config

type CORSConfig struct {
	AllowOrigins     []string
	AllowMethods     []string
	AllowHeaders     []string
	ExposeHeaders    []string
	AllowCredentials bool
	MaxAge           string
}

type CacheConfig struct {
	LocalTTL time.Duration
}

type CatalogConfig struct {
	ModelsDevBaseURL string
}

type Config struct {
	AppEnv       string
	Server       ServerConfig
	Database     DatabaseConfig
	Redis        RedisConfig
	Cache        CacheConfig
	SessionStore SessionStoreConfig
	Kafka        KafkaConfig
	Telemetry    TelemetryConfig
	Metrics      MetricsConfig
	Playground   PlaygroundConfig
	Upstream     UpstreamConfig
	Provider     ProviderConfig
	Catalog      CatalogConfig
	CORS         CORSConfig
	Logger       LoggerConfig
}

type DatabaseConfig struct {
	Host              string
	Port              int
	User              string
	Password          string // #nosec G117 -- config struct field, not a hardcoded credential
	Name              string
	SSLMode           string
	SSLRootCert       string
	MinConns          int32
	MaxConns          int32
	MaxConnLifetime   time.Duration
	MaxConnIdleTime   time.Duration
	HealthCheckPeriod time.Duration
	ConnectTimeout    time.Duration
}

type KafkaConfig struct {
	Brokers []string
}

type LoggerConfig struct {
	Level  slog.Level
	Format string
}

type MetricsConfig struct {
	Enabled       bool
	QueueSize     int
	WorkerCount   int
	FlushInterval time.Duration
}

type OTLPConfig struct {
	Endpoint    string
	Headers     map[string]string
	Protocol    string
	Timeout     time.Duration
	Insecure    bool
	Compression string
}

type PlaygroundConfig struct {
	TraceStoreEnabled bool
	TraceStoreTTL     time.Duration
}

type ProviderConfig struct {
	RequestTimeout time.Duration
	MaxRetries     int
}

type RedisConfig struct {
	Host              string
	Port              int
	Password          string
	DB                int
	TLSEnabled        bool
	TLSInsecureVerify bool
}

type ServerConfig struct {
	AdminPort    int
	ProxyPort    int
	MCPPort      int
	ReadTimeout  time.Duration
	WriteTimeout time.Duration
	IdleTimeout  time.Duration
	// SecretKey signs and verifies admin-plane JWTs. Empty disables admin auth
	// token acceptance (every token is rejected).
	SecretKey            string
	GatewayBaseDomain    string
	MCPBaseDomain        string
	GatewayDiscoveryMode string
	STSIssuer            string
	STSSigningKey        string
	TrustXFCCFrom        []string
}

type SessionStoreConfig struct {
	Enabled bool
	TTL     time.Duration
}

type TelemetryConfig struct {
	Enabled             bool
	KafkaTopic          string
	EnableRequestTraces bool
	EnablePluginTraces  bool
	OTLP                OTLPConfig
}

type UpstreamConfig struct {
	Timeout          time.Duration
	ErrorPassthrough bool
}