appconfig

type AuditSettings struct {
	// Enabled turns auditing on. Default false ⇒ no records written.
	Enabled bool `yaml:"enabled"`
	// Level is "alter_only" (default) or "all". alter_only skips read-only ops.
	Level string `yaml:"level"`
	// Path overrides the audit log location (default ~/.kafui/audit.log).
	Path string `yaml:"path"`
}

type AuthzSettings struct {
	// ActiveProfile, when set, forces this profile as the active one regardless
	// of cluster membership (an explicit override).
	ActiveProfile string `yaml:"activeProfile"`

	// Profiles are the named permission profiles.
	Profiles []Profile `yaml:"profiles"`

	// Default is the fallback profile (permissions only, all clusters) applied
	// when no named profile covers the active cluster.
	Default *Profile `yaml:"default"`
}

type AutoReloadSettings struct {
	Enabled  bool          `yaml:"enabled"`
	Interval time.Duration `yaml:"interval"`
}

type ClusterConfig struct {
	Name    string
	Brokers []string
}

type ClusterExtension struct {
	ReadOnly bool `yaml:"readOnly"`

	// --- Fully-kafui-defined cluster connection (AC-13). Empty ⇒ overlay only. ---
	Brokers                []string    `yaml:"brokers,omitempty"`
	KafkaVersion           string      `yaml:"kafkaVersion,omitempty"`
	SecurityProtocol       string      `yaml:"securityProtocol,omitempty"`
	SASL                   *SASLConfig `yaml:"sasl,omitempty"`
	TLS                    *TLSConfig  `yaml:"tls,omitempty"`
	SchemaRegistryURL      string      `yaml:"schemaRegistryUrl,omitempty"`
	SchemaRegistryUsername string      `yaml:"schemaRegistryUsername,omitempty"`
	SchemaRegistryPassword string      `yaml:"schemaRegistryPassword,omitempty"`

	// PollingThrottle bounds background collection rate for this cluster.
	PollingThrottle time.Duration `yaml:"pollingThrottle"`

	// Connect lists Kafka Connect clusters for this Kafka cluster.
	Connect []ConnectCluster `yaml:"connect"`

	// Ksql is the ksqlDB endpoint config (optional).
	Ksql *KsqlEndpoint `yaml:"ksql"`

	// Metrics holds metrics-store settings (optional).
	Metrics map[string]string `yaml:"metrics"`

	// Masking holds data-masking rules for message payloads.
	Masking []string `yaml:"masking"`

	// Serdes holds per-cluster serde bindings (topic-name pattern → key/value
	// serde overrides). Unbound built-in serdes remain selectable regardless.
	Serdes []serde.SerdeConfig `yaml:"serdes"`

	// Properties are free-form custom client properties (dot-flattened on load).
	Properties         map[string]any `yaml:"properties"`
	ConsumerProperties map[string]any `yaml:"consumerProperties"`
	ProducerProperties map[string]any `yaml:"producerProperties"`
}

type Config struct {
	// DynamicConfigEnabled gates in-UI cluster editing (the setup wizard).
	DynamicConfigEnabled bool `yaml:"dynamicConfigEnabled"`

	// UI preferences persisted across runs.
	UI UISettings `yaml:"ui"`

	// ReleaseCheck controls the optional latest-release check.
	ReleaseCheck ReleaseCheckSettings `yaml:"releaseCheck"`

	// AutoReload controls hot-reloading of this config file while kafui runs.
	AutoReload AutoReloadSettings `yaml:"autoReload"`

	// Redaction controls secret masking in displayed configuration.
	Redaction RedactionSettings `yaml:"redaction"`

	// RefreshInterval is the background statistics collection cadence.
	RefreshInterval time.Duration `yaml:"refreshInterval"`

	// Clusters holds per-cluster extension entries keyed by cluster name.
	Clusters map[string]ClusterExtension `yaml:"clusters"`

	// Keybindings rebinds actions from the controls specification. Each entry
	// names a registry action and the keys that should trigger it; the first
	// key listed is the one shown in the hint bar and help overlay. Overrides
	// that conflict with another binding, shadow a reserved global, or use a
	// key terminals cannot report are reported and ignored.
	Keybindings []KeybindingOverride `yaml:"keybindings"`

	// Authz holds the local permission-profile configuration (AA-2). A missing
	// section (no profiles and no default) leaves authorization disabled: every
	// operation is allowed. Read-only mode is independent of this section.
	Authz AuthzSettings `yaml:"authz"`

