config

type AccessPolicy struct {
	AllowedEmailEnabled bool `env:"AUTHARA_ACCESS_POLICY_ALLOWLIST_ENABLED,default=false"`
}

type Admin struct {
	AuditRetentionDays   int           `env:"AUTHARA_ADMIN_AUDIT_RETENTION_DAYS,default=180"`
	AuditCleanupInterval time.Duration `env:"AUTHARA_ADMIN_AUDIT_CLEANUP_INTERVAL,default=24h"`
}

type AdminPolicy struct {
	AuditRetention time.Duration
}

type AdminPolicyReader interface {
	CurrentAdmin() AdminPolicy
}

type AdminPolicyReaderFunc func() AdminPolicy

type AllowlistPolicy struct {
	AllowlistEnabled bool
}

type AllowlistPolicyReader interface {
	CurrentAllowlist() AllowlistPolicy
}

type AllowlistPolicyReaderFunc func() AllowlistPolicy

type Authentication struct {
	UsernameLoginEnabled      bool   `env:"AUTHARA_USERNAME_LOGIN_ENABLED,default=false"`
	EmailVerificationRequired bool   `env:"AUTHARA_EMAIL_VERIFICATION_REQUIRED,default=false"`
	PasswordMinimumLength     int    `env:"AUTHARA_PASSWORD_MIN_LENGTH,default=8"`
	PasskeyCloneResponse      string `env:"AUTHARA_PASSKEY_CLONE_RESPONSE,default=alert"`
	PasskeyCloneNotifyUser    bool   `env:"AUTHARA_PASSKEY_CLONE_NOTIFY_USER,default=true"`
}

type AuthenticationPolicy struct {
	UsernameLoginEnabled      bool
	EmailVerificationRequired bool
	PasskeyCloneResponse      string
	PasskeyCloneNotifyUser    bool
}

type AuthenticationPolicyReader interface {
	CurrentAuthentication() AuthenticationPolicy
}

type AuthenticationPolicyReaderFunc func() AuthenticationPolicy

type Cache struct {
	Provider                  string `env:"AUTHARA_CACHE_PROVIDER,default=noop"`
	AccessTokenRevocationMode string `env:"AUTHARA_ACCESS_TOKEN_REVOCATION_MODE"`
	RedisHost                 string `env:"AUTHARA_REDIS_HOST,default=localhost"`
	RedisPort                 int    `env:"AUTHARA_REDIS_PORT,default=6379"`
	RedisPassword             string `env:"AUTHARA_REDIS_PASSWORD"`
	RedisDB                   int    `env:"AUTHARA_REDIS_DB,default=0"`
}

type Challenge struct {
	Enabled             bool          `env:"AUTHARA_CHALLENGE_ENABLED,default=false"`
	TTL                 time.Duration `env:"AUTHARA_CHALLENGE_TTL,default=30m"`
	VerificationCodeTTL time.Duration `env:"AUTHARA_CHALLENGE_VERIFICATION_CODE_TTL,default=10m"`
	MaxAttempts         int           `env:"AUTHARA_CHALLENGE_MAX_ATTEMPTS,default=5"`
	MaxResends          int           `env:"AUTHARA_CHALLENGE_MAX_RESENDS,default=3"`
	MinResendInterval   time.Duration `env:"AUTHARA_CHALLENGE_MIN_RESEND_INTERVAL,default=30s"`
}

type ChallengePolicy struct {
	Enabled               bool
	TTL                   time.Duration
	VerificationCodeTTL   time.Duration
	MaxAttempts           int
	MaxResends            int
	MinimumResendInterval time.Duration
}

type ChallengePolicyReader interface {
	CurrentChallenge() ChallengePolicy
}

type Config struct {
	Values         Values
	DB             DB
	Cache          Cache
	Logging        Logging
	Observability  Observability
	UI             UI
	OAuth          OAuth
	Token          Token
	Session        Session
	RateLimit      RateLimit
	Webhook        Webhook
	AccessPolicy   AccessPolicy
	Admin          Admin
	OperatorAudit  OperatorAudit
	InternalAPI    InternalAPI
	Organization   Organization
	Authentication Authentication
	SecurityEvents SecurityEvents
	Challenge      Challenge
	Email          Email
}

type Control string

type DB struct {
	Host        string `env:"POSTGRESQL_HOST,required"`
	Port        int    `env:"POSTGRESQL_PORT,required"`
	Username    string `env:"POSTGRESQL_USERNAME,required"`
	Password    string `env:"POSTGRESQL_PASSWORD,required"`
	Database    string `env:"POSTGRESQL_DATABASE,required"`
	Timezone    string `env:"POSTGRESQL_TIMEZONE,default=UTC"`
	LogSQL      bool   `env:"POSTGRESQL_LOG_SQL,default=false"`
	SSLMode     string `env:"POSTGRESQL_SSL_MODE,default=disable"`
	SSLRootCert string `env:"POSTGRESQL_SSL_ROOT_CERT"`

