config

type AppAuthConfig struct {
	Mode string         `koanf:"mode"`
	OIDC OIDCAuthConfig `koanf:"oidc"`
}

type AuthConfig struct {
	Type     string `koanf:"type" json:"type"`
	Username string `koanf:"username" json:"username"`
	Password string `koanf:"password" json:"password"`
}

type ClusterConfig struct {
	Name           string               `koanf:"name" json:"name"`
	IsProd         bool                 `koanf:"is_prod" json:"is_prod"`
	Brokers        []string             `koanf:"brokers" json:"brokers"`
	Auth           AuthConfig           `koanf:"auth" json:"auth"`
	TLS            TLSConfig            `koanf:"tls" json:"tls"`
	SchemaRegistry SchemaRegistryConfig `koanf:"schema_registry" json:"schema_registry"`
	DataMasking    []MaskingRule        `koanf:"data_masking" json:"data_masking"`
}

type Config struct {
	Server   ServerConfig    `koanf:"server"`
	Clusters []ClusterConfig `koanf:"clusters"`
	RBAC     RBACConfig      `koanf:"rbac"`
	Auth     AppAuthConfig   `koanf:"auth"`
	Log      LogConfig       `koanf:"log"`

	PrivateClusters PrivateClustersConfig `koanf:"private_clusters"`
}

type IdentityConfig struct {
	Header        string `koanf:"header"`
	AnonymousRole string `koanf:"anonymous_role"`
}

type LogConfig struct {
	Level  string `koanf:"level"`
	Format string `koanf:"format"`
}

type MaskingRule struct {
	Topics      []string    `koanf:"topics" json:"topics"`
	Fields      []string    `koanf:"fields" json:"fields"`           // JSONPath expressions
	Regex       []RegexMask `koanf:"regex" json:"regex"`             // regex-based replacements applied on the raw string
	Replacement string      `koanf:"replacement" json:"replacement"` // default replacement for Fields; empty = "***"
	Targets     []string    `koanf:"targets" json:"targets"`
	Headers     []string    `koanf:"headers" json:"headers"`
}

type OIDCAuthConfig struct {
	// IssuerURL is the exact expected "iss" claim and the base for OpenID
	// Connect discovery. Required in oidc mode.
	// Env: KAFKITO_AUTH_OIDC_ISSUER_URL.
	IssuerURL string `koanf:"issuer_url"`
	// Audience is the value the token's "aud" claim must contain: the
	// identifier of the kafkito API, not the client of the auth proxy.
	// Required in oidc mode. Env: KAFKITO_AUTH_OIDC_AUDIENCE.
	Audience string `koanf:"audience"`
	// JWKSURL is the signing-key endpoint. When empty it is discovered from
	// <IssuerURL>/.well-known/openid-configuration at startup.
	// Env: KAFKITO_AUTH_OIDC_JWKS_URL.
	JWKSURL string `koanf:"jwks_url"`
	// RequiredTyp, when set, is the "typ" header every token must carry
	// (for example "at+jwt"). Empty disables the check.
	// Env: KAFKITO_AUTH_OIDC_REQUIRED_TYP.
	RequiredTyp string `koanf:"required_typ"`
	// AllowedAZP, when non-empty, lists the "azp" claim values a token may
	// carry; tokens without azp are then rejected. Empty disables the check.
	// Env: KAFKITO_AUTH_OIDC_ALLOWED_AZP (comma-separated).
	AllowedAZP []string `koanf:"allowed_azp"`
}

type PermissionConfig struct {
	Resource string   `koanf:"resource"`
	Actions  []string `koanf:"actions"`
}

type PrivateClusterMode string

type PrivateClustersConfig struct {
	// Mode is on, off or role, case-insensitive; empty means on. Load also
	// accepts a YAML boolean: true is on, false is off.
	Mode PrivateClusterMode `koanf:"mode"`
	// AllowPlainWithoutTLS lets a private cluster use SASL/PLAIN without
	// TLS. By default such a definition is rejected, because PLAIN sends
	// the password in clear text. Configured clusters are not affected.
	AllowPlainWithoutTLS bool `koanf:"allow_plain_without_tls"`
}

type RBACConfig struct {
	Enabled     bool            `koanf:"enabled"`
	DefaultRole string          `koanf:"default_role"`
	Identity    IdentityConfig  `koanf:"identity"`
	Roles       []RoleConfig    `koanf:"roles"`
	Subjects    []SubjectConfig `koanf:"subjects"`
}

type RegexMask struct {
	Match       string `koanf:"match" json:"match"`
	Replacement string `koanf:"replacement" json:"replacement"`
}

type RoleConfig struct {
	Name        string             `koanf:"name"`
	Permissions []PermissionConfig `koanf:"permissions"`
}

type SchemaRegistryConfig struct {
	URL                string `koanf:"url" json:"url"`
	Username           string `koanf:"username" json:"username"`
	Password           string `koanf:"password" json:"password"`
	InsecureSkipVerify bool   `koanf:"insecure_skip_verify" json:"insecure_skip_verify"`
}

type ServerConfig struct {
	// Addr is the bind address, e.g. ":37421". Empty means DefaultAddr.
	// A non-empty $PORT always wins over this (Load rewrites Addr to
	// ":$PORT"), to stay Cloud-Foundry friendly.
	Addr string `koanf:"addr"`
	// TestConnectionTimeout bounds the "Test connection" probe of
	// POST /api/v1/clusters/_test. Env: KAFKITO_TEST_CONNECTION_TIMEOUT
	// (Go duration, e.g. "30s"). Zero means DefaultTestConnectionTimeout.
	TestConnectionTimeout time.Duration `koanf:"test_connection_timeout"`
	// FrameAncestors is the source list of the Content-Security-Policy
	// frame-ancestors directive, i.e. which origins may embed the UI in a
	// frame. Env: KAFKITO_SERVER_FRAME_ANCESTORS. Empty means
	// DefaultFrameAncestors ('none').
	FrameAncestors string `koanf:"frame_ancestors"`
}

type SubjectConfig struct {
	User  string   `koanf:"user"`
	Roles []string `koanf:"roles"`
}

type TLSConfig struct {
	Enabled            bool `koanf:"enabled" json:"enabled"`
	InsecureSkipVerify bool `koanf:"insecure_skip_verify" json:"insecure_skip_verify"`
}