	// Audit configures the local JSONL audit log (AA-6). Disabled by default.
	Audit AuditSettings `yaml:"audit"`
}

type ConnectCluster struct {
	Name                string `yaml:"name"`
	Address             string `yaml:"address"`
	Username            string `yaml:"username"`
	Password            string `yaml:"password"`
	TLSCAPath           string `yaml:"tlsCaPath"`
	TLSCertPath         string `yaml:"tlsCertPath"`
	TLSKeyPath          string `yaml:"tlsKeyPath"`
	ConsumerNamePattern string `yaml:"consumerNamePattern"`
}

type KeybindingOverride struct {
	// Action is the registry action id, e.g. "delete" or "actions-menu".
	Action string `yaml:"action"`
	// Keys are the keys that trigger it, most-advertised first.
	Keys []string `yaml:"keys"`
}

type KsqlEndpoint struct {
	URL              string `yaml:"url"`
	Username         string `yaml:"username"`
	Password         string `yaml:"password"`
	TLSCAPath        string `yaml:"tlsCaPath"`
	TLSCertPath      string `yaml:"tlsCertPath"`
	TLSKeyPath       string `yaml:"tlsKeyPath"`
	MaxResponseBytes int64  `yaml:"maxResponseBytes"`
}

type MetricsSettings struct {
	// Enabled reports whether metrics collection is switched on. It defaults to
	// true: offset-delta metrics cost little and are always useful.
	Enabled bool
	// PollInterval is the background collection cadence (0 ⇒ collector default).
	PollInterval time.Duration
	// Endpoint is an optional Prometheus/JMX-exporter metrics URL. Empty means
	// offset-delta-only collection (byte rates reported as unknown).
	Endpoint string
	// Type selects the collection mechanism: "PROMETHEUS" (default) scrapes the
	// exposition endpoint; "JMX" is honored only through a Jolokia HTTP bridge
	// (JolokiaURL) and otherwise degrades to a warning and empty broker metrics
	// (MM-17). Stored upper-cased.
	Type string
	// JolokiaURL is the optional Jolokia HTTP-bridge base URL used when Type is
	// "JMX" (MM-17). Empty ⇒ JMX degrades gracefully.
	JolokiaURL string
	// Username/Password are optional basic-auth credentials for scraping and the
	// Jolokia bridge.
	Username string
	Password string
	// TimeSeriesURLs is the optional list of Prometheus-compatible query API base
	// URLs used for range/instant graphs (MM-14/MM-15). Empty ⇒ no graph backend.
	TimeSeriesURLs []string
	// TLSCAPath is an optional custom CA PEM path for the query/scrape HTTPS
	// clients.
	TLSCAPath string
	// ExpositionEnabled opts a cluster in to the flag-gated Prometheus exposition
	// endpoint (MM-16). Defaults to true so an unset value still exports.
	ExpositionEnabled bool
}

type Permission struct {
	Resource string   `yaml:"resource"`
	Name     string   `yaml:"name"`
	Actions  []string `yaml:"actions"`
}

type Profile struct {
	Name        string       `yaml:"name"`
	Clusters    []string     `yaml:"clusters"`
	Permissions []Permission `yaml:"permissions"`
}

type RedactionSettings struct {
	Enabled  bool     `yaml:"enabled"`
	Patterns []string `yaml:"patterns"` // when non-empty, replaces the default pattern list
}

type Redactor struct {
	// contains filtered or unexported fields
}

type ReleaseCheckSettings struct {
	Enabled  bool          `yaml:"enabled"`
	Interval time.Duration `yaml:"interval"`
	Timeout  time.Duration `yaml:"timeout"`
}

type SASLConfig struct {
	Mechanism    string `yaml:"mechanism"`
	Username     string `yaml:"username"`
	Password     string `yaml:"password"`
	ClientID     string `yaml:"clientID"`
	ClientSecret string `yaml:"clientSecret"`
	TokenURL     string `yaml:"tokenURL"`
	// DeviceAuthURL is the OAuth2 device-authorization endpoint. When set (with a
	// ClientID and TokenURL but no ClientSecret or static Token), kafui runs the
	// interactive device-code grant for OAUTHBEARER (AA-13).
	DeviceAuthURL string `yaml:"deviceAuthURL"`
}

type TLSConfig struct {
	CAPath   string `yaml:"caPath"`
	CertPath string `yaml:"certPath"`
	KeyPath  string `yaml:"keyPath"`
	Insecure bool   `yaml:"insecure"`
}

type UISettings struct {
	Theme       string `yaml:"theme"` // "auto", "dark", "light"
	ShowSidebar bool   `yaml:"showSidebar"`
	CompactMode bool   `yaml:"compactMode"`
	Timezone    string `yaml:"timezone"` // "local", "UTC", or an IANA name
}

type ValidationError struct {
	Field   string
	Cluster string
	Message string
}