only).
  config: AppConfig!

  # List directories on the server for UI pickers.
  serverDirectories(path: String): [ServerDirectory!]!

  # Fetch a document by its slug path.
  document(slug: String!): Document

  # List documents under an optional path prefix.
  documents(prefix: String): [DocumentMeta!]!

  # List all relative folder paths in the repository.
  folders: [String!]!

  # Commit history for a document.
  history(slug: String!): [CommitEntry!]!

  # Unified diff between two commits for a document.
  diff(slug: String!, fromHash: String!, toHash: String!): String!

  # Raw content of a document at a specific commit.
  documentAtCommit(slug: String!, hash: String!): String!

  # Whether the current storage path has uncommitted files.
  repoStatus: RepoStatus!

  # List images next to a document.
  images(slug: String!): [ImageFile!]!

  # Browse LDAP tree (admin only)
  ldapBrowse(url: String, baseDN: String, adminUser: String, adminPass: String): LDAPTree!

  # Fetch permissions for a path
  acl(path: String!): [ACLEntry!]!

  # Returns all users and groups that can be assigned to ACL entries (admin only).
  aclSubjects: ACLSubjects!

  # Returns "local", "ldap", or "guest" for a given username.
  userAuthType(username: String!): String!
}

type Mutation {
  # First-run setup.
  setup(input: SetupInput!): Boolean!

  # Test an LDAP configuration.
  testLdapConnection(url: String!, adminUser: String, adminPass: String): LDAPTestResult!

  # Authenticate and receive a bearer token.
  login(username: String!, password: String!, ldapPassword: String): String!

  # Invalidate the current session.
  logout: Boolean!

  # Save (create or update) a document.
  saveDocument(input: SaveDocumentInput!): Document!

  # Delete a document.
  deleteDocument(slug: String!): Boolean!

  # Modify LDAP Configuration (admin only).
  updateLdapConfig(input: LDAPInput): Boolean!

  # Sync users/groups from LDAP
  importLdapSubject(type: String!, name: String!): Boolean!

  # ACL Mutations
  setAcl(input: ACLInput!): Boolean!
  removeAcl(id: Int!): Boolean!

  # Modify Storage Path (admin only).
  updateStoragePath(path: String!): Boolean!

  # Change the current user's password.
  changePassword(old: String!, new: String!): Boolean!

  # Commit all uncommitted files in the storage path.
  initCommit(message: String!): Boolean!

  # Delete an image file.
  deleteImage(slug: String!, filename: String!): Boolean!

  # Create a new folder (directory) at the specified path.
  createFolder(path: String!): Boolean!

  # Move a document from one location to another.
  moveDocument(oldSlug: String!, newSlug: String!): Boolean!
}

# ── Types ──────────────────────────────────────────────────────────────────────

enum SystemStatus {
  OK
  REQUIRE_SETUP
}

type AppConfig {
  storagePath: String!
  ldap:        LDAPConfig
}

type LDAPConfig {
  url:       String!
  baseDN:    String!
  adminUser: String!
}

type LDAPTree {
  users:  [String!]!
  groups: [String!]!
}

type ACLEntry {
  id:         Int!
  path:       String!
  subjectType: String!
  subjectId:  Int!
  canSearch:  Boolean!
  canView:    Boolean!
  canRead:    Boolean!
  canEdit:    Boolean!
  canCreate:  Boolean!
  canDelete:  Boolean!
  canMove:    Boolean!
}

type ServerDirectory {
  name:      String!
  path:      String!
  isGitRepo: Boolean!
  hasDocuments: Boolean!
}

type Document {
  slug:    String!
  content: String!
  meta:    DocumentMeta!
}

type DocumentMeta {
  slug:      String!
  title:     String!
  updatedAt: String!
}

type LDAPTestResult {
  success: Boolean!
  message: String!
}

type CommitEntry {
  hash:    String!
  author:  String!
  email:   String!
  date:    String!
  subject: String!
  added:   Int!
  removed: Int!
}

type RepoStatus {
  hasUncommitted: Boolean!
}

type ImageFile {
  name: String!
  url:  String!
  size: Int!
}

# ── Inputs ─────────────────────────────────────────────────────────────────────

input SetupInput {
  storagePath: String!
  adminUser:   String!
  adminPass:   String!
  ldap:        LDAPInput
  jwtSecret:   String!
}

input LDAPInput {
  url:       String!
  baseDN:    String
  adminUser: String!
  adminPass: String
}

type ACLSubject {
  id:     Int!
  name:   String!
  isLdap: Boolean!
}

type ACLSubjects {
  users:  [ACLSubject!]!
  groups: [ACLSubject!]!
}

input ACLInput {
  path:       String!
  subjectType: String!
  subjectId:  Int!
  canSearch:  Boolean!
  canView:    Boolean!
  canRead:    Boolean!
  canEdit:    Boolean!
  canCreate:  Boolean!
  canDelete:  Boolean!
  canMove:    Boolean!
}

input SaveDocumentInput {
  slug:          String!
  content:       String!
  commitMessage: String!
}