app

type App struct {
	Sessions *SessionManager
	// contains filtered or unexported fields
}

type CertInfo struct {
	ID         string `json:"id"`
	Name       string `json:"name"`
	Subject    string `json:"subject"`
	Issuer     string `json:"issuer"`
	NotAfter   string `json:"not_after"`
	IsCA       bool   `json:"is_ca"`
	KeyFile    string `json:"key_file,omitempty"`
	CertFile   string `json:"cert_file,omitempty"`
	CAParentID string `json:"ca_parent_id,omitempty"`
}

type ClientEntry struct {
	Name     string   `yaml:"name" json:"name"`
	Addr     string   `yaml:"addr" json:"addr"`                       // primary address (backward compat)
	Addrs    []string `yaml:"addrs,omitempty" json:"addrs,omitempty"` // all addresses (including primary)
	Password string   `yaml:"password" json:"password"`

	// TLS
	SNI      string `yaml:"sni,omitempty" json:"sni"`
	Insecure bool   `yaml:"insecure" json:"insecure"`
	CA       string `yaml:"ca,omitempty" json:"ca"` // PEM content or path

	// Bandwidth (bytes/sec)
	MaxTx int `yaml:"max_tx,omitempty" json:"max_tx"`
	MaxRx int `yaml:"max_rx,omitempty" json:"max_rx"`

	// QUIC
	InitStreamWindow int `yaml:"init_stream_window,omitempty" json:"init_stream_window"`
	MaxStreamWindow  int `yaml:"max_stream_window,omitempty" json:"max_stream_window"`
	InitConnWindow   int `yaml:"init_conn_window,omitempty" json:"init_conn_window"`
	MaxConnWindow    int `yaml:"max_conn_window,omitempty" json:"max_conn_window"`

	// Misc
	FastOpen   bool   `yaml:"fast_open,omitempty" json:"fast_open"`
	BBRProfile string `yaml:"bbr_profile,omitempty" json:"bbr_profile,omitempty"` // "", "standard", "conservative", "aggressive"
	Disabled   bool   `yaml:"disabled,omitempty" json:"disabled"`
}

type Config struct {
	NodeID          string                `yaml:"node_id" json:"node_id"`
	Name            string                `yaml:"name" json:"name"`
	ExitNode        bool                  `yaml:"exit_node" json:"exit_node"`
	Hy2UserAuth     bool                  `yaml:"hy2_user_auth,omitempty" json:"hy2_user_auth"`
	Server          *ServerConfig         `yaml:"server" json:"server"`
	Clients         []ClientEntry         `yaml:"clients" json:"clients"`
	Peers           map[string]PeerConfig `yaml:"peers" json:"peers"`
	SOCKS5          *SOCKS5Config         `yaml:"socks5,omitempty" json:"-"`
	Users           []UserConfig          `yaml:"users" json:"users"`
	Proxies         []ProxyConfig         `yaml:"proxies" json:"proxies"`
	SS              *SSConfig             `yaml:"ss,omitempty" json:"ss,omitempty"`
	L2TP            *L2TPConfig           `yaml:"l2tp,omitempty" json:"l2tp,omitempty"`
	IKEv2           *IKEv2Config          `yaml:"ikev2,omitempty" json:"ikev2,omitempty"`
	WireGuard       *WireGuardConfig      `yaml:"wireguard,omitempty" json:"wireguard,omitempty"`
	Rules           []RoutingRule         `yaml:"rules,omitempty" json:"rules,omitempty"`
	TunMode         *TunModeConfig        `yaml:"tun_mode,omitempty" json:"tun_mode,omitempty"`
	UIListen        string                `yaml:"ui_listen,omitempty" json:"ui_listen,omitempty"`
	UIBasePath      string                `yaml:"ui_base_path,omitempty" json:"ui_base_path,omitempty"`
	WebUsername     string                `yaml:"web_username,omitempty" json:"web_username,omitempty"`
	WebPassword     string                `yaml:"web_password,omitempty" json:"web_password,omitempty"`
	DNS             string                `yaml:"dns,omitempty" json:"dns,omitempty"`
	ForceHTTPS      bool                  `yaml:"force_https,omitempty" json:"force_https,omitempty"`
	HTTPSCertID     string                `yaml:"https_cert_id,omitempty" json:"https_cert_id,omitempty"`
	SessionTimeoutH int                   `yaml:"session_timeout_h,omitempty" json:"session_timeout_h,omitempty"` // hours, default 12
	// Persisted topology-graph layout: node key → SVG coordinates. Stored
	// server-side so the layout follows the user across browsers/devices
	// and multiple concurrent sessions converge on a single source of truth.
	GraphLayout map[string]GraphLayoutPos `yaml:"graph_layout,omitempty" json:"graph_layout,omitempty"`
	// Nested-discovery hard limits. Defensive backstops on the deep-cache
	// machinery (see internal/api/server.go walkAndCache /
	// assembleDeepTree). Under a sane config rule 1 cycle drop + rule 2
	// gating already structurally bound the tree shape; these caps only
	// fire under pathological mis-config or hostile peers. Hot-reloadable:
	// updateUISettings refreshes the runtime atomic-pointer so changes
	// take effect within the next SubPeersUpdater tick (≤7 s) without a
	// restart. Zero / missing means "use built-in default".
	MaxNestedDepth   int `yaml:"max_nested_depth,omitempty" json:"max_nested_depth,omitempty"`     // default 5,         hard cap 10
	MaxResponseNodes int `yaml:"max_response_nodes,omitempty" json:"max_response_nodes,omitempty"` // default 1024,      hard cap 65536
	MaxCacheEntries  int `yaml:"max_cache_entries,omitempty" json:"max_cache_entries,omitempty"`   // default 5000,      hard cap 100000
	MaxResponseBytes int `yaml:"max_response_bytes,omitempty" json:"max_response_bytes,omitempty"` // default 1048576,   hard cap 16<<20
	MaxFetchFanOut   int `yaml:"max_fetch_fan_out,omitempty" json:"max_fetch_fan_out,omitempty"`   // default 8,         hard cap 64

