config

type APIAuthConfig struct {
	Audience       string   // expected OIDC audience (default: public_base_url)
	ExtraAudiences []string // additional accepted audiences (e.g. the gcloud ADC client id, for user tokens)
	Principals     []APIAuthPrincipal
}

type APIAuthPrincipal struct {
	Email  string
	Scopes []string
}

type AllowBlock struct {
	Unit    string   `hcl:"unit"`
	Key     string   `hcl:"key"`
	Envs    []string `hcl:"envs"`
	Reason  string   `hcl:"reason"`
	Expires string   `hcl:"expires,optional"`
}

type ApprovalConfig struct {
	Backend       string // the block label, e.g. "gcp-pam"
	Location      string
	Duration      string
	RequesterPool []string
}

type CacheConfig struct {
	Bucket  string
	Prefix  string
	Version string
}

type ClassBinding struct {
	Name             string
	Backend          string
	Entitlement      string
	EntitlementScope string
	Required         bool
}

type Classification struct {
	Default model.Class
	Rules   []classify.Rule
}

type Config struct {
	Classification *Classification // nil when no classification block present
	Diff           DiffConfig
	Links          *LinksConfig         // nil when no links block present
	Server         *ServerConfig        // nil when no server block (the default/unlabeled one)
	Servers        []ServerConfig       // all parsed server blocks (including labeled ones)
	Serve          *ServeConfig         // nil when no serve block (added in a later task)
	UI             *UIConfig            // nil when no ui block (the central UI face)
	Classes        []ClassBinding       // class "<name>" {} bindings
	Progress       *ProgressConfig      // nil when no progress block (falls back to built-in fracs)
	Cache          *CacheConfig         // nil when no cache block present
	EnvUniqueness  *EnvUniquenessConfig // nil when no env_uniqueness block present
}

type DiffConfig struct {
	Detect            bool
	MaxAttributeLines int // 0 = no cap
	Overrides         []DiffOverride
}

type DiffOverride struct {
	TypePattern *regexp.Regexp
	Attribute   string
	Differ      string
}

type EnvBlock struct {
	Name string `hcl:"name,label"`
	Tier string `hcl:"tier"`
}

type EnvUniquenessConfig struct {
	ProtectedTier   string              `hcl:"protected_tier,optional"`
	ProjectTemplate string              `hcl:"project_token_template,optional"`
	Environments    []EnvBlock          `hcl:"environment,block"`
	Source          *SourceBlock        `hcl:"source,block"`
	ExtraEnvTokens  map[string][]string `hcl:"extra_env_tokens,optional"`
	ExtraScopedSegs []string            `hcl:"extra_scoped_segments,optional"`
	ExtraKeyPats    []string            `hcl:"extra_key_patterns,optional"`
	Allows          []AllowBlock        `hcl:"allow,block"`
}

type ExecutorConfig struct {
	Backend  string // the block label, e.g. "cloudbuild"
	Project  string
	Region   string
	Triggers map[string]string // run kind ("plan"/"apply") → trigger name
}

type GitHubAppConfig struct {
	AppID          string
	InstallationID string
	PrivateKeyPath string
}

type HeaderLink struct {
	Label string
	URL   string
}

type LinksConfig struct {
	Resource string
	Stack    string
	Header   []HeaderLink
}

type ObjectsConfig struct {
	Backend string // "gcs"
	Bucket  string
	Prefix  string
}

type PhaseWeight struct {
	Phase  events.Phase
	Weight float64
}

type ProgressConfig struct {
	Plan  []PhaseWeight
	Apply []PhaseWeight
}

type PubSubConfig struct {
	Audience       string // expected OIDC audience (default: <public_base_url>/pubsub/push)
	ServiceAccount string // the push subscription's OIDC service-account email
}

type ServeConfig struct {
	DBPath                 string
	PublicBaseURL          string
	GitHubWebhookSecretEnv string // env var name holding the GitHub webhook HMAC secret
	// UIBaseURL is the central UI service's external base URL. Check-run
	// details and approval links point there ("" leaves them unset — the
	// check-run body still carries everything). The UI's tier names must
	// match the serve environments for its /t/<tier>/e/<id> routes.
	UIBaseURL string
	GitHubApp *GitHubAppConfig
	Approval  *ApprovalConfig
	LogsDir   string
	Objects   *ObjectsConfig
	PubSub    *PubSubConfig
	APIAuth   *APIAuthConfig
	Executor  *ExecutorConfig
}

type ServerConfig struct {
	Name        string
	URL         string
	Environment string
}

type SourceBlock struct {
	Glob             string `hcl:"glob,optional"`
	EnvironmentsPath string `hcl:"environments_path,optional"`
	InputsPath       string `hcl:"inputs_path,optional"`
	TierInput        string `hcl:"tier_input,optional"`
}

type UIConfig struct {
	PublicBaseURL    string // external base URL (OAuth redirect URI = <base>/auth/callback)
	SessionSecretEnv string // env var name holding the session-cookie encryption secret
	// GitHubWebhookSecretEnv names the env var holding the GitHub App's
	// webhook secret. The UI is the App's single webhook ingress: it verifies
	// GitHub's HMAC here and relays deliveries to the tiers under its own
	// Google OIDC identity — the App secret exists nowhere else.
	GitHubWebhookSecretEnv string
	Tiers                  []UITierConfig
	OAuth                  *UIOAuthConfig
}

type UIOAuthConfig struct {
	ClientID        string
	ClientSecretEnv string
	AllowedDomain   string // required Workspace domain (the id_token `hd` claim)
	// QuotaProject is sent as x-goog-user-project on user-token GCP API calls
	// (PAM approve/deny): user credentials attribute quota to the OAuth
	// client's project, which must have the called API enabled. Empty sends
	// no header.
	QuotaProject string
}

type UITierConfig struct {
	Name     string
	URL      string
	Audience string
}