securityx

type AuditConfig struct {
	Enabled bool   `json:"enabled" yaml:"enabled"`
	Backend string `json:"backend" yaml:"backend"`
	DSN     string `json:"dsn" yaml:"dsn"`
}

type AuthnBoundaryConfig struct {
	Enabled bool   `json:"enabled" yaml:"enabled"`
	Mode    string `json:"mode" yaml:"mode"`

	// Provider is descriptive. For Casdoor deployments use provider=casdoor and
	// mode=casdoor_jwt. The actual JWT verifier is OIDC/JWKS based and does not
	// require Casdoor client_secret.
	Provider string `json:"provider" yaml:"provider"`

	OIDC oidcx.Config `json:"oidc" yaml:"oidc"`

	// PrincipalJWT verifies IAM-issued Gateway -> backend identity assertions.
	// Business services only need mode=principal_jwt plus this shared secret.
	PrincipalJWT authn.PrincipalJWTConfig `json:"principal_jwt" yaml:"principal_jwt"`

	// InternalCall is required in gateway_trusted mode and is injected by
	// Gateway before forwarding requests to backend services.
	InternalCall authn.InternalServiceTokenConfig `json:"internal_call" yaml:"internal_call"`

	// CacheTTL enables optional token-hash -> Principal caching when a cache is
	// supplied. TTL is always capped by the JWT exp claim by authn.CachedAuthenticator.
	CacheTTL time.Duration `json:"cache_ttl_ns" yaml:"cache_ttl_ns"`

	AllowAnonymous bool `json:"allow_anonymous" yaml:"allow_anonymous"`
}

type AuthnBoundaryRuntime struct {
	Config              AuthnBoundaryConfig
	Authenticator       authn.Authenticator
	CredentialExtractor authnmw.CredentialExtractor
}

type AuthzConfig struct {
	Enabled     bool           `json:"enabled" yaml:"enabled"`
	Provider    string         `json:"provider" yaml:"provider"`
	DevAllowAll bool           `json:"dev_allow_all" yaml:"dev_allow_all"`
	SpiceDB     spicedb.Config `json:"spicedb" yaml:"spicedb"`
}

type Config struct {
	// Authn describes how inbound callers become authn.Principal values. It is
	// consumed by NewRuntime to build AuthnBoundaryRuntime.
	Authn AuthnBoundaryConfig `json:"authn" yaml:"authn"`

	// InternalCall is the Gateway -> backend trust-boundary secret. It is kept as
	// a top-level field because existing configs use security.internal_call. When
	// Authn.InternalCall is empty, NewRuntime copies this value into Authn.
	InternalCall authn.InternalServiceTokenConfig `json:"internal_call" yaml:"internal_call"`

	// Access controls per-operation short-circuits such as public endpoints and
	// bootstrap/self-service endpoints that skip SpiceDB but still require authn.
	Access accessx.AccessConfig `json:"access" yaml:"access"`

	Authz AuthzConfig `json:"authz" yaml:"authz"`
	Audit AuditConfig `json:"audit" yaml:"audit"`
}

type Runtime struct {
	Config Config

	AuthnBoundary      *AuthnBoundaryRuntime
	SkipPolicyResolver accessx.SkipPolicyResolver
}