	// RelayAdminPassthrough lets web/API requests delivered through the
	// authenticated peer-to-peer relay bridge (apiBridge in
	// internal/api/server.go) skip the local session/Bearer-token check.
	// Off by default — backwards compatible with every prior release where
	// every API route required login regardless of transport. When on, the
	// trust boundary becomes the relay handshake itself: a peer that has
	// already authenticated as a known node is allowed to administer this
	// node's web UI without a separate admin password.
	RelayAdminPassthrough bool `yaml:"relay_admin_passthrough,omitempty" json:"relay_admin_passthrough,omitempty"`

	// DNSResolver routes hy2scale's own internal name lookups (rules-engine
	// `applyDomainRule`, future call sites) through a clean upstream DNS
	// reachable via the relay/exit, so a polluted local resolv.conf does
	// not contaminate which IPs the rule installs in iptables. Disabled by
	// default: hy2scale falls back to net.LookupHost (host's resolv.conf).
	DNSResolver DNSResolverConfig `yaml:"dns_resolver,omitempty" json:"dns_resolver,omitempty"`
}

type ConfigStore struct {
	// contains filtered or unexported fields
}

type DNSResolverConfig struct {
	// Enabled turns the resolver on. *bool so we can distinguish three
	// states: nil (config field absent → default ENABLED), explicit
	// true, explicit false. Defaulting nil to enabled means upgrades
	// from 1.3.3 (which had no `dns_resolver` section) and fresh
	// installs both get the safer relay-routed path; only operators
	// who explicitly turned it off keep their off state.
	Enabled *bool `yaml:"enabled,omitempty" json:"enabled,omitempty"`
	// CacheTTL is how long an answer stays cached (seconds). Default
	// 300. Fixed window — Go's stdlib resolver path doesn't surface
	// the upstream's per-record TTL, so we use one operator-tunable
	// value rather than honouring per-record TTL with min/max clamps.
	CacheTTL int `yaml:"cache_ttl,omitempty" json:"cache_ttl,omitempty"`
	// NegativeTTL is how long failures stay cached (seconds). Default
	// 30. Avoids hammering upstream on an obviously-broken name.
	NegativeTTL int `yaml:"negative_ttl,omitempty" json:"negative_ttl,omitempty"`
	// CacheSize is the maximum number of cached entries (LRU evicted).
	// Default 1024.
	CacheSize int `yaml:"cache_size,omitempty" json:"cache_size,omitempty"`
	// QueryTimeoutMs bounds a single upstream query (milliseconds).
	// Default 3000.
	QueryTimeoutMs int `yaml:"query_timeout_ms,omitempty" json:"query_timeout_ms,omitempty"`
}

type Device struct {
	Key       string // username|ip|protocol
	Username  string
	RemoteIP  string
	Protocol  string // "socks5", "ss", "hy2", "l2tp", "ikev2"
	ConnectAt time.Time
	ConnCount atomic.Int32 // number of active TCP connections
	TxBytes   atomic.Int64
	RxBytes   atomic.Int64
	// contains filtered or unexported fields
}

