#ifndef _AUTHZ_H
#define _AUTHZ_H

/* authorization framework API definitions */

#ifdef __cplusplus
extern "C" {
#endif

#if !defined(_AUTHZ_)
#define AUTHZAPI DECLSPEC_IMPORT
#else
#define AUTHZAPI
#endif

#include <windows.h>
#include <adtgen.h>

#define AUTHZ_SKIP_TOKEN_GROUPS  0x2

#define AUTHZ_GENERATE_SUCCESS_AUDIT  0x1
#define AUTHZ_GENERATE_FAILURE_AUDIT  0x2

#define AUTHZ_ACCESS_CHECK_NO_DEEP_COPY_SD  0x00000001

#define AUTHZ_RM_FLAG_NO_AUDIT  0x1

#define AUTHZ_VALID_RM_INIT_FLAGS  (AUTHZ_RM_FLAG_NO_AUDIT)

#define AUTHZ_NO_SUCCESS_AUDIT  0x00000001
#define AUTHZ_NO_FAILURE_AUDIT  0x00000002
#define AUTHZ_NO_ALLOC_STRINGS  0x00000004

#define AUTHZ_VALID_OBJECT_ACCESS_AUDIT_FLAGS  (AUTHZ_NO_SUCCESS_AUDIT|AUTHZ_NO_FAILURE_AUDIT|AUTHZ_NO_ALLOC_STRINGS)

DECLARE_HANDLE(AUTHZ_ACCESS_CHECK_RESULTS_HANDLE);
DECLARE_HANDLE(AUTHZ_CLIENT_CONTEXT_HANDLE);
DECLARE_HANDLE(AUTHZ_RESOURCE_MANAGER_HANDLE);
DECLARE_HANDLE(AUTHZ_AUDIT_EVENT_HANDLE);
DECLARE_HANDLE(AUTHZ_AUDIT_EVENT_TYPE_HANDLE);

typedef AUTHZ_ACCESS_CHECK_RESULTS_HANDLE *PAUTHZ_ACCESS_CHECK_RESULTS_HANDLE;
typedef AUTHZ_CLIENT_CONTEXT_HANDLE *PAUTHZ_CLIENT_CONTEXT_HANDLE;
typedef AUTHZ_RESOURCE_MANAGER_HANDLE *PAUTHZ_RESOURCE_MANAGER_HANDLE;
typedef AUTHZ_AUDIT_EVENT_HANDLE *PAUTHZ_AUDIT_EVENT_HANDLE;
typedef AUTHZ_AUDIT_EVENT_TYPE_HANDLE *PAUTHZ_AUDIT_EVENT_TYPE_HANDLE;

typedef struct _AUTHZ_ACCESS_REQUEST {
    ACCESS_MASK DesiredAccess;
    PSID PrincipalSelfSid;
    POBJECT_TYPE_LIST ObjectTypeList;
    DWORD ObjectTypeListLength;
    PVOID OptionalArguments;
} AUTHZ_ACCESS_REQUEST, *PAUTHZ_ACCESS_REQUEST;

typedef struct _AUTHZ_ACCESS_REPLY {
    DWORD ResultListLength;
    PACCESS_MASK GrantedAccessMask;
    PDWORD SaclEvaluationResults;
    PDWORD Error;
} AUTHZ_ACCESS_REPLY, *PAUTHZ_ACCESS_REPLY;

typedef BOOL(CALLBACK *PFN_AUTHZ_DYNAMIC_ACCESS_CHECK)(AUTHZ_CLIENT_CONTEXT_HANDLE,PACE_HEADER,PVOID,PBOOL);
typedef BOOL(CALLBACK *PFN_AUTHZ_COMPUTE_DYNAMIC_GROUPS)(AUTHZ_CLIENT_CONTEXT_HANDLE,PVOID,PSID_AND_ATTRIBUTES*,PDWORD,PSID_AND_ATTRIBUTES*,PDWORD);
typedef VOID(CALLBACK *PFN_AUTHZ_FREE_DYNAMIC_GROUPS)(PSID_AND_ATTRIBUTES);

typedef enum _AUTHZ_CONTEXT_INFORMATION_CLASS {
    AuthzContextInfoUserSid = 1,
    AuthzContextInfoGroupsSids,
    AuthzContextInfoRestrictedSids,
    AuthzContextInfoPrivileges,
    AuthzContextInfoExpirationTime,
    AuthzContextInfoServerContext,
    AuthzContextInfoIdentifier,
    AuthzContextInfoSource,
    AuthzContextInfoAll
} AUTHZ_CONTEXT_INFORMATION_CLASS;

typedef enum _AUTHZ_AUDIT_EVENT_INFORMATION_CLASS {
    AuthzAuditEventInfoFlags = 1,
    AuthzAuditEventInfoOperationType,
    AuthzAuditEventInfoObjectType,
    AuthzAuditEventInfoObjectName,
    AuthzAuditEventInfoAdditionalInfo,
} AUTHZ_AUDIT_EVENT_INFORMATION_CLASS;

