config

type AppAuthConfig struct {
	Mode string `koanf:"mode"`
}

type AuthConfig struct {
	Type     string `koanf:"type" json:"type"`
	Username string `koanf:"username" json:"username"`
	Password string `koanf:"password" json:"password"`
}

type ClusterConfig struct {
	Name           string               `koanf:"name" json:"name"`
	IsProd         bool                 `koanf:"is_prod" json:"is_prod"`
	Brokers        []string             `koanf:"brokers" json:"brokers"`
	Auth           AuthConfig           `koanf:"auth" json:"auth"`
	TLS            TLSConfig            `koanf:"tls" json:"tls"`
	SchemaRegistry SchemaRegistryConfig `koanf:"schema_registry" json:"schema_registry"`
	DataMasking    []MaskingRule        `koanf:"data_masking" json:"data_masking"`
}

type Config struct {
	Server   ServerConfig    `koanf:"server"`
	Clusters []ClusterConfig `koanf:"clusters"`
	RBAC     RBACConfig      `koanf:"rbac"`
	Auth     AppAuthConfig   `koanf:"auth"`
	Log      LogConfig       `koanf:"log"`
}

type IdentityConfig struct {
	Header        string `koanf:"header"`
	AnonymousRole string `koanf:"anonymous_role"`
}

type LogConfig struct {
	Level  string `koanf:"level"`
	Format string `koanf:"format"`
}

type MaskingRule struct {
	Topics      []string    `koanf:"topics" json:"topics"`
	Fields      []string    `koanf:"fields" json:"fields"`           // JSONPath expressions
	Regex       []RegexMask `koanf:"regex" json:"regex"`             // regex-based replacements applied on the raw string
	Replacement string      `koanf:"replacement" json:"replacement"` // default replacement for Fields; empty = "***"
	Targets     []string    `koanf:"targets" json:"targets"`
	Headers     []string    `koanf:"headers" json:"headers"`
}

type PermissionConfig struct {
	Resource string   `koanf:"resource"`
	Actions  []string `koanf:"actions"`
}

type RBACConfig struct {
	Enabled     bool            `koanf:"enabled"`
	DefaultRole string          `koanf:"default_role"`
	Identity    IdentityConfig  `koanf:"identity"`
	Roles       []RoleConfig    `koanf:"roles"`
	Subjects    []SubjectConfig `koanf:"subjects"`
}

type RegexMask struct {
	Match       string `koanf:"match" json:"match"`
	Replacement string `koanf:"replacement" json:"replacement"`
}

type RoleConfig struct {
	Name        string             `koanf:"name"`
	Permissions []PermissionConfig `koanf:"permissions"`
}

type SchemaRegistryConfig struct {
	URL                string `koanf:"url" json:"url"`
	Username           string `koanf:"username" json:"username"`
	Password           string `koanf:"password" json:"password"`
	InsecureSkipVerify bool   `koanf:"insecure_skip_verify" json:"insecure_skip_verify"`
}

type ServerConfig struct {
	// Addr is the bind address, e.g. ":37421". Empty means DefaultAddr.
	// A non-empty $PORT always wins over this (Load rewrites Addr to
	// ":$PORT"), to stay Cloud-Foundry friendly.
	Addr string `koanf:"addr"`
	// TestConnectionTimeout bounds the "Test connection" probe of
	// POST /api/v1/clusters/_test. Env: KAFKITO_TEST_CONNECTION_TIMEOUT
	// (Go duration, e.g. "30s"). Zero means DefaultTestConnectionTimeout.
	TestConnectionTimeout time.Duration `koanf:"test_connection_timeout"`
	// FrameAncestors is the source list of the Content-Security-Policy
	// frame-ancestors directive, i.e. which origins may embed the UI in a
	// frame. Env: KAFKITO_SERVER_FRAME_ANCESTORS. Empty means
	// DefaultFrameAncestors ('none').
	FrameAncestors string `koanf:"frame_ancestors"`
}

type SubjectConfig struct {
	User  string   `koanf:"user"`
	Roles []string `koanf:"roles"`
}

type TLSConfig struct {
	Enabled            bool `koanf:"enabled" json:"enabled"`
	InsecureSkipVerify bool `koanf:"insecure_skip_verify" json:"insecure_skip_verify"`
}