config

type Config struct {
	Port         string
	AppEnv       string
	DatabaseURL  string
	DevStubAuth  bool
	DevSeed      bool
	AvvikEnabled bool

	// AuthProviders is the list of enabled auth providers (e.g. ["github", "entra"]).
	// Set via AUTH_PROVIDERS (comma-separated) or the legacy AUTH_PROVIDER variable.
	AuthProviders []string
	// AllowedEmailDomains is the optional OAuth self-registration allowlist.
	// Set via AUTH_ALLOWED_EMAIL_DOMAINS (comma-separated domains).
	AllowedEmailDomains []string

	GitHubClientID     string
	GitHubClientSecret string

	OIDCIssuerURL    string
	OIDCClientID     string
	OIDCClientSecret string

	EntraTenantID     string
	EntraClientID     string
	EntraClientSecret string

	SessionCookieName   string
	SessionCookieSecure bool
	SessionIdleTimeout  time.Duration
	AppBaseURL          string

	// MetricsPath is the HTTP path for the Prometheus metrics endpoint.
	// Set to "" to disable.
	MetricsPath string

	// SessionHMACKey is the secret used to HMAC-SHA256 session tokens before
	// including them in security event logs. Set via SESSION_HMAC_KEY.
	// Leave empty to omit session token hashes from log lines (not recommended
	// in production).
	SessionHMACKey string

	// TrustedProxyCIDRs is a comma-separated list of CIDR ranges whose
	// X-Forwarded-For header is trusted for source IP extraction.
	// Example: "10.0.0.0/8,172.16.0.0/12". Empty = trust no proxy (use RemoteAddr).
	TrustedProxyCIDRs string

	// GlobalRateLimitPerWindow is the global in-memory per-key request limit for
	// non-exempt routes during GlobalRateLimitWindow. Set to 0 to disable.
	GlobalRateLimitPerWindow int
	GlobalRateLimitWindow    time.Duration
}