stdtemporalcodecfx

type Config struct {
	// Enabled toggles encryption of Temporal payloads. When false a
	// pass-through DataConverter is provided so local development works
	// without a configured keyset. Default false.
	Enabled bool `env:"ENABLED"`

	// Keyset is the base64-encoded Tink keyset (JSON form). When
	// KeysetKEKURI is empty it must be a cleartext keyset; otherwise it
	// must be a keyset wrapped by the KEK at KeysetKEKURI. Required when
	// Enabled is true. It MUST match the value configured on the codec
	// server and on every other worker/client in the same namespace.
	Keyset string `env:"KEYSET"`

	// KeysetKEKURI optionally selects the keyset backend. Leave empty for
	// a cleartext keyset (local dev); set to e.g.
	// "aws-kms://arn:aws:kms:<region>:<acct>:key/<id>" to unwrap Keyset
	// via AWS KMS.
	KeysetKEKURI string `env:"KEYSET_KEK_URI"`

	// Namespace is the Temporal namespace this client/worker operates in.
	// It is bound into the AEAD additionalData to enforce cryptographic
	// tenant isolation. Required when Enabled is true.
	Namespace string `env:"NAMESPACE"`
}

type KMS interface {
	Encrypt(ctx context.Context, params *kms.EncryptInput, optFns ...func(*kms.Options)) (*kms.EncryptOutput, error)
	Decrypt(ctx context.Context, params *kms.DecryptInput, optFns ...func(*kms.Options)) (*kms.DecryptOutput, error)
}

type Params struct {
	fx.In

	Config Config

	// KMS is optional. When the configured keyset backend is AWS KMS and
	// no KMS is provided, a default *kms.Client constructed from the
	// ambient AWS SDK configuration is used. Tests inject a mock here.
	KMS KMS `optional:"true"`
}

type Result struct {
	fx.Out

	// DataConverter is suitable for installing on a Temporal client.
	// stdtemporalfx already consumes it as an optional dependency.
	DataConverter converter.DataConverter
}

type ServerConfig struct {
	// Enabled toggles the codec server. When false a stub handler that
	// responds 404 to every request is produced under the "codec" name
	// tag, so consumers can mount it unconditionally. Default false.
	Enabled bool `env:"ENABLED"`

	// Keyset is the base64-encoded Tink keyset (JSON form). When
	// KeysetKEKURI is empty it must be a cleartext keyset; otherwise it
	// must be a keyset wrapped by the KEK at KeysetKEKURI. Required when
	// Enabled is true. Must match the value used by every worker/client
	// whose payloads this server is expected to decode.
	Keyset string `env:"KEYSET"`

	// KeysetKEKURI mirrors Config.KeysetKEKURI for the server side.
	KeysetKEKURI string `env:"KEYSET_KEK_URI"`

	// AllowedNamespaces lists the Temporal namespaces this server will
	// service. Requests bearing any other (normalized) namespace are
	// rejected with 403 Forbidden. If empty, all requests are rejected.
	AllowedNamespaces []string `env:"ALLOWED_NAMESPACES" envSeparator:","`

	// StripCloudSuffix toggles the StripCloudAccountSuffix normalizer
	// (which trims everything after the last dot in X-Namespace). Defaults
	// to true so the handler works out of the box with the Temporal Cloud
	// Web UI.
	StripCloudSuffix bool `env:"STRIP_CLOUD_SUFFIX" envDefault:"true"`
}

type ServerParams struct {
	fx.In

	Config ServerConfig
	Logger *zap.Logger

	// KMS is optional. When the configured keyset backend is AWS KMS and
	// no KMS is provided, a default *kms.Client constructed from the
	// ambient AWS SDK configuration is used. Tests inject a mock here.
	KMS KMS `optional:"true"`
}

type ServerResult struct {
	fx.Out

	// Handler is the codec server handler, exposing POST /encode and
	// POST /decode (suffix-matched so it can be mounted anywhere).
	Handler http.Handler `name:"codec"`
}