config

type Config struct {
	Address               string        // PORT, "8080" or ":8080"
	Environment           string        // APP_ENV, defaults to development
	DatabaseURL           string        // DATABASE_URL
	JWTSecret             []byte        // JWT_SECRET, length is enforced by auth.New
	SessionSecret         []byte        // SESSION_SECRET, length is enforced by session.Middleware
	OAuth                 OAuthConfig   // OAUTH_* provider credentials and browser redirects
	TrustedProxyCIDRs     []string      // TRUSTED_PROXY_CIDRS, comma separated
	CORSAllowedOrigins    []string      // CORS_ALLOWED_ORIGINS, comma separated
	RateLimitEnabled      bool          // RATE_LIMIT_ENABLED, defaults to true
	RateLimitPerMinute    int           // RATE_LIMIT_PER_MINUTE, defaults to 60
	RateLimitBurst        int           // RATE_LIMIT_BURST, 0 lets the runtime derive it
	MaxBodyBytes          int64         // MAX_BODY_BYTES, defaults to 1 MiB
	CacheDriver           string        // CACHE_DRIVER, "memory" (default) or "redis"
	QueueDriver           string        // QUEUE_DRIVER, "sync" (default) or "redis"
	QueueConcurrency      int           // QUEUE_CONCURRENCY, defaults to 10
	RedisURL              string        // REDIS_URL, e.g. redis://localhost:6379/0
	MetricsEnabled        bool          // METRICS_ENABLED, defaults to false
	PProfEnabled          bool          // PPROF_ENABLED, defaults to false; never expose publicly
	DocsEnabled           bool          // DOCS_ENABLED, defaults to true only in development
	DocsPath              string        // DOCS_PATH, defaults to /docs
	DocsSpecPath          string        // DOCS_SPEC_PATH, defaults to /openapi.json
	DocsTitle             string        // DOCS_TITLE, empty lets the application inject its name
	DocsVersion           string        // DOCS_VERSION, defaults to 0.1.0
	DocsDescription       string        // DOCS_DESCRIPTION
	DocsServers           []string      // DOCS_SERVERS, comma separated
	DocsBasicAuthUser     string        // DOCS_BASIC_AUTH_USERNAME
	DocsBasicAuthPass     string        // DOCS_BASIC_AUTH_PASSWORD
	DevToolsEnabled       bool          // DEVTOOLS_ENABLED, defaults to true only in development; refused elsewhere
	DevToolsPath          string        // DEVTOOLS_PATH, defaults to /_ginkit
	MailDriver            string        // MAIL_DRIVER, "log" (default) or "smtp"
	MailHost              string        // MAIL_HOST
	MailPort              int           // MAIL_PORT, defaults per encryption
	MailUsername          string        // MAIL_USERNAME
	MailPassword          string        // MAIL_PASSWORD
	MailEncryption        string        // MAIL_ENCRYPTION, none|tls|starttls (default starttls)
	MailFromAddress       string        // MAIL_FROM_ADDRESS
	MailFromName          string        // MAIL_FROM_NAME
	WhatsAppDriver        string        // WHATSAPP_DRIVER, "log" (default) or "cloud"
	WhatsAppAccessToken   string        // WHATSAPP_ACCESS_TOKEN
	WhatsAppPhoneNumberID string        // WHATSAPP_PHONE_NUMBER_ID
	WhatsAppAPIVersion    string        // WHATSAPP_API_VERSION, for example v25.0
	WhatsAppTimeout       time.Duration // WHATSAPP_TIMEOUT, defaults to 15s
	StorageDriver         string        // STORAGE_DRIVER, "local" (default) or "s3"
	StorageLocalRoot      string        // STORAGE_LOCAL_ROOT, defaults to ./storage
	StorageLocalURL       string        // STORAGE_LOCAL_BASE_URL
	S3Endpoint            string        // S3_ENDPOINT, host[:port] without scheme
	S3Region              string        // S3_REGION
	S3Bucket              string        // S3_BUCKET
	S3AccessKey           string        // S3_ACCESS_KEY
	S3SecretKey           string        // S3_SECRET_KEY
	S3UseSSL              bool          // S3_USE_SSL, defaults to true
	S3UsePathStyle        bool          // S3_USE_PATH_STYLE, defaults to false (MinIO needs true)
	S3PresignTTL          time.Duration // S3_PRESIGN_TTL, defaults to 15m
	S3PublicBaseURL       string        // S3_PUBLIC_BASE_URL
	ReadTimeout           time.Duration // READ_TIMEOUT, Go duration syntax such as 10s
	WriteTimeout          time.Duration // WRITE_TIMEOUT
	IdleTimeout           time.Duration // IDLE_TIMEOUT
	ShutdownTimeout       time.Duration // SHUTDOWN_TIMEOUT
}

type OAuthConfig struct {
	// Google contains Google OIDC credentials and callback configuration.
	Google OAuthProviderConfig
	// GitHub contains GitHub OAuth credentials and callback configuration.
	GitHub OAuthProviderConfig
	// SuccessRedirect is the relative browser path used after a successful flow.
	SuccessRedirect string
	// FailureRedirect is the relative browser path used after a failed flow.
	FailureRedirect string
}

type OAuthProviderConfig struct {
	// ClientID is the provider-issued OAuth client identifier.
	ClientID string
	// ClientSecret is the provider-issued credential and must remain secret.
	ClientSecret string
	// RedirectURL is the exact callback URL registered with the provider.
	RedirectURL string
}