type DeviceJSON struct {
	Key       string `json:"key"`
	Username  string `json:"username"`
	RemoteIP  string `json:"remote_ip"`
	Protocol  string `json:"protocol"`
	ConnectAt int64  `json:"connect_at"`
	Duration  int    `json:"duration"`
	ConnCount int    `json:"conn_count"`
	TxBytes   int64  `json:"tx_bytes"`
	RxBytes   int64  `json:"rx_bytes"`
}

type GraphLayoutPos struct {
	X float64 `yaml:"x" json:"x"`
	Y float64 `yaml:"y" json:"y"`
}

type IKEv2Config struct {
	Enabled         bool   `yaml:"enabled" json:"enabled"`
	Mode            string `yaml:"mode" json:"mode"`                                               // "mschapv2" or "psk"
	Pool            string `yaml:"pool" json:"pool"`                                               // e.g. "10.10.10.1/24"
	CertID          string `yaml:"cert_id" json:"cert_id"`                                         // TLS cert ID (for mschapv2)
	PSK             string `yaml:"psk" json:"psk"`                                                 // pre-shared key (for psk mode)
	LocalID         string `yaml:"local_id" json:"local_id"`                                       // server identity (leftid), default = node ID
	RemoteID        string `yaml:"remote_id" json:"remote_id"`                                     // client identity (rightid), default = %any
	PSKUserMode     bool   `yaml:"psk_user_mode" json:"psk_user_mode"`                             // PSK: require user auth
	DefaultExit     string `yaml:"default_exit" json:"default_exit"`                               // exit_via when user mode off
	DefaultExitMode string `yaml:"default_exit_mode,omitempty" json:"default_exit_mode,omitempty"` // ""|"quality"|"aggregate"
	DNS             string `yaml:"dns" json:"dns"`                                                 // DNS servers, default "8.8.8.8 8.8.4.4"
	ProxyPort       int    `yaml:"proxy_port" json:"proxy_port"`                                   // transparent proxy port, default 12350
	MTU             int    `yaml:"mtu" json:"mtu"`                                                 // tunnel MTU, default 1400
}

type L2TPConfig struct {
	Listen    string `yaml:"listen" json:"listen"` // UDP port, e.g. "1701"
	Enabled   bool   `yaml:"enabled" json:"enabled"`
	Pool      string `yaml:"pool" json:"pool"`             // e.g. "192.168.25.1/24"
	PSK       string `yaml:"psk" json:"psk"`               // IPsec pre-shared key
	ProxyPort int    `yaml:"proxy_port" json:"proxy_port"` // transparent proxy port, default 12345
	MTU       int    `yaml:"mtu" json:"mtu"`               // PPP MTU, default 1280
}

type PeerConfig struct {
	Nested   bool `yaml:"nested" json:"nested"`
	Disabled bool `yaml:"disabled,omitempty" json:"disabled,omitempty"`
}

type PortConflict struct {
	Port  int    `json:"port"`
	Proto string `json:"proto"` // "tcp" or "udp"
	Desc  string `json:"desc"`  // what's using it
}

type ProxyConfig struct {
	ID        string   `yaml:"id" json:"id"`
	Protocol  string   `yaml:"protocol" json:"protocol"` // "socks5", "http"
	Listen    string   `yaml:"listen" json:"listen"`
	Enabled   bool     `yaml:"enabled" json:"enabled"`
	TLSCert   string   `yaml:"tls_cert,omitempty" json:"tls_cert,omitempty"` // TLS cert ID (enables TLS wrapping)
	ExitVia   string   `yaml:"exit_via,omitempty" json:"exit_via,omitempty"`
	ExitPaths []string `yaml:"exit_paths,omitempty" json:"exit_paths,omitempty"`
	ExitMode  string   `yaml:"exit_mode,omitempty" json:"exit_mode,omitempty"`
}

type RelayAuthConn struct {
	net.Conn
	AuthID string
}

type RoutingRule struct {
	ID        string   `yaml:"id" json:"id"`
	Name      string   `yaml:"name" json:"name"`
	Type      string   `yaml:"type" json:"type"`       // "ip" or "domain"
	Targets   []string `yaml:"targets" json:"targets"` // IPs/CIDRs/ranges or domains
	ExitVia   string   `yaml:"exit_via" json:"exit_via"`
	ExitPaths []string `yaml:"exit_paths,omitempty" json:"exit_paths,omitempty"`
	ExitMode  string   `yaml:"exit_mode,omitempty" json:"exit_mode,omitempty"` // ""|"quality"|"aggregate"
	Enabled   bool     `yaml:"enabled" json:"enabled"`
	// Priority resolves overlaps between rules. Higher priority wins for the
	// same IP/CIDR. At equal priority, use_tun=true wins (TUN naturally
	// preempts proxy at the routing layer anyway). Default 0.
	Priority int `yaml:"priority,omitempty" json:"priority,omitempty"`
	// UseTun requests full TUN forwarding for this rule. When the exit peer is
	// TUN-capable (has NET_ADMIN + /dev/net/tun) and the target is routable,
	// packets go through a raw IP tunnel (source IP preserved, ICMP supported).
	// Otherwise silently falls back to normal relay proxy. When UseTun is set
	// ExitPaths and ExitMode are ignored — only a single exit_via is honored.
	UseTun bool `yaml:"use_tun,omitempty" json:"use_tun,omitempty"`
}

