config

type CORSConfig struct {
	AllowOrigins     []string
	AllowMethods     []string
	AllowHeaders     []string
	ExposeHeaders    []string
	AllowCredentials bool
	MaxAge           string
}

type CacheConfig struct {
	LocalTTL time.Duration
}

type CatalogConfig struct {
	ModelsDevBaseURL string
}

type Config struct {
	AppEnv           string
	Server           ServerConfig
	Database         DatabaseConfig
	Redis            RedisConfig
	Cache            CacheConfig
	SessionStore     SessionStoreConfig
	Kafka            KafkaConfig
	Telemetry        TelemetryConfig
	Metrics          MetricsConfig
	Playground       PlaygroundConfig
	Upstream         UpstreamConfig
	Provider         ProviderConfig
	Catalog          CatalogConfig
	CORS             CORSConfig
	Logger           LoggerConfig
	TrustGuard       TrustGuardConfig
	OpenAIModeration OpenAIModerationConfig
}

type DatabaseConfig struct {
	Host              string
	Port              int
	User              string
	Password          string // #nosec G117 -- config struct field, not a hardcoded credential
	Name              string
	SSLMode           string
	SSLRootCert       string
	MinConns          int32
	MaxConns          int32
	MaxConnLifetime   time.Duration
	MaxConnIdleTime   time.Duration
	HealthCheckPeriod time.Duration
	ConnectTimeout    time.Duration
}

type KafkaConfig struct {
	Brokers []string
}

type LoggerConfig struct {
	Level  slog.Level
	Format string
}

type MetricsConfig struct {
	Enabled       bool
	QueueSize     int
	WorkerCount   int
	FlushInterval time.Duration
}

type OTLPConfig struct {
	Endpoint    string
	Headers     map[string]string
	Protocol    string
	Timeout     time.Duration
	Insecure    bool
	Compression string
}

type OpenAIModerationConfig struct {
	BaseURL string
	Timeout time.Duration
}

type PlaygroundConfig struct {
	TraceStoreEnabled bool
	TraceStoreTTL     time.Duration
}

type ProviderConfig struct {
	RequestTimeout time.Duration
	MaxRetries     int
}

type RedisConfig struct {
	Host              string
	Port              int
	Password          string
	DB                int
	TLSEnabled        bool
	TLSInsecureVerify bool
}

type ServerConfig struct {
	AdminPort    int
	ProxyPort    int
	MCPPort      int
	ReadTimeout  time.Duration
	WriteTimeout time.Duration
	IdleTimeout  time.Duration
	// SecretKey signs and verifies admin-plane JWTs. Empty disables admin auth
	// token acceptance (every token is rejected).
	SecretKey            string
	GatewayBaseDomain    string
	MCPBaseDomain        string
	GatewayDiscoveryMode string
	STSIssuer            string
	STSSigningKey        string
	TrustXFCCFrom        []string
}

type SessionStoreConfig struct {
	Enabled bool
	TTL     time.Duration
}

type TelemetryConfig struct {
	Enabled             bool
	KafkaTopic          string
	EnableRequestTraces bool
	EnablePluginTraces  bool
	OTLP                OTLPConfig
}

type TrustGuardConfig struct {
	BaseURL      string
	Timeout      time.Duration
	ClientID     string
	ClientSecret string
}

type UpstreamConfig struct {
	Timeout          time.Duration
	ErrorPassthrough bool
}