server

type AccountReader interface {
	GetByID(ctx context.Context, id string) (account.Record, error)
}

type AuthMiddleware struct {
	// contains filtered or unexported fields
}

type CORSConfig struct {
	// AllowedOrigins is a list of origins a cross-domain request can be executed from
	AllowedOrigins []string `env:"CORS_ALLOWED_ORIGINS,default=*"`

	// AllowedMethods is a list of methods the client is allowed to use with cross-domain requests
	AllowedMethods []string `env:"CORS_ALLOWED_METHODS,default=GET,POST,PUT,DELETE,OPTIONS"`

	// AllowedHeaders is list of non simple headers the client is allowed to use with cross-domain requests
	AllowedHeaders []string `env:"CORS_ALLOWED_HEADERS,default=Accept,Authorization,Content-Type,X-CSRF-Token"`

	// ExposedHeaders indicates which headers are safe to expose to the API of a CORS API specification
	ExposedHeaders []string `env:"CORS_EXPOSED_HEADERS,default="`

	// AllowCredentials indicates whether the request can include user credentials
	AllowCredentials bool `env:"CORS_ALLOW_CREDENTIALS,default=true"`

	// MaxAge indicates how long (in seconds) the results of a preflight request can be cached
	MaxAge int `env:"CORS_MAX_AGE,default=300"`
}

type Config struct {
	// Port to listen on
	Port int `env:"PORT,default=8080"`

	// Host to bind to
	Host string `env:"HOST,default=0.0.0.0"`

	// Read and write timeouts
	ReadTimeout  time.Duration `env:"READ_TIMEOUT,default=10s"`
	WriteTimeout time.Duration `env:"WRITE_TIMEOUT,default=10s"`
	IdleTimeout  time.Duration `env:"IDLE_TIMEOUT,default=120s"`

	// Request timeout for middleware
	RequestTimeout time.Duration `env:"REQUEST_TIMEOUT,default=60s"`

	// Shutdown timeout
	ShutdownTimeout time.Duration `env:"SHUTDOWN_TIMEOUT,default=30s"`

	// MaxRequestSize is the largest request body the gateway reads, in bytes.
	// Application composition supplies it from the loaded configuration, so
	// this field carries no environment tag: a tag here would state a default
	// that never reads the environment and would drift from the real one.
	MaxRequestSize int64

	// MaxFileUploadSize is the largest file upload the gateway accepts, in
	// bytes. It carries no environment tag for the same reason MaxRequestSize
	// does not: application composition supplies it from the loaded file
	// configuration, and a tag here would state a second default that never
	// reads the environment.
	MaxFileUploadSize int64

	// Maximum aggregate size of HTTP request headers.
	MaxHeaderBytes int `env:"MAX_HEADER_BYTES,default=1048576"`

	// Rate limiting configuration. Enforcement happens after API key
	// authentication and uses the authenticated API key ID, not the raw secret.
	EnableRateLimiting         bool          `env:"ENABLE_RATE_LIMITING,default=false"`
	RateLimitRequestsPerWindow int64         `env:"RATE_LIMIT_REQUESTS_PER_WINDOW,default=0"`
	RateLimitWindow            time.Duration `env:"RATE_LIMIT_WINDOW,default=1m"`

	// AuthMode selects whether a request must carry a gateway API key. It is
	// the mode the gateway starts under; the console can change the running
	// mode afterwards, and the middleware reads the live policy rather than
	// this field.
	AuthMode authmode.Mode

	// AuthModeSource names where AuthMode came from, so the startup banner and
	// the console can say which thing an operator has to change.
	AuthModeSource authmode.Source

	// AuthModeStore persists a mode the console sets, so the change outlives
	// the process that accepted it. A nil store means the mode cannot be
	// changed at runtime, and the switch reports that rather than accepting a
	// change it would forget.
	AuthModeStore authmode.Repository

	// UnauthenticatedScopes lists the scopes a request holds while the running
	// mode is disabled. An empty list means apikey.DefaultAnonymousScopes.
	UnauthenticatedScopes []string

	// AllowRemoteNoAuth is the operator's acknowledgment that an
	// unauthenticated gateway may bind an address the network can reach. It is
	// the same acknowledgment startup validation reads, and the runtime switch
	// reads it for the same reason.
	AllowRemoteNoAuth bool

