casdoor

type AdminConfig struct {
	Enabled bool `json:"enabled" yaml:"enabled"`

	OrganizationName string `json:"organization_name" yaml:"organization_name"`
	ApplicationName  string `json:"application_name" yaml:"application_name"`
	ClientID         string `json:"client_id" yaml:"client_id"`
	ClientSecret     string `json:"client_secret" yaml:"client_secret"`

	JWTCertificate     string `json:"jwt_certificate" yaml:"jwt_certificate"`
	JWTCertificateFile string `json:"jwt_certificate_file" yaml:"jwt_certificate_file"`

	// Certificate is kept as a backward-compatible alias for JWTCertificate.
	Certificate string `json:"certificate" yaml:"certificate"`
}

type Client struct {
	// contains filtered or unexported fields
}

type Config struct {
	Endpoint string `json:"endpoint" yaml:"endpoint"`

	// Issuer is the trusted OIDC issuer expected in Casdoor JWTs. When empty,
	// Endpoint is used as a compatibility default. For application-specific
	// discovery this should match the issuer returned by that discovery document.
	Issuer string `json:"issuer" yaml:"issuer"`

	// DiscoveryURL and JWKSURL enable standard OIDC/JWKS verification. Prefer
	// these in Gateway and production deployments. JWTCertificate remains as a
	// static fallback for local/dev setups.
	DiscoveryURL string `json:"discovery_url" yaml:"discovery_url"`
	JWKSURL      string `json:"jwks_url" yaml:"jwks_url"`

	// Audience limits tokens to the expected Casdoor application/client IDs.
	// When empty, ClientID is used as the default audience.
	Audience []string `json:"audience" yaml:"audience"`

	// AllowedOwners optionally restricts accepted Casdoor organizations.
	AllowedOwners []string `json:"allowed_owners" yaml:"allowed_owners"`

	// AllowedAlgs limits JWT signing algorithms accepted from Casdoor.
	// Default: RS256, RS512, ES256, ES512.
	AllowedAlgs []string `json:"allowed_algs" yaml:"allowed_algs"`

	// JWKSCacheTTL controls local JWKS cache lifetime.
	JWKSCacheTTL time.Duration `json:"jwks_cache_ttl_ns" yaml:"jwks_cache_ttl_ns"`

	OrganizationName string `json:"organization_name" yaml:"organization_name"`
	ApplicationName  string `json:"application_name" yaml:"application_name"`
	ClientID         string `json:"client_id" yaml:"client_id"`
	ClientSecret     string `json:"client_secret" yaml:"client_secret"`

	// JWTCertificate is the PEM public certificate used by Casdoor SDK to verify
	// JWT access/id tokens signed by the Casdoor application cert.
	JWTCertificate     string `json:"jwt_certificate" yaml:"jwt_certificate"`
	JWTCertificateFile string `json:"jwt_certificate_file" yaml:"jwt_certificate_file"`

	// Certificate is kept as a backward-compatible alias for JWTCertificate.
	// Prefer jwt_certificate or jwt_certificate_file in new configs.
	Certificate string `json:"certificate" yaml:"certificate"`

	Admin AdminConfig `json:"admin" yaml:"admin"`

	HTTPClient *http.Client  `json:"-" yaml:"-"`
	Timeout    time.Duration `json:"timeout" yaml:"timeout"`

	// Logger is the component logger. If nil, casdoor uses logx.DefaultLogger().
	Logger logx.Logger `json:"-" yaml:"-"`

	// Metrics is the optional metrics manager for Casdoor backend HTTP calls.
	Metrics metricsx.Manager `json:"-" yaml:"-"`

	// MetricsEnabled controls whether Casdoor backend calls record metrics.
	MetricsEnabled bool `json:"metrics_enabled" yaml:"metrics_enabled"`
}