httpx

type Config struct {
	Bind           string
	TLSCert        string
	TLSKey         string
	MTLSCA         string
	ReadHeader     time.Duration
	ReadTimeout    time.Duration
	WriteTimeout   time.Duration
	IdleTimeout    time.Duration
	MaxHeaderBytes int
	MaxBodyBytes   int64
	CORSEnabled    bool
	CORSOrigins    []string
	// CORSAllowAnyOrigin is the explicit any-origin opt-in (T-05). By
	// default a literal "*" entry in CORSOrigins is NOT treated as
	// match-all: ValidateConfig rejects it (ErrCORSWildcardWithCredentials)
	// and the headers() matcher ignores it. Setting this flag to true
	// permits "*" and makes the CORS matcher reflect any request Origin
	// into Access-Control-Allow-Origin. Default false (fail-closed). Use
	// only for surfaces that intentionally serve any origin and carry no
	// credentials; it is forbidden by the CORS spec to combine "*" with
	// credentialed requests, so enable this knowingly.
	CORSAllowAnyOrigin bool
	// EnableCompression turns on transparent gzip of text-ish JSON
	// responses (>=1 KiB; client must send Accept-Encoding: gzip).
	EnableCompression bool
	// CompressionExcludePaths lists request paths whose responses must
	// never be gzipped, even when EnableCompression is true. Use for
	// BREACH-sensitive routes (OAuth token endpoints, login, anything
	// emitting bearer tokens or session cookies). Matching is exact with
	// a trailing-slash tolerance (no regex, no wildcards). Empty/nil
	// preserves today's behaviour (compress every eligible response).
	CompressionExcludePaths []string
	// PerIPRPS / PerIPBurst configure a coarse global token bucket
	// partitioned by client IP, applied to every route as an abuse
	// ceiling underneath any tighter per-route limiters. Zero disables.
	PerIPRPS   float64
	PerIPBurst float64
	// PerIPSource selects the key extractor for the per-IP limiter.
	PerIPSource IPSource
	// TrustedProxyCIDRs lists the reverse-proxy networks whose
	// X-Forwarded-For / X-Real-IP headers the global per-IP limiter will
	// honor when PerIPSource is a proxy-header source. Empty (the default)
	// trusts no proxy, so forged forwarded headers are ignored and the
	// limiter keys on RemoteAddr -- forged XFF cannot dodge per-IP limits.
	// Set this only when the server sits behind a reverse proxy that
	// overwrites (not appends to) the header. Additive/default-safe. T-06.
	TrustedProxyCIDRs []string
	// PathRateLimits install stricter per-IP buckets for matching path
	// prefixes (F3), applied as the outermost layer (before the global per-IP
	// limiter) so e.g. /v1/auth/* gets a tighter credential-stuffing ceiling.
	PathRateLimits []PathLimit

	// Security response headers (SEC-0023). The hardened set —
	// Content-Security-Policy, Cross-Origin-Opener/Embedder/Resource-Policy,
	// and Permissions-Policy — is emitted by default with deny-by-default
	// values suitable for a JSON API. For each field: an empty string emits
	// the secure default; a non-empty string overrides it; the literal "-"
	// suppresses that single header. DisableSecurityHeaders drops the whole
	// hardened set at once (the legacy HSTS/X-Content-Type-Options/
	// X-Frame-Options/Referrer-Policy headers are always emitted regardless).
	ContentSecurityPolicy     string
	CrossOriginOpenerPolicy   string
	CrossOriginEmbedderPolicy string
	CrossOriginResourcePolicy string
	PermissionsPolicy         string
	DisableSecurityHeaders    bool
}

type IPSource int

type Mux struct{ *http.ServeMux }

type PathLimit struct {
	Prefix string
	RPS    float64
	Burst  int
	Source IPSource
	// TrustedProxyCIDRs lists the reverse-proxy networks whose forwarded
	// headers this path's limiter will honor when Source is a proxy-header
	// source. Empty (the default) trusts no proxy, so forged X-Forwarded-For
	// / X-Real-IP values are ignored and keying falls back to RemoteAddr.
	// Additive/optional so existing construction stays default-safe. T-06.
	TrustedProxyCIDRs []string
}

type PathPeerLimiter struct {
	// contains filtered or unexported fields
}

type PeerLimiter struct {
	// contains filtered or unexported fields
}