	MaxOpenConns    int           `env:"AUTHARA_DB_MAX_OPEN_CONNS,default=40"`
	MaxIdleConns    int           `env:"AUTHARA_DB_MAX_IDLE_CONNS,default=20"`
	ConnMaxLifetime time.Duration `env:"AUTHARA_DB_CONN_MAX_LIFETIME,default=30m"`
	ConnMaxIdleTime time.Duration `env:"AUTHARA_DB_CONN_MAX_IDLE_TIME,default=5m"`
}

type Definition struct {
	Key          Key
	Name         string
	Description  string
	Environment  string
	Control      Control
	Reload       Reload
	Sensitive    bool
	Group        string
	Type         ValueType
	DefaultValue string
	Required     bool
	HasDefault   bool
	Minimum      string
	Maximum      string
	Allowed      []string
	Impact       string
	// contains filtered or unexported fields
}

type Description struct {
	Definition
	EffectiveValue    string
	EffectiveSource   Source
	Locked            bool
	PersistedOverride *string
	Revision          int64
	DormantOverride   bool
}

type Email struct {
	Provider string `env:"AUTHARA_EMAIL_PROVIDER,default=noop"`
	From     string `env:"AUTHARA_EMAIL_FROM"`

	SMTPHost     string        `env:"AUTHARA_EMAIL_SMTP_HOST"`
	SMTPPort     int           `env:"AUTHARA_EMAIL_SMTP_PORT,default=587"`
	SMTPUsername string        `env:"AUTHARA_EMAIL_SMTP_USERNAME"`
	SMTPPassword string        `env:"AUTHARA_EMAIL_SMTP_PASSWORD"`
	SMTPTLS      bool          `env:"AUTHARA_EMAIL_SMTP_TLS,default=true"`
	SMTPTimeout  time.Duration `env:"AUTHARA_EMAIL_SMTP_TIMEOUT,default=10s"`

	WorkerCount          int           `env:"AUTHARA_EMAIL_WORKER_COUNT,default=2"`
	WorkerPollInterval   time.Duration `env:"AUTHARA_EMAIL_WORKER_POLL_INTERVAL,default=2s"`
	JobMaxAttempts       int           `env:"AUTHARA_EMAIL_JOB_MAX_ATTEMPTS,default=100"`
	ProcessingStaleAfter time.Duration `env:"AUTHARA_EMAIL_PROCESSING_STALE_AFTER,default=2m"`
	StaleReaperInterval  time.Duration `env:"AUTHARA_EMAIL_STALE_REAPER_INTERVAL,default=1m"`
	MaintenanceBatchSize int           `env:"AUTHARA_EMAIL_MAINTENANCE_BATCH_SIZE,default=1000"`
	CleanupSentAfter     time.Duration `env:"AUTHARA_EMAIL_CLEANUP_SENT_AFTER,default=720h"`    // 30d
	CleanupFailedAfter   time.Duration `env:"AUTHARA_EMAIL_CLEANUP_FAILED_AFTER,default=2160h"` // 90d
	CleanupInterval      time.Duration `env:"AUTHARA_EMAIL_CLEANUP_INTERVAL,default=1h"`
}

type EmailPolicy struct {
	JobMaxAttempts     int
	CleanupSentAfter   time.Duration
	CleanupFailedAfter time.Duration
}

type EmailPolicyReader interface {
	CurrentEmail() EmailPolicy
}

type EmailPolicyReaderFunc func() EmailPolicy

type EnvironmentVariable struct {
	Name        string
	DisplayName string
	Group       string
	Type        string
	Default     string
	Required    bool
	HasDefault  bool
	Sensitive   bool
}

type InternalAPI struct {
	Token string `env:"AUTHARA_INTERNAL_API_TOKEN"`
}

type Key = configruntime.Key

type Logging struct {
	Level string `env:"LOG_LEVEL"`
}

type Mutation = configruntime.Mutation

type OAuth struct {
	Providers []string `env:"AUTHARA_OAUTH_PROVIDERS"`

	GoogleClientID     string `env:"AUTHARA_OAUTH_GOOGLE_CLIENT_ID"`
	GoogleClientSecret string `env:"AUTHARA_OAUTH_GOOGLE_CLIENT_SECRET"`
	MicrosoftClientID  string `env:"AUTHARA_OAUTH_MICROSOFT_CLIENT_ID"`
	MicrosoftTenantID  string `env:"AUTHARA_OAUTH_MICROSOFT_TENANT_ID"`

