config

type ClaimMapEntry struct {
	Value  string
	Mapped string
}

type Config struct {
	OAuth OAuthConfig
	// AppOrigin is the public URL of the frontend (e.g. http://localhost:5173). When set, invite URLs and OAuth redirects use it; non-API requests to this server return 401 Unauthorized.
	AppOrigin string
	Metrics   MetricsConfig
}

type MetricsConfig struct {
	// Enabled mounts /metrics. METRICS_ENABLED; defaults to true.
	Enabled bool
	// Token, when non-empty, requires Authorization: Bearer <token> on /metrics. METRICS_TOKEN.
	Token string // #nosec G117 -- scrape credential from config, not logged
}

type OAuthClientMTLSConfig struct {
	Enabled     bool
	TLSCertFile string
	TLSKeyFile  string
	TLSVersion  uint16
}

type OAuthConfig struct {
	Providers map[string]OAuthProviderConfig
}

type OAuthProviderConfig struct {
	ClientID               string
	ClientSecret           string // #nosec G117 -- OAuth client secret from config, not logged
	Scopes                 []string
	AuthURL                string
	TokenURL               string
	UserInfoURL            string
	UserIDClaim            string // JSON claim for provider user id; default "sub"
	EmailClaim             string // JSON claim for email; default "email"
	EmailsURL              string // Optional second URL returning a JSON array when email is not on userinfo (e.g. GitHub /user/emails)
	EmailsPrimaryClaim     string // Claim on array entries marking the preferred email; default "primary"
	EmailVerifiedClaim     string // Userinfo claim that must be true when email comes from userinfo (e.g. email_verified)
	EmailsVerifiedClaim    string // Emails-list entry claim that must be true (e.g. verified on GitHub /user/emails)
	AllowEmailMatch        bool   // Allow signing in to an existing account by email alone; default false
	DisplayName            string // Login/signup button label; default derived from provider id
	ClientMTLS             OAuthClientMTLSConfig
	JITEnabled             bool            // Create users on first SSO login without an invite; default false
	JITDefaultRole         string          // Role when ROLE_MAP does not match; default "user"
	JITDefaultOrganization string          // Org name or UUID when ORG_CLAIM is missing and domain map does not match
	JITAllowedEmailDomains []string        // If set, JIT only accepts these exact email domains
	JITDomainOrgMap        []ClaimMapEntry // email domain → organization name or UUID; also an allowlist when AllowedEmailDomains is empty
	RoleClaim              string          // Dotted claim path for role mapping (e.g. groups, realm_access.roles)
	RoleMap                []ClaimMapEntry // claim value → IPAM role (user or admin)
	OrgClaim               string          // Dotted claim path for organization mapping
	OrgMap                 []ClaimMapEntry // claim value → organization name or UUID
}