config

type APIAuthConfig struct {
	Audience       string   // expected OIDC audience (default: public_base_url)
	ExtraAudiences []string // additional accepted audiences (e.g. the gcloud ADC client id, for user tokens)
	Principals     []APIAuthPrincipal
}

type APIAuthPrincipal struct {
	Email  string
	Scopes []string
}

type ApprovalConfig struct {
	Backend       string // the block label, e.g. "gcp-pam"
	Location      string
	Duration      string
	RequesterPool []string
}

type CacheConfig struct {
	Bucket  string
	Prefix  string
	Version string
}

type ClassBinding struct {
	Name             string
	Backend          string
	Entitlement      string
	EntitlementScope string
	Required         bool
}

type Classification struct {
	Default model.Class
	Rules   []classify.Rule
}

type Config struct {
	Classification *Classification // nil when no classification block present
	Diff           DiffConfig
	Links          *LinksConfig    // nil when no links block present
	Server         *ServerConfig   // nil when no server block
	Serve          *ServeConfig    // nil when no serve block (added in a later task)
	Classes        []ClassBinding  // class "<name>" {} bindings
	Progress       *ProgressConfig // nil when no progress block (falls back to built-in fracs)
	Cache          *CacheConfig    // nil when no cache block present
}

type DiffConfig struct {
	Detect            bool
	MaxAttributeLines int // 0 = no cap
	Overrides         []DiffOverride
}

type DiffOverride struct {
	TypePattern *regexp.Regexp
	Attribute   string
	Differ      string
}

type ExecutorConfig struct {
	Backend  string // the block label, e.g. "cloudbuild"
	Project  string
	Region   string
	Triggers map[string]string // run kind ("plan"/"apply") → trigger name
}

type GitHubAppConfig struct {
	AppID          string
	InstallationID string
	PrivateKeyPath string
}

type GroupConfig struct {
	Depth   int
	Pattern string
}

type HeaderLink struct {
	Label string
	URL   string
}

type LinksConfig struct {
	Resource string
	Stack    string
	Header   []HeaderLink
}

type ObjectsConfig struct {
	Backend string // "gcs"
	Bucket  string
	Prefix  string
}

type PhaseWeight struct {
	Phase  events.Phase
	Weight float64
}

type ProgressConfig struct {
	Plan  []PhaseWeight
	Apply []PhaseWeight
}

type PubSubConfig struct {
	Audience       string // expected OIDC audience (default: <public_base_url>/pubsub/push)
	ServiceAccount string // the push subscription's OIDC service-account email
}

type ServeConfig struct {
	DBPath                 string
	PublicBaseURL          string
	WebhookSecretEnv       string // env var name holding the view-JWT signing secret (not the secret itself)
	GitHubWebhookSecretEnv string // env var name holding the GitHub webhook HMAC secret
	GitHubApp              *GitHubAppConfig
	Approval               *ApprovalConfig
	Group                  *GroupConfig
	LogsDir                string
	Objects                *ObjectsConfig
	PubSub                 *PubSubConfig
	APIAuth                *APIAuthConfig
	Executor               *ExecutorConfig
}

type ServerConfig struct {
	URL         string
	Environment string
}