identityagent

type AdminServerConfig struct {
	Port         int
	Registry     *prometheus.Registry
	Version      string
	PprofEnabled bool

	ReadHeaderTimeout time.Duration
	ReadTimeout       time.Duration
	WriteTimeout      time.Duration
	IdleTimeout       time.Duration
	MaxHeaderBytes    int

	Recorder Recorder
	Logger   *slog.Logger
}

type Config struct {
	HTTPPort       int
	RequestTimeout time.Duration

	// HTTP server timeouts. RequestTimeout is the per-request handler-internal
	// budget enforced via context.WithTimeout; the four below are outer
	// listener-level bounds that absorb slow-client behavior and shut the
	// door on slow-header / slow-body / slow-read attacks.
	HTTPReadHeaderTimeout time.Duration
	HTTPReadTimeout       time.Duration
	HTTPWriteTimeout      time.Duration
	HTTPIdleTimeout       time.Duration

	// ShutdownGrace is the readiness-flip propagation window; ShutdownTimeout
	// is the hard ceiling on graceful shutdown after that window expires.
	// Together they must fit inside the orchestrator's terminationGracePeriod.
	ShutdownGrace   time.Duration
	ShutdownTimeout time.Duration

	// RequestBodyLimitBytes is the maximum POST /identity body size in
	// bytes. Anything larger is rejected at decode time.
	RequestBodyLimitBytes int

	// MaxHeaderBytes caps the total size of request headers. Goes onto
	// http.Server.MaxHeaderBytes; tighter than Go's 1 MiB default to
	// reject malformed bloat early.
	MaxHeaderBytes int

	// MaxOpenConnections caps the number of concurrently-accepted TCP
	// connections to the listener. New SYNs queue in the kernel backlog
	// once the cap is reached and are eventually rejected. Pair with the
	// container's file-descriptor ulimit.
	MaxOpenConnections int

	// ResponseTTL is the cache TTL hint returned to callers in
	// IdentityMatchResponse.ServeWindowSec.
	ResponseTTL time.Duration

	// StrictContentType rejects requests whose Content-Type is not
	// application/json with 415 Unsupported Media Type. Enabled by default
	// to close content-type confusion attacks; disable only for legacy
	// callers that send a different type.
	StrictContentType bool

	// AccessLogEnabled emits one structured INFO log line per request
	// (method, path, status, bytes, latency, request_id). Off by default
	// to avoid log-volume cost at 10k QPS; useful in staging or for
	// incident triage.
	AccessLogEnabled bool

	// AdminPort, when > 0, moves /metrics, /live, and /debug/pprof onto a
	// second HTTP listener on that port. /identity and /health stay on
	// HTTPPort — both are part of the TMP protocol surface that publisher
	// routers probe externally, so they MUST share the listener serving
	// /identity. When 0 (default) all endpoints share HTTPPort. Splitting
	// lets ops apply different network policies to observability vs the
	// public attack surface.
	AdminPort int

	// SupportedADCPMajorVersions enumerates the AdCP major versions this
	// agent accepts on inbound `adcp_major_version`. Requests carrying an
	// unsupported value are rejected with HTTP 400. Empty means "accept any
	// value" — but Validate rejects empty, so deployments must declare
	// support explicitly.
	SupportedADCPMajorVersions []int

	LogLevel string

	TMP             TMPConfig
	TMPX            TMPXConfig
	LiveRamp        LiveRampSidecarConfig
	IdentityConfig  IdentityConfigSourceConfig
	AudienceValkey  ValkeyBlock
	FCapValkey      ValkeyBlock
	AudienceTimeout time.Duration
	FCapTimeout     time.Duration

	Metrics MetricsConfig
	Pprof   PprofConfig
}

type DecodedIdentity struct {
	UIDType tmproto.UIDType
	Bytes   []byte
}

type IdentityCanonicalizer struct {
	// contains filtered or unexported fields
}

type IdentityConfigSourceConfig struct {
	URL                string
	Token              string
	Timeout            time.Duration
	RefreshInterval    time.Duration
	StartMode          string
	StartRetryDeadline time.Duration

	// ExtraHeaders are added to every outbound config-source request on top
	// of the headers the source manages itself (Authorization, Content-Type,
	// Accept). Loaded from CONFIG_SOURCE_EXTRA_HEADERS as a JSON object of
	// name→value pairs. Collisions with the managed headers are rejected by
	// the source constructor.
	ExtraHeaders map[string]string
}

type IdentityHandlerConfig struct {
	Service    *Service
	TMPXSealer *TMPXSealer
	// Canonicalizer decodes inbound IdentityToken.UserToken strings into
	// the canonical lowercase-hex key form audience/fcap services lookup
	// on. Construct via NewIdentityCanonicalizer (typically alongside
	// TMPXSealer) so the per-request decode pass runs once and feeds
	// both the shadow request and the TMPX seal step. Nil disables
	// canonicalization — the inbound request is forwarded to
	// service.Evaluate unmodified, preserving the legacy "publisher wire
	// string is the key" behavior.
	Canonicalizer    *IdentityCanonicalizer
	RequestTimeout   time.Duration
	RequestBodyLimit int64
	ResponseTTL      time.Duration
	// SupportedADCPMajorVersions enumerates the AdCP major versions this
	// agent will accept on inbound `adcp_major_version`. When the field is
	// present on a request and not in this set, the handler rejects with
	// HTTP 400 and ErrorCodeInvalidRequest. When the field is omitted, the
	// seller assumes its highest supported version (per the TMP schema).
	SupportedADCPMajorVersions []int
	Recorder                   Recorder
	Logger                     *slog.Logger
}

