config

const (
	// DirPerm is the permission mode for directories that hold sensitive
	// data (token store, cache, lock files). Owner-only rwx.
	DirPerm os.FileMode = 0o700

	// FilePerm is the permission mode for sensitive files (encrypted
	// tokens, cache entries, lock files). Owner-only rw.
	FilePerm os.FileMode = 0o600
)

const (
	// HTTPTimeout is the default timeout for outgoing HTTP requests
	// (market registry, MCP JSON-RPC, device flow).
	HTTPTimeout = 30 * time.Second

	// OAuthTimeout is the timeout for OAuth token exchange/refresh
	// requests, which are latency-sensitive and should fail fast.
	OAuthTimeout = 15 * time.Second

	// DiscoveryTimeout bounds the time spent on live registry + runtime
	// discovery before falling back to cache.
	DiscoveryTimeout = 10 * time.Second

	// LockTimeout is how long to wait when acquiring a cross-process
	// file lock for token operations.
	LockTimeout = 10 * time.Second
)

const (
	// ManualTokenExpiry is the default lifetime for manually imported tokens.
	ManualTokenExpiry = 24 * time.Hour

	// DeviceFlowTimeout is the maximum wait time for device-flow authorization.
	DeviceFlowTimeout = 16 * time.Minute

	// OAuthFlowTimeout is the maximum wait time for browser-based OAuth.
	OAuthFlowTimeout = 6 * time.Minute

	// DefaultAccessTokenExpiry is the default access token lifetime in seconds
	// when the server does not return an explicit expires_in value.
	DefaultAccessTokenExpiry = 7200

	// DefaultRefreshTokenLifetime is the default refresh token lifetime.
	DefaultRefreshTokenLifetime = 30 * 24 * time.Hour
)

const (
	// PluginManagedDir is a legacy subdirectory under ~/.dws/plugins/
	// retained so plugins installed by older CLI versions remain loadable.
	// New installs always go to PluginUserDir; there is no privilege
	// associated with this directory anymore.
	PluginManagedDir = "managed"

	// PluginUserDir is the subdirectory under ~/.dws/plugins/ where all
	// third-party plugins are installed. Every plugin — whether authored
	// by the DingTalk team or anyone else — lives here with equal status.
	PluginUserDir = "user"

	// PluginDataDir is the subdirectory under ~/.dws/plugins/ for
	// plugin persistent data that survives across version updates.
	PluginDataDir = "data"

	// PluginHookTimeout is the default timeout for plugin hook commands.
	PluginHookTimeout = 30 * time.Second
)

const (
	// DefaultTerminalBaseURL is the DingTalk developer platform base URL.
	// Override at runtime via ~/.dws/terminal_url file.
	DefaultTerminalBaseURL = "https://open-dev.dingtalk.com"

	// DeveloperSettingsPath is the path to the organization developer
	// settings page (CLI access management).
	DeveloperSettingsPath = "/fe/old#/developerSettings"
)

const (
	// DefaultFetchServersLimit is the maximum number of servers to fetch
	// from the market registry in a single request.
	DefaultFetchServersLimit = 200
)

const (
	// DefaultPartition is the cache partition used when no tenant/org
	// context is available.
	DefaultPartition = "default/default"
)

const (
	// MaxResponseBodySize limits the amount of data read from a single
	// HTTP response to prevent memory exhaustion from malicious servers.
	MaxResponseBodySize = 10 * 1024 * 1024 // 10 MB
)

const (
	// MaxUploadFileSize is the maximum file size for attachment uploads.
	MaxUploadFileSize int64 = 100 * 1024 * 1024 // 100 MB
)