	// MetricsMode states who may read GET /metrics: MetricsModeOn serves
	// every caller, MetricsModeAdmin requires the admin scope, and
	// MetricsModeOff removes the route. Application composition supplies it
	// from the loaded telemetry configuration; an empty value reads as on,
	// so a hand-built server serves the scrape the way a deployment does by
	// default.
	MetricsMode string

	// Build is the provenance of the running binary, which the health and
	// admin surfaces report. Application composition supplies it from the
	// linker-stamped values; a hand-built server reports an unstamped build.
	Build controllers.BuildInfo

	// CORS configuration
	CORS CORSConfig
}

type Dependencies struct {
	Service            proxy.Proxy
	APIKeys            apikey.Repository
	Accounts           account.Repository
	ProviderKeys       keyring.ProviderKeys
	RateLimits         ratelimit.Repository
	ProviderOperations controllers.ProviderOperations
	Console            console.PageServer
	// Usage serves recorded request activity. A nil repository degrades
	// the activity and metrics endpoints to 503, loudly.
	Usage usage.Repository
	// Catalog serves snapshot freshness, diffs, and forced acquisition. A
	// nil port degrades the catalog endpoints to 503, loudly.
	Catalog controllers.CatalogOperations
	// Presets serves stored preset management. A nil repository degrades
	// the preset endpoints to 503, loudly.
	Presets presets.Repository
	// Templates serves account templates: the named creation defaults an
	// account can be stamped from. A nil repository degrades the template
	// endpoints to 503, loudly.
	Templates account.TemplateRepository
	// Files serves the stored file surface. A nil service degrades the file
	// endpoints to 503, loudly: the routes stay registered so a caller reads
	// that this deployment configured no file storage rather than that the
	// gateway has no files API.
	Files *files.Service
	// Jobs serves work that outlives its request. A nil service degrades the
	// video endpoints to 503, loudly, for the same reason a nil file service
	// does: the routes stay registered so a caller reads that this deployment
	// configured no job store rather than that the gateway has no video API.
	Jobs *jobs.Service
	// Batches serves the batch surface. A nil service degrades the batch
	// endpoints to 503, loudly, for the same reason a nil job service does.
	Batches *jobs.BatchService

	// FileBackend names the blob backend behind that service, for the admin
	// surface to report. An empty name reads as no file storage at all.
	FileBackend string
	// LocalGate redeems console launch tickets and verifies console sessions
	// against this machine's local admin token. A nil gate refuses every
	// launch and every session cookie, which is the right answer for a
	// gateway assembled without one: the bearer key path is unaffected.
	LocalGate *localauth.Gate
	// IdentityAuth is the OAuth acquisition path, or nil when this
	// deployment configured no identity provider. The identity routes stay
	// mounted either way and refuse with the operator's answer when nil.
	IdentityAuth controllers.IdentityAuthenticator
	// Identity holds the durable people plane: users, teams, memberships,
	// and account grants. Zero repositories — no identity provider configured —
	// degrade the members and teams endpoints to 503, loudly, so the
	// console reads "not configured" rather than "nobody is here".
	Identity identity.Repositories
	// Telemetry serves the Prometheus scrape and counts budget refusals. A
	// nil surface removes the /metrics route and observes nothing, which is
	// what a deployment that turned metrics off gets.
	Telemetry *telemetry.Metrics

	// Tracing starts the request span and hands the tracer to the routing and
	// execution seams. A nil tracer disables tracing without a guard anywhere
	// else.
	Tracing *telemetry.Tracing

	// Audit records admin mutations and serves the trail back. A nil trail
	// records nothing and degrades the audit listing to 503, loudly.
	Audit controllers.AuditTrail

	// Events pushes budget and key lifecycle events to the configured
	// webhook endpoints. A nil emitter pushes nothing, which is the
	// deployment with no endpoint configured.
	Events controllers.EventEmitter

	// Webhooks reports the delivery state of that surface for the admin
	// summary. A nil reporter reads as webhooks off.
	Webhooks controllers.WebhookReporter

	// Deployment is what the admin surface states about the configured
	// storage, telemetry, guardrail, and retention settings.
	Deployment controllers.Deployment
}

type Server struct {
	// contains filtered or unexported fields
}