type LiveRampSidecar interface {
	MappedID(ctx context.Context, env string) (string, error)
}

type LiveRampSidecarConfig struct {
	URL         string
	Timeout     time.Duration
	DialTimeout time.Duration
}

type MetricsConfig struct {
	Enabled   bool
	Namespace string
}

type MetricsProvider struct {
	Registry *prometheus.Registry
	Recorder Recorder
	// contains filtered or unexported fields
}

type PprofConfig struct {
	Enabled bool
}

type RecipientKey = targeting.RecipientKey

type Recorder interface {
	RequestStarted(ctx context.Context)
	RequestCompleted(ctx context.Context, status string, d time.Duration)
	StageOutcome(ctx context.Context, stage, outcome string)
	StageDuration(ctx context.Context, stage string, d time.Duration)
	StoreError(ctx context.Context, store string)
	ConfigRefresh(ctx context.Context, outcome string)
	ShutdownPanic(ctx context.Context)
	HandlerPanic(ctx context.Context)
	BackgroundPanic(ctx context.Context, where string)

	// TmpxIdentityDrop records one inbound identity dropped from a TMPX
	// wire token. Distinguishes the drop reason and the UIDType so
	// operators can attribute "we're shipping zero RampIDs" to either a
	// LiveRamp outage (TmpxDropDecoderError on rampid) or no RampIDs in
	// inbound traffic (no metric ticks).
	TmpxIdentityDrop(ctx context.Context, reason, uidType string)

	// VerifiedIdentityDrop records one attestation/sealed-credential dropped
	// from the verified-identity stage, by reason. A verifier_error rate
	// makes a down/unwired verifier observable instead of indistinguishable
	// from organic absence (the spike's silent-degradation blast radius).
	VerifiedIdentityDrop(ctx context.Context, reason string)
}

type RunOption func(*runOptions)

type ServerConfig struct {
	Port            int
	IdentityHandler http.Handler
	KeyStore        tmproto.KeyStore
	OwnEndpointURL  string
	RequireSig      bool
	Registry        *prometheus.Registry
	IsRunning       func() bool
	Version         string
	PprofEnabled    bool

	ReadHeaderTimeout time.Duration
	ReadTimeout       time.Duration
	WriteTimeout      time.Duration
	IdleTimeout       time.Duration
	MaxHeaderBytes    int

	// AdminPort decides whether observability endpoints share the main
	// listener (=0) or split onto a second listener built by NewAdminServer
	// (>0). Callers that get an AdminPort > 0 must also instantiate the
	// admin server themselves; NewServer only signals whether to mount the
	// observability endpoints on the main mux.
	AdminPort int

	// Middleware knobs for the main mux. Match Config flags 1:1.
	StrictContentType bool
	AccessLogEnabled  bool

	Recorder Recorder
	Logger   *slog.Logger
}

type Service struct {
	// contains filtered or unexported fields
}

type ServiceConfig struct {
	Engine          *targeting.IdentityEngine
	FCap            *fcap.Service
	Audience        *audience.Service
	ConfigService   *identityconfig.Service
	FCapTimeout     time.Duration
	AudienceTimeout time.Duration
	Recorder        Recorder

	// Verifier validates attestations; nil disables the verified-identity
	// stage (fail-closed — attestations are treated as absent).
	Verifier targeting.AttestationVerifier
	// RecipientKeys maps audience_kid → the HPKE recipient key + the relying
	// party this deployment acts as for that audience. nil/empty disables the
	// stage. The values contain secret key material — never log this map.
	RecipientKeys map[string]RecipientKey
	// AgeResolver resolves a package's required age threshold by geo; nil
	// means no age gating.
	AgeResolver targeting.AgeResolver
	// RelyingPartyID is the RP this deployment acts as for in-band attestation
	// verification (req.Identities[].Attestation). Empty disables that carrier.
	RelyingPartyID string
}

type TMPConfig struct {
	RegistryURL    string
	OwnEndpointURL string
	AllowUnsigned  bool
}

type TMPXConfig struct {
	EncryptJWKSURL string
	EncryptJWKSTTL time.Duration
	Country        string
	Priority       string

	// MacroNames is the ordered list of ad-server macro slot names this
	// provider's TMPX response fills, matching the provider's registered
	// `tmpx_macros` (provider-registration.json). The sealer pairs the
	// sealed token with these names to populate IdentityMatchResponse's
	// `tmpx_macros[]`. When empty the response carries only the legacy
	// singular `tmpx` field (deprecated, removed in 4.0). Capped at 2 by
	// the spec; multi-chunk encoding is not yet implemented — when
	// configured with more than one name only the first slot is filled,
	// matching the single-slot deployment shape.
	MacroNames []string
}

type TMPXSealer struct {
	// contains filtered or unexported fields
}

type TmpxTokenDecoder interface {
	Decode(ctx context.Context, userToken string) ([]byte, error)
}

type ValkeyBlock struct {
	Enabled bool

	Mode     string
	Shards   map[string]string
	Username string
	Password string
	DB       int
	TLS      bool

	DialTimeout time.Duration
	ReadTimeout time.Duration
	PoolSize    int
}