server

type AuthConfig struct {
	Mode string // "password", "oidc", "proxy" or "none"

	// Fixed credentials from the environment; when empty, the ones created
	// in the UI (stored in Credentials) are used.
	Username     string
	PasswordHash string // argon2id PHC string
	Credentials  credentials

	ProxyHeader string // proxy mode: header carrying the user (Remote-User)

	OIDCIssuer       string
	OIDCClientID     string
	OIDCClientSecret string
	OIDCAllowedSubs  []string
	OIDCAllowedMails []string
	// PublicURL is where users reach Fundarr (for the OIDC redirect).
	PublicURL string
	// OIDCAutoRedirect sends signed-out visitors straight to the provider:
	// with a session there, they come back signed in without a click.
	OIDCAutoRedirect bool

	SessionKey []byte
	SessionTTL time.Duration
}

type Config struct {
	Engine  *engine.Engine
	Auth    AuthConfig
	Static  fs.FS // the built UI; nil in tests
	Version string
	Log     *slog.Logger
	// Background is the context syncs started from the UI run in.
	Background context.Context
	// Demo: the data is made up (FUNDARR_DEMO); nothing reaches a platform.
	Demo bool
}

type Server struct {
	// contains filtered or unexported fields
}