config

type Config struct {
	Source Source `mapstructure:"source"`
	Dump   Dump   `mapstructure:"dump"`

	CopyTTLSeconds int          `mapstructure:"copy_ttl_seconds"`
	PortPoolStart  int          `mapstructure:"port_pool_start"`
	PortPoolEnd    int          `mapstructure:"port_pool_end"`
	WarmPoolSize   int          `mapstructure:"warm_pool_size"` // 0 = disabled (default)
	CopyImage      string       `mapstructure:"copy_image"`     // optional Docker image override
	DockerHost     string       `mapstructure:"docker_host"`    // optional Docker-compatible daemon host override
	Server         ServerConfig `mapstructure:"server"`
	Obfuscation    Obfuscation  `mapstructure:"obfuscation"`
}

type Dump struct {
	Schedule       string        `mapstructure:"schedule"`
	Path           string        `mapstructure:"path"`
	SchemaPath     string        `mapstructure:"schema_path"`     // optional: path for a schema-only (DDL) dump; empty = disabled
	StaleThreshold int           `mapstructure:"stale_threshold"` // seconds
	ClientImage    string        `mapstructure:"client_image"`    // optional helper image override for dump operations
	OnFailure      DumpOnFailure `mapstructure:"on_failure"`
}

type DumpOnFailure struct {
	WebhookURL string `mapstructure:"webhook_url"` // HTTP endpoint to POST a JSON failure payload
	Exec       string `mapstructure:"exec"`        // shell command to run on failure
}

type Obfuscation struct {
	Rules []ObfuscationRule `mapstructure:"rules"`
}

type ObfuscationRule struct {
	Table    string `mapstructure:"table"`
	Column   string `mapstructure:"column"`
	Strategy string `mapstructure:"strategy"`  // nullify | redact | mask | hash | replace
	With     string `mapstructure:"with"`      // redact: replacement text (default "[redacted]")
	MaskChar string `mapstructure:"mask_char"` // mask: character to use (default "*")
	KeepLast int    `mapstructure:"keep_last"` // mask: preserve trailing N characters
	Type     string `mapstructure:"type"`      // replace: data type — email | name | phone | ip | url | uuid
	WarnOnly bool   `mapstructure:"warn_only"` // if true, 0-row updates emit a warning instead of an error
}

type ServerAuthConfig struct {
	StaticToken string `mapstructure:"static_token"` // secret reference: env:VAR, file:/path, or literal
	Issuer      string `mapstructure:"issuer"`
	Audience    string `mapstructure:"audience"`
	JWKSURL     string `mapstructure:"jwks_url"`
	AdminClaim  string `mapstructure:"admin_claim"`
	AdminValue  string `mapstructure:"admin_value"`
}

type ServerConfig struct {
	Enabled          bool             `mapstructure:"enabled"`
	Addr             string           `mapstructure:"addr"`               // listen address, default ":8080"
	AdvertiseHost    string           `mapstructure:"advertise_host"`     // host/DNS name returned in remote DSNs
	DBBindHost       string           `mapstructure:"db_bind_host"`       // host interface used for published DB ports
	CopySecretSecret string           `mapstructure:"copy_secret_secret"` // secret reference used to derive per-copy credentials
	Auth             ServerAuthConfig `mapstructure:"auth"`
	DBTLS            ServerDBTLS      `mapstructure:"db_tls"`
}

type ServerDBTLS struct {
	CertFile string `mapstructure:"cert_file"`
	KeyFile  string `mapstructure:"key_file"`
}

type Source struct {
	URL            string `mapstructure:"url"` // DSN alternative to individual fields
	Engine         string `mapstructure:"engine"`
	Host           string `mapstructure:"host"`
	Port           int    `mapstructure:"port"`
	Database       string `mapstructure:"database"`
	User           string `mapstructure:"user"`
	Password       string `mapstructure:"password"`        // plain password (dev only)
	PasswordSecret string `mapstructure:"password_secret"` // secret reference: env:VAR, file:/path, or arn:aws:...
}