	AppleClientID         string            `env:"AUTHARA_OAUTH_APPLE_CLIENT_ID"`
	AppleTeamID           string            `env:"AUTHARA_OAUTH_APPLE_TEAM_ID"`
	AppleKeyID            string            `env:"AUTHARA_OAUTH_APPLE_KEY_ID"`
	ApplePrivateKeyBase64 string            `env:"AUTHARA_OAUTH_APPLE_PRIVATE_KEY_BASE64"`
	AppleTokenActiveKeyID string            `env:"AUTHARA_OAUTH_APPLE_TOKEN_ACTIVE_KEY_ID"`
	AppleTokenKeys        map[string]string `env:"AUTHARA_OAUTH_APPLE_TOKEN_KEYS"`
	ApplePrivateKey       *ecdsa.PrivateKey
	AppleDecodedTokenKeys map[string][]byte
}

type Observability struct {
	Enabled bool `env:"AUTHARA_METRICS_ENABLED,default=false"`
}

type OperatorAudit struct {
	RetentionDays int `env:"AUTHARA_OPERATOR_AUDIT_RETENTION_DAYS,default=180"`
}

type Organization struct {
	Mode                                string `env:"AUTHARA_ORG_MODE,default=single"`
	PublicOrganizationManagementEnabled bool   `env:"AUTHARA_PUBLIC_ORGANIZATION_MANAGEMENT_ENABLED,default=false"`
	InvitationTTLRaw                    string `env:"AUTHARA_ORGANIZATION_INVITATION_TTL,default=168h"`

	InvitationTTL time.Duration
}

type OrganizationPolicy struct {
	PublicManagementEnabled bool
	InvitationTTL           time.Duration
}

type OrganizationPolicyReader interface {
	CurrentOrganization() OrganizationPolicy
}

type OrganizationPolicyReaderFunc func() OrganizationPolicy

type PersistedOverride = configruntime.PersistedOverride

type PersistedState = configruntime.PersistedState

type RateLimit struct {
	LoginIPLimit        int    `env:"AUTHARA_RATE_LIMIT_LOGIN_IP_LIMIT,default=5"`
	LoginIPWindowRaw    string `env:"AUTHARA_RATE_LIMIT_LOGIN_IP_WINDOW,default=1m"`
	LoginEmailLimit     int    `env:"AUTHARA_RATE_LIMIT_LOGIN_EMAIL_LIMIT,default=10"`
	LoginEmailWindowRaw string `env:"AUTHARA_RATE_LIMIT_LOGIN_EMAIL_WINDOW,default=1h"`

	SignupIPLimit        int    `env:"AUTHARA_RATE_LIMIT_SIGNUP_IP_LIMIT,default=3"`
	SignupIPWindowRaw    string `env:"AUTHARA_RATE_LIMIT_SIGNUP_IP_WINDOW,default=1h"`
	SignupEmailLimit     int    `env:"AUTHARA_RATE_LIMIT_SIGNUP_EMAIL_LIMIT,default=3"`
	SignupEmailWindowRaw string `env:"AUTHARA_RATE_LIMIT_SIGNUP_EMAIL_WINDOW,default=24h"`

	PasswordResetIPLimit        int    `env:"AUTHARA_RATE_LIMIT_PASSWORD_RESET_IP_LIMIT,default=5"`
	PasswordResetIPWindowRaw    string `env:"AUTHARA_RATE_LIMIT_PASSWORD_RESET_IP_WINDOW,default=1h"`
	PasswordResetEmailLimit     int    `env:"AUTHARA_RATE_LIMIT_PASSWORD_RESET_EMAIL_LIMIT,default=3"`
	PasswordResetEmailWindowRaw string `env:"AUTHARA_RATE_LIMIT_PASSWORD_RESET_EMAIL_WINDOW,default=24h"`

	PasskeyLoginIPLimit     int    `env:"AUTHARA_RATE_LIMIT_PASSKEY_LOGIN_IP_LIMIT,default=30"`
	PasskeyLoginIPWindowRaw string `env:"AUTHARA_RATE_LIMIT_PASSKEY_LOGIN_IP_WINDOW,default=10m"`

