mw

type AuthHandler interface {
	ValidateBearer(r *http.Request) (string, error)
}

type Authenticator struct {
	Mode       string // "hmac" | "jwks"
	HMACSecret []byte
	JWKS       *JWKSValidator
}

type BreakerConfig struct {
	Enabled             bool
	FailureThreshold    int           // consecutive failures to open
	OpenDuration        time.Duration // how long to stay open
	HalfOpenMaxInFlight int           // how many trial requests in half-open
}

type BreakerState string

type BreakerStats struct {
	State         BreakerState `json:"state"`
	Failures      int          `json:"failures"`
	OpensAt       time.Time    `json:"opens_at"`
	RetryAfterSec int          `json:"retry_after_seconds"`
	HalfInFlight  int          `json:"half_open_in_flight"`
}

type CircuitBreaker struct {
	// contains filtered or unexported fields
}

type IPResolver struct {
	Trusted *netx.CIDRSet
}

type JWKSStats struct {
	URL       string    `json:"url"`
	KeyCount  int       `json:"key_count"`
	FetchedAt time.Time `json:"fetched_at"`
}

type JWKSValidator struct {
	// contains filtered or unexported fields
}

type JWKSValidatorOptions struct {
	HTTPTimeout time.Duration
	CacheTTL    time.Duration
	Leeway      time.Duration

	// If provided, token must match one of these issuers.
	Issuers []string
	// If provided, token must match one of these audiences.
	Audiences []string

	// Allowed JWT algs (default ["RS256"])
	ValidAlgs []string
}

type Metrics struct {
	Requests *prometheus.CounterVec
	Latency  *prometheus.HistogramVec
}

type RateLimitConfig struct {
	Enabled   bool
	RPS       float64
	Burst     float64
	Scope     string // "user" | "ip"
	RouteName string
}

type Semaphore struct {
	// contains filtered or unexported fields
}