middleware

type AuthConfig struct {
	// Authenticate is the function that validates credentials and returns user info.
	// The token/key string is extracted from the request based on the scheme.
	// Return any user object to store in context, or error to reject.
	Authenticate func(ctx context.Context, token string) (any, error)

	// Scheme determines where to extract credentials from.
	// Default: "bearer"
	// Options: "bearer", "api-key"
	Scheme string

	// APIKeyHeader is the header name for API key auth.
	// Default: "X-API-Key"
	APIKeyHeader string

	// SkipPaths are paths that bypass authentication.
	SkipPaths map[string]bool

	// ErrorMessage is the message for unauthorized responses.
	// Default: "Authentication required"
	ErrorMessage string
}

type CORSConfig struct {
	// AllowOrigins is a list of allowed origins.
	// Use "*" to allow all origins (not recommended for production with credentials).
	// Default: []
	AllowOrigins []string

	// AllowMethods is a list of allowed HTTP methods.
	// Default: GET, POST, PUT, PATCH, DELETE, OPTIONS
	AllowMethods []string

	// AllowHeaders is a list of allowed request headers.
	// Default: Content-Type, Authorization, X-Request-ID
	AllowHeaders []string

	// ExposeHeaders is a list of headers the browser is allowed to access.
	// Default: X-Request-ID
	ExposeHeaders []string

	// AllowCredentials indicates whether credentials (cookies, auth headers) are allowed.
	// Default: false
	AllowCredentials bool

	// MaxAge is how long preflight results can be cached.
	// Default: 12 hours
	MaxAge time.Duration
}

type LoggerConfig struct {
	// Logger is the slog.Logger to use. Default: slog.Default()
	Logger *slog.Logger

	// Level is the default log level for successful requests. Default: slog.LevelInfo
	Level slog.Level

	// SkipPaths is a set of paths to skip logging for (e.g., health checks).
	SkipPaths map[string]bool

	// LogRequestBody logs the request body (use with caution — PII concerns).
	// Default: false
	LogRequestBody bool

	// LogResponseBody logs the response body.
	// Default: false
	LogResponseBody bool
}

type Middleware func(http.Handler) http.Handler

type RateLimitConfig struct {
	// Limiter is the rate limiting backend.
	// If nil, a default in-memory token bucket is used.
	Limiter RateLimiter

	// KeyFunc extracts the rate limit key from the request.
	// Default: uses client IP from RemoteAddr (safe).
	// Set TrustProxy to true if behind a reverse proxy.
	KeyFunc func(r *http.Request) string

	// TrustProxy enables reading client IP from X-Forwarded-For and X-Real-IP headers.
	// Only enable this if your server is behind a trusted reverse proxy.
	// Default: false (uses RemoteAddr only)
	TrustProxy bool

	// Rate is the number of requests allowed per window (for default limiter).
	// Default: 100
	Rate int

	// Window is the time window for the rate limit (for default limiter).
	// Default: 1 minute
	Window time.Duration

	// Message is the error message sent when rate limited.
	// Default: "Rate limit exceeded"
	Message string
}

type RateLimiter interface {
	// Allow checks if a request from the given key is allowed.
	// Returns true if allowed, false if rate limited.
	Allow(key string) bool
}

type RecoverConfig struct {
	// Logger is used to log panic details.
	// If nil, uses slog.Default().
	Logger *slog.Logger

	// EnableStackTrace includes the stack trace in logs.
	// Default: true
	EnableStackTrace bool

	// OnPanic is called when a panic is recovered.
	// If nil, a default handler is used.
	OnPanic func(w http.ResponseWriter, r *http.Request, recovered any)
}

type RequestIDConfig struct {
	// Header is the header to read/write the request ID.
	// Default: "X-Request-ID"
	Header string

	// Generator is a function that generates a new request ID.
	// Default: generates a random 16-byte hex string.
	Generator func() string

	// TrustProxy trusts the incoming X-Request-ID header if present.
	// If false, always generates a new ID.
	// Default: true
	TrustProxy bool
}

type SecurityHeadersConfig struct {
	// ContentTypeNosniff sets X-Content-Type-Options: nosniff
	// Default: true
	ContentTypeNosniff bool

	// XFrameOptions sets X-Frame-Options. Common values: DENY, SAMEORIGIN
	// Default: "DENY"
	XFrameOptions string

	// XSSProtection sets X-XSS-Protection.
	// Default: "1; mode=block"
	XSSProtection string

	// HSTSMaxAge sets Strict-Transport-Security max-age in seconds.
	// Set to 0 to disable. Default: 31536000 (1 year)
	HSTSMaxAge int

	// HSTSIncludeSubdomains adds includeSubDomains to HSTS.
	// Default: true
	HSTSIncludeSubdomains bool

	// ReferrerPolicy sets Referrer-Policy header.
	// Default: "strict-origin-when-cross-origin"
	ReferrerPolicy string

	// ContentSecurityPolicy sets Content-Security-Policy header.
	// Default: "" (not set)
	ContentSecurityPolicy string

	// PermissionsPolicy sets Permissions-Policy header.
	// Default: "" (not set)
	PermissionsPolicy string
}

type TokenBucket struct {
	// contains filtered or unexported fields
}