	ChallengeVerifyIPLimit     int    `env:"AUTHARA_RATE_LIMIT_CHALLENGE_VERIFY_IP_LIMIT,default=30"`
	ChallengeVerifyIPWindowRaw string `env:"AUTHARA_RATE_LIMIT_CHALLENGE_VERIFY_IP_WINDOW,default=10m"`

	ChallengeResendIPLimit     int    `env:"AUTHARA_RATE_LIMIT_CHALLENGE_RESEND_IP_LIMIT,default=10"`
	ChallengeResendIPWindowRaw string `env:"AUTHARA_RATE_LIMIT_CHALLENGE_RESEND_IP_WINDOW,default=1h"`

	CleanupEvery int `env:"AUTHARA_RATE_LIMIT_CLEANUP_EVERY,default=200"`
	MaxEntries   int `env:"AUTHARA_RATE_LIMIT_MAX_ENTRIES,default=50000"`

	LoginIPWindow            time.Duration
	LoginEmailWindow         time.Duration
	SignupIPWindow           time.Duration
	SignupEmailWindow        time.Duration
	PasswordResetIPWindow    time.Duration
	PasswordResetEmailWindow time.Duration
	PasskeyLoginIPWindow     time.Duration
	ChallengeVerifyIPWindow  time.Duration
	ChallengeResendIPWindow  time.Duration
}

type RateLimitPolicy struct {
	LoginIPLimit     int
	LoginIPWindow    time.Duration
	LoginEmailLimit  int
	LoginEmailWindow time.Duration

	SignupIPLimit     int
	SignupIPWindow    time.Duration
	SignupEmailLimit  int
	SignupEmailWindow time.Duration

	PasswordResetIPLimit     int
	PasswordResetIPWindow    time.Duration
	PasswordResetEmailLimit  int
	PasswordResetEmailWindow time.Duration

	PasskeyLoginIPLimit  int
	PasskeyLoginIPWindow time.Duration

	ChallengeVerifyIPLimit  int
	ChallengeVerifyIPWindow time.Duration

	ChallengeResendIPLimit  int
	ChallengeResendIPWindow time.Duration

	CleanupEvery int
	MaxEntries   int
}

type Reload string

type RuntimeSettingsMetrics interface {
	SetRuntimeSettingsRevision(revision int64)
	ObserveRuntimeSettingsReconciliation(result string, duration time.Duration, revision int64)
}

type RuntimeSettingsStore interface {
	LoadRuntimeSettings(context.Context) (PersistedState, error)
	UpsertRuntimeSettingOverride(context.Context, Mutation) (PersistedOverride, error)
	DeleteRuntimeSettingOverride(context.Context, Key, int64, int64, uuid.UUID, json.RawMessage) (int64, error)
}

type SecurityEvents struct {
	EnabledEvents   []string      `env:"AUTHARA_SECURITY_EVENT_ENABLED_EVENTS"`
	RetentionDays   int           `env:"AUTHARA_SECURITY_EVENT_RETENTION_DAYS,default=180"`
	CleanupInterval time.Duration `env:"AUTHARA_SECURITY_EVENT_CLEANUP_INTERVAL,default=24h"`

	EnabledEventSet map[domain.SecurityEventType]struct{}
}

type Service struct {
	*Config
	// contains filtered or unexported fields
}

type ServiceOptions struct {
	Startup           *Config
	Store             RuntimeSettingsStore
	LookupEnvironment func(string) (string, bool)
	Environment       []EnvironmentVariable
	Logger            *slog.Logger
	ReconcileInterval time.Duration
	Metrics           RuntimeSettingsMetrics
}

type Session struct {
	SessionTTLDays                int           `env:"AUTHARA_SESSION_TTL_DAYS,default=60"`
	RefreshTokenTTLDays           int           `env:"AUTHARA_REFRESH_TOKEN_TTL_DAYS,default=14"`
	RefreshTokenRotationRaw       string        `env:"AUTHARA_REFRESH_TOKEN_ROTATION_INTERVAL,default=24h"`
	RecentAuthenticationEnabled   bool          `env:"AUTHARA_RECENT_AUTHENTICATION_ENABLED,default=true"`
	RecentAuthenticationWindowRaw string        `env:"AUTHARA_RECENT_AUTHENTICATION_WINDOW,default=10m"`
	CleanupInterval               time.Duration `env:"AUTHARA_SESSION_CLEANUP_INTERVAL,default=5m"`

