stdtemporalcodecfx

type Config struct {
	// Enabled toggles KMS encryption of Temporal payloads. When false a
	// pass-through DataConverter is provided so local development works
	// without KMS. Default false.
	Enabled bool `env:"ENABLED"`

	// KMSKeyID is the KMS key ARN or alias used to generate data keys.
	// Required when Enabled is true.
	KMSKeyID string `env:"KMS_KEY_ID"`

	// Namespace is the Temporal namespace this client/worker operates in.
	// It is bound into the KMS EncryptionContext to enforce cryptographic
	// tenant isolation. Required when Enabled is true.
	Namespace string `env:"NAMESPACE"`
}

type Params struct {
	fx.In

	Config    Config
	AWSConfig aws.Config `optional:"true"`
	// KMS is an optional override for the KMS client. When nil the codec
	// uses kms.NewFromConfig(AWSConfig). Tests supply a fake here.
	KMS stdtemporalcodec.KMS `optional:"true"`
}

type Result struct {
	fx.Out

	// DataConverter is suitable for installing on a Temporal client.
	// stdtemporalfx already consumes it as an optional dependency.
	DataConverter converter.DataConverter
}

type ServerConfig struct {
	// KMSKeyID is the KMS key ARN/alias the codec uses to wrap data keys.
	// Required.
	KMSKeyID string `env:"KMS_KEY_ID,required"`

	// AllowedNamespaces lists the Temporal namespaces this server will
	// service. Requests bearing any other (normalized) namespace are
	// rejected with 403 Forbidden. If empty, all requests are rejected.
	AllowedNamespaces []string `env:"ALLOWED_NAMESPACES" envSeparator:","`

	// StripCloudSuffix toggles the StripCloudAccountSuffix normalizer
	// (which trims everything after the last dot in X-Namespace). Defaults
	// to true so the handler works out of the box with the Temporal Cloud
	// Web UI.
	StripCloudSuffix bool `env:"STRIP_CLOUD_SUFFIX" envDefault:"true"`
}

type ServerParams struct {
	fx.In

	Config    ServerConfig
	Logger    *zap.Logger
	AWSConfig aws.Config `optional:"true"`
	// KMS is an optional override for the KMS client. When nil the server
	// uses kms.NewFromConfig(AWSConfig). Tests supply a fake here.
	KMS stdtemporalcodec.KMS `optional:"true"`
}

type ServerResult struct {
	fx.Out

	// Handler is the codec server handler, exposing POST /encode and
	// POST /decode (suffix-matched so it can be mounted anywhere).
	Handler http.Handler `name:"codec"`
}