type SOCKS5Config struct {
	Listen  string `yaml:"listen"`
	ExitVia string `yaml:"exit_via"`
}

type SSConfig struct {
	Listen  string `yaml:"listen" json:"listen"`
	Enabled bool   `yaml:"enabled" json:"enabled"`
	Method  string `yaml:"method" json:"method"` // aes-128-gcm, aes-256-gcm, chacha20-ietf-poly1305
}

type ServerConfig struct {
	Listen   string `yaml:"listen" json:"listen"`
	Password string `yaml:"password" json:"password"`
	TLSCert  string `yaml:"tls_cert" json:"tls_cert"`
	TLSKey   string `yaml:"tls_key" json:"tls_key"`
}

type SessionManager struct {
	// contains filtered or unexported fields
}

type TLSStore struct {
	// contains filtered or unexported fields
}

type TunModeConfig struct {
	Enabled bool   `yaml:"enabled" json:"enabled"`
	Mode    string `yaml:"mode" json:"mode"` // "mixed" (routable=TUN, others=proxy) or "full" (all TUN)
}

type UserConfig struct {
	ID             string            `yaml:"id" json:"id"`
	Username       string            `yaml:"username" json:"username"`
	Password       string            `yaml:"password" json:"password"`
	ProxyPasswords map[string]string `yaml:"proxy_passwords,omitempty" json:"proxy_passwords,omitempty"` // proxy-specific overrides (e.g. "hy2", "ss")
	// ProxyDisabled lists proxy keys (hy2/ss/socks5/http/l2tp/ikev2) that
	// MUST refuse to authenticate this user. Empty/missing list = the user
	// is allowed on every proxy. Used by the per-proxy auth toggle in the
	// admin UI; the auth path consults IsProxyEnabled() before issuing a
	// successful auth on each protocol.
	ProxyDisabled []string `yaml:"proxy_disabled,omitempty" json:"proxy_disabled,omitempty"`
	ExitVia       string   `yaml:"exit_via" json:"exit_via"`
	ExitPaths     []string `yaml:"exit_paths,omitempty" json:"exit_paths,omitempty"`
	ExitMode      string   `yaml:"exit_mode,omitempty" json:"exit_mode,omitempty"` // ""|"quality"|"aggregate"
	TrafficLimit  int64    `yaml:"traffic_limit" json:"traffic_limit"`             // bytes, 0=unlimited
	TrafficUsed   int64    `yaml:"traffic_used" json:"traffic_used"`
	ExpiryDate    string   `yaml:"expiry_date,omitempty" json:"expiry_date"`
	Enabled       bool     `yaml:"enabled" json:"enabled"`
}

type WireGuardConfig struct {
	Enabled    bool            `yaml:"enabled" json:"enabled"`
	ListenPort int             `yaml:"listen_port" json:"listen_port"`
	PrivateKey string          `yaml:"private_key" json:"private_key"`
	Address    string          `yaml:"address" json:"address"`
	DNS        string          `yaml:"dns,omitempty" json:"dns,omitempty"`
	MTU        int             `yaml:"mtu,omitempty" json:"mtu,omitempty"`
	Peers      []WireGuardPeer `yaml:"peers" json:"peers"`
}

type WireGuardPeer struct {
	Name       string   `yaml:"name" json:"name"`
	PublicKey  string   `yaml:"public_key" json:"public_key"`
	PrivateKey string   `yaml:"private_key" json:"private_key"`
	AllowedIPs string   `yaml:"allowed_ips" json:"allowed_ips"`
	Keepalive  int      `yaml:"keepalive" json:"keepalive"`
	ExitVia    string   `yaml:"exit_via,omitempty" json:"exit_via"`
	ExitPaths  []string `yaml:"exit_paths,omitempty" json:"exit_paths,omitempty"`
	ExitMode   string   `yaml:"exit_mode,omitempty" json:"exit_mode,omitempty"`
}