config

type APIAuthConfig struct {
	Audience       string   // expected OIDC audience (default: public_base_url)
	ExtraAudiences []string // additional accepted audiences (e.g. the gcloud ADC client id, for user tokens)
	Principals     []APIAuthPrincipal
}

type APIAuthPrincipal struct {
	Email  string
	Scopes []string
}

type ApprovalConfig struct {
	Backend       string // the block label, e.g. "gcp-pam"
	Location      string
	Duration      string
	RequesterPool []string
}

type CacheConfig struct {
	Bucket  string
	Prefix  string
	Version string
}

type ClassBinding struct {
	Name             string
	Backend          string
	Entitlement      string
	EntitlementScope string
	Required         bool
}

type Classification struct {
	Default model.Class
	Rules   []classify.Rule
}

type Config struct {
	Classification *Classification // nil when no classification block present
	Diff           DiffConfig
	Links          *LinksConfig    // nil when no links block present
	Server         *ServerConfig   // nil when no server block
	Serve          *ServeConfig    // nil when no serve block (added in a later task)
	UI             *UIConfig       // nil when no ui block (the central UI face)
	Classes        []ClassBinding  // class "<name>" {} bindings
	Progress       *ProgressConfig // nil when no progress block (falls back to built-in fracs)
	Cache          *CacheConfig    // nil when no cache block present
}

type DiffConfig struct {
	Detect            bool
	MaxAttributeLines int // 0 = no cap
	Overrides         []DiffOverride
}

type DiffOverride struct {
	TypePattern *regexp.Regexp
	Attribute   string
	Differ      string
}

type ExecutorConfig struct {
	Backend  string // the block label, e.g. "cloudbuild"
	Project  string
	Region   string
	Triggers map[string]string // run kind ("plan"/"apply") → trigger name
}

type GitHubAppConfig struct {
	AppID          string
	InstallationID string
	PrivateKeyPath string
}

type GroupConfig struct {
	Depth   int
	Pattern string
}

type HeaderLink struct {
	Label string
	URL   string
}

type LinksConfig struct {
	Resource string
	Stack    string
	Header   []HeaderLink
}

type ObjectsConfig struct {
	Backend string // "gcs"
	Bucket  string
	Prefix  string
}

type PhaseWeight struct {
	Phase  events.Phase
	Weight float64
}

type ProgressConfig struct {
	Plan  []PhaseWeight
	Apply []PhaseWeight
}

type PubSubConfig struct {
	Audience       string // expected OIDC audience (default: <public_base_url>/pubsub/push)
	ServiceAccount string // the push subscription's OIDC service-account email
}

type ServeConfig struct {
	DBPath                 string
	PublicBaseURL          string
	GitHubWebhookSecretEnv string // env var name holding the GitHub webhook HMAC secret
	// UIBaseURL is the central UI service's external base URL. Check-run
	// details and approval links point there ("" leaves them unset — the
	// check-run body still carries everything). The UI's tier names must
	// match the serve environments for its /t/<tier>/e/<id> routes.
	UIBaseURL string
	GitHubApp *GitHubAppConfig
	Approval  *ApprovalConfig
	Group     *GroupConfig
	LogsDir   string
	Objects   *ObjectsConfig
	PubSub    *PubSubConfig
	APIAuth   *APIAuthConfig
	Executor  *ExecutorConfig
}

type ServerConfig struct {
	URL         string
	Environment string
}

type UIConfig struct {
	PublicBaseURL    string // external base URL (OAuth redirect URI = <base>/auth/callback)
	SessionSecretEnv string // env var name holding the session-cookie encryption secret
	// GitHubWebhookSecretEnv names the env var holding the GitHub App's
	// webhook secret. The UI is the App's single webhook ingress: it verifies
	// GitHub's HMAC here and relays deliveries to the tiers under its own
	// Google OIDC identity — the App secret exists nowhere else.
	GitHubWebhookSecretEnv string
	Tiers                  []UITierConfig
	OAuth                  *UIOAuthConfig
}

type UIOAuthConfig struct {
	ClientID        string
	ClientSecretEnv string
	AllowedDomain   string // required Workspace domain (the id_token `hd` claim)
	// QuotaProject is sent as x-goog-user-project on user-token GCP API calls
	// (PAM approve/deny): user credentials attribute quota to the OAuth
	// client's project, which must have the called API enabled. Empty sends
	// no header.
	QuotaProject string
}

type UITierConfig struct {
	Name     string
	URL      string
	Audience string
}