config

type Config struct {
	Port         string
	AppEnv       string
	DatabaseURL  string
	DevStubAuth  bool
	DevSeed      bool
	AvvikEnabled bool

	// NaisAuth enables the NAIS/Wonderwall bearer-token auth mode.
	// When true, the app verifies the Authorization: Bearer header injected by
	// the Wonderwall login-proxy sidecar instead of running its own OAuth flow.
	// Set via NAIS_AUTH=true.
	NaisAuth bool
	// NaisIssuer is the Entra ID token issuer. Set via AZURE_OPENID_CONFIG_ISSUER.
	NaisIssuer string
	// NaisClientID is the Entra ID application client ID. Set via AZURE_APP_CLIENT_ID.
	NaisClientID string
	// NaisJWKSURI is the JWKS endpoint for token signature verification.
	// Set via AZURE_OPENID_CONFIG_JWKS_URI.
	NaisJWKSURI string
	// AdminGroups is the list of Entra ID group object IDs whose members are
	// granted the admin role at request time. Set via ADMIN_GROUPS (comma-separated).
	AdminGroups []string

	// AuthProviders is the list of enabled auth providers (e.g. ["github", "entra"]).
	// Set via AUTH_PROVIDERS (comma-separated) or the legacy AUTH_PROVIDER variable.
	AuthProviders []string
	// AllowedEmailDomains is the optional OAuth self-registration allowlist.
	// Set via AUTH_ALLOWED_EMAIL_DOMAINS (comma-separated domains).
	AllowedEmailDomains []string

	GitHubClientID     string
	GitHubClientSecret string

	OIDCIssuerURL    string
	OIDCClientID     string
	OIDCClientSecret string

	EntraTenantID     string
	EntraClientID     string
	EntraClientSecret string

	SessionCookieName   string
	SessionCookieSecure bool
	SessionIdleTimeout  time.Duration
	AppBaseURL          string

	// MetricsPath is the HTTP path for the Prometheus metrics endpoint.
	// Set to "" to disable.
	MetricsPath string

	// SessionHMACKey is the secret used to HMAC-SHA256 session tokens before
	// including them in security event logs. Set via SESSION_HMAC_KEY.
	// Leave empty to omit session token hashes from log lines (not recommended
	// in production).
	SessionHMACKey string

	// TrustedProxyCIDRs is a comma-separated list of CIDR ranges whose
	// X-Forwarded-For header is trusted for source IP extraction.
	// Example: "10.0.0.0/8,172.16.0.0/12". Empty = trust no proxy (use RemoteAddr).
	TrustedProxyCIDRs string

	// GlobalRateLimitPerWindow is the global in-memory per-key request limit for
	// non-exempt routes during GlobalRateLimitWindow. Set to 0 to disable.
	GlobalRateLimitPerWindow int
	GlobalRateLimitWindow    time.Duration
}