	SessionTTL                 time.Duration
	RefreshTokenTTL            time.Duration
	RefreshTokenRotation       time.Duration
	RecentAuthenticationWindow time.Duration
}

type SessionCookiePolicy struct {
	AccessTokenTTL  time.Duration
	RefreshTokenTTL time.Duration
}

type SessionCookiePolicyReader interface {
	CurrentSessionCookies() SessionCookiePolicy
}

type SessionCookiePolicyReaderFunc func() SessionCookiePolicy

type SessionPolicy struct {
	SessionTTL                  time.Duration
	RefreshTokenTTL             time.Duration
	RefreshTokenRotation        time.Duration
	RecentAuthenticationEnabled bool
	RecentAuthenticationWindow  time.Duration
}

type SessionPolicyReader interface {
	CurrentSession() SessionPolicy
}

type SessionPolicyReaderFunc func() SessionPolicy

type Source string

type StaticChallengePolicy struct {
	Policy ChallengePolicy
}

type Token struct {
	Issuer                string            `env:"AUTHARA_JWT_ISSUER,required"`
	ActiveKeyID           string            `env:"AUTHARA_JWT_ACTIVE_KEY_ID,required"`
	Keys                  map[string]string `env:"AUTHARA_JWT_KEYS,required"`
	AccessTokenTTLMinutes int               `env:"AUTHARA_ACCESS_TOKEN_TTL_MINUTES,default=10"`

	AccessTokenTTL time.Duration
	KeySet         *token.KeySet
}

type TokenPolicy struct {
	AccessTokenTTL time.Duration
}

type TokenPolicyReader interface {
	CurrentToken() TokenPolicy
}

type TokenPolicyReaderFunc func() TokenPolicy

type UI struct {
	AppName         string `env:"AUTHARA_APP_NAME,default=Authara"`
	DefaultReturnTo string `env:"AUTHARA_DEFAULT_RETURN_TO,default=/"`
}

type UIPolicy struct {
	AppName         string
	DefaultReturnTo string
}

type UIPolicyReader interface {
	CurrentUI() UIPolicy
}

type UIPolicyReaderFunc func() UIPolicy

type ValueType string

type Values struct {
	AppEnv               string `env:"APP_ENV,default=dev"`
	PublicURL            string `env:"PUBLIC_URL,required"`
	TrustProxyHeaders    bool   `env:"AUTHARA_TRUST_PROXY_HEADERS,default=false"`
	TrustedProxyCIDRsRaw string `env:"AUTHARA_TRUSTED_PROXY_CIDRS"`

	HttpAddr string
}

type Webhook struct {
	URLRaw               string        `env:"AUTHARA_WEBHOOK_URL"`
	Secret               string        `env:"AUTHARA_WEBHOOK_SECRET"`
	EnabledEvents        []string      `env:"AUTHARA_WEBHOOK_ENABLED_EVENTS"`
	Timeout              time.Duration `env:"AUTHARA_WEBHOOK_TIMEOUT,default=5s"`
	WorkerCount          int           `env:"AUTHARA_WEBHOOK_WORKER_COUNT,default=2"`
	MaxDeliveryAttempts  int           `env:"AUTHARA_WEBHOOK_MAX_DELIVERY_ATTEMPTS,default=3"`
	ProcessingStaleAfter time.Duration `env:"AUTHARA_WEBHOOK_PROCESSING_STALE_AFTER,default=2m"`
	StaleReaperInterval  time.Duration `env:"AUTHARA_WEBHOOK_STALE_REAPER_INTERVAL,default=1m"`
	DeliveredRetention   time.Duration `env:"AUTHARA_WEBHOOK_DELIVERED_RETENTION,default=24h"`
	FailedRetention      time.Duration `env:"AUTHARA_WEBHOOK_FAILED_RETENTION,default=720h"`
	CleanupInterval      time.Duration `env:"AUTHARA_WEBHOOK_CLEANUP_INTERVAL,default=1h"`
	MaintenanceBatchSize int           `env:"AUTHARA_WEBHOOK_MAINTENANCE_BATCH_SIZE,default=1000"`

	URL             string
	EnabledEventSet map[string]struct{}
}

type WebhookPolicy struct {
	EnabledEvents        []string
	Timeout              time.Duration
	MaxDeliveryAttempts  int
	ProcessingStaleAfter time.Duration
	DeliveredRetention   time.Duration
	FailedRetention      time.Duration
	MaintenanceBatchSize int
}

type WebhookPolicyReader interface {
	CurrentWebhook() WebhookPolicy
}

type WebhookPolicyReaderFunc func() WebhookPolicy