AUTHZAPI BOOL WINAPI AuthzAccessCheck(DWORD,AUTHZ_CLIENT_CONTEXT_HANDLE,PAUTHZ_ACCESS_REQUEST,AUTHZ_AUDIT_EVENT_HANDLE,PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR*,DWORD,PAUTHZ_ACCESS_REPLY,PAUTHZ_ACCESS_CHECK_RESULTS_HANDLE);
AUTHZAPI BOOL WINAPI AuthzCachedAccessCheck(DWORD,AUTHZ_ACCESS_CHECK_RESULTS_HANDLE,PAUTHZ_ACCESS_REQUEST,AUTHZ_AUDIT_EVENT_HANDLE,PAUTHZ_ACCESS_REPLY);
AUTHZAPI BOOL WINAPI AuthzOpenObjectAudit(DWORD,AUTHZ_CLIENT_CONTEXT_HANDLE,PAUTHZ_ACCESS_REQUEST,AUTHZ_AUDIT_EVENT_HANDLE,PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR*,DWORD,PAUTHZ_ACCESS_REPLY);
AUTHZAPI BOOL WINAPI AuthzFreeHandle(AUTHZ_ACCESS_CHECK_RESULTS_HANDLE);
AUTHZAPI BOOL WINAPI AuthzInitializeResourceManager(DWORD,PFN_AUTHZ_DYNAMIC_ACCESS_CHECK,PFN_AUTHZ_COMPUTE_DYNAMIC_GROUPS,PFN_AUTHZ_FREE_DYNAMIC_GROUPS,PCWSTR,PAUTHZ_RESOURCE_MANAGER_HANDLE);
AUTHZAPI BOOL WINAPI AuthzFreeResourceManager(AUTHZ_RESOURCE_MANAGER_HANDLE);
AUTHZAPI BOOL WINAPI AuthzInitializeContextFromToken(DWORD,HANDLE,AUTHZ_RESOURCE_MANAGER_HANDLE,PLARGE_INTEGER,LUID,PVOID,PAUTHZ_CLIENT_CONTEXT_HANDLE);
AUTHZAPI BOOL WINAPI AuthzInitializeContextFromSid(DWORD,PSID,AUTHZ_RESOURCE_MANAGER_HANDLE,PLARGE_INTEGER,LUID,PVOID,PAUTHZ_CLIENT_CONTEXT_HANDLE);
AUTHZAPI BOOL WINAPI AuthzInitializeContextFromAuthzContext(DWORD,AUTHZ_CLIENT_CONTEXT_HANDLE,PLARGE_INTEGER,LUID,PVOID,PAUTHZ_CLIENT_CONTEXT_HANDLE);
AUTHZAPI BOOL WINAPI AuthzAddSidsToContext(AUTHZ_CLIENT_CONTEXT_HANDLE,PSID_AND_ATTRIBUTES,DWORD,PSID_AND_ATTRIBUTES,DWORD,PAUTHZ_CLIENT_CONTEXT_HANDLE);
AUTHZAPI BOOL WINAPI AuthzGetInformationFromContext(AUTHZ_CLIENT_CONTEXT_HANDLE,AUTHZ_CONTEXT_INFORMATION_CLASS,DWORD,PDWORD,PVOID);
AUTHZAPI BOOL WINAPI AuthzFreeContext(AUTHZ_CLIENT_CONTEXT_HANDLE);
AUTHZAPI BOOL WINAPIV AuthzInitializeObjectAccessAuditEvent(DWORD,AUTHZ_AUDIT_EVENT_TYPE_HANDLE,PWSTR,PWSTR,PWSTR,PWSTR,PAUTHZ_AUDIT_EVENT_HANDLE,DWORD,...);
AUTHZAPI BOOL WINAPI AuthzGetInformationFromAuditEvent(AUTHZ_AUDIT_EVENT_HANDLE,AUTHZ_AUDIT_EVENT_INFORMATION_CLASS,DWORD,PDWORD,PVOID);
AUTHZAPI BOOL WINAPI AuthzFreeAuditEvent(AUTHZ_AUDIT_EVENT_HANDLE);

#ifdef __cplusplus
}
#endif

#endif /* _AUTHZ_H */
