httpserver

type AdminClient struct {
	ID            string    `json:"id"`
	RedirectURIs  []string  `json:"redirect_uris,omitempty"`
	GrantTypes    []string  `json:"grant_types,omitempty"`
	ResponseTypes []string  `json:"response_types,omitempty"`
	Scopes        []string  `json:"scopes,omitempty"`
	Public        bool      `json:"public"`
	CreatedAt     time.Time `json:"created_at"`
}

type AdminCondorConfigEntry struct {
	Key      string `json:"key"`
	Value    string `json:"value,omitempty"`
	Redacted bool   `json:"redacted,omitempty"`
}

type AdminCondorConfigResponse struct {
	Configured bool                     `json:"configured"`
	Entries    []AdminCondorConfigEntry `json:"entries"`
}

type AdminLogsResponse struct {
	Enabled bool                  `json:"enabled"`
	Entries []logging.BufferEntry `json:"entries"`
}

type AdminToken struct {
	Kind            string    `json:"kind"` // "access" or "refresh"
	SignaturePrefix string    `json:"signature_prefix"`
	ClientID        string    `json:"client_id"`
	Subject         string    `json:"subject,omitempty"`
	Scopes          []string  `json:"scopes,omitempty"`
	Active          bool      `json:"active"`
	RequestedAt     time.Time `json:"requested_at"`
	ExpiresAt       time.Time `json:"expires_at,omitempty"`
}

type AdvertiseRequest struct {
	Ad      *classad.ClassAd `json:"ad,omitempty"`       // Single ad (JSON body)
	Command string           `json:"command,omitempty"`  // Optional UPDATE command (e.g., "UPDATE_STARTD_AD")
	WithAck bool             `json:"with_ack,omitempty"` // Request acknowledgment
}

type AdvertiseResponse struct {
	Success   bool     `json:"success"`
	Message   string   `json:"message,omitempty"`
	Succeeded int      `json:"succeeded"`        // Number of ads successfully advertised
	Failed    int      `json:"failed"`           // Number of ads that failed
	Errors    []string `json:"errors,omitempty"` // Error messages for failed ads
}

type AuthMeResponse struct {
	Authenticated bool     `json:"authenticated"`
	Username      string   `json:"username,omitempty"`
	Groups        []string `json:"groups,omitempty"`
	IsAdmin       bool     `json:"is_admin"`
}

type CollectorAdsResponse struct {
	Ads []*classad.ClassAd `json:"ads"`
}

type Config struct {
	ListenAddr string // Address to listen on (e.g., ":8080")
	ScheddName string // Schedd name
	ScheddAddr string // Schedd address (e.g., "127.0.0.1:9618"). If empty, discovered from collector.
	UserHeader string // HTTP header to extract username from (optional)
	// UserHeaderTrustedProxies is the CIDR list from which UserHeader
	// is honored. See HandlerConfig.UserHeaderTrustedProxies for
	// full docs and the security rationale. Configurable via
	// HTTP_API_USER_HEADER_TRUSTED_PROXIES.
	UserHeaderTrustedProxies []string
	// UserHeaderTrustAnyUnsafe disables the trusted-proxy gate and
	// honors UserHeader from any source. Demo / test only — see
	// HandlerConfig.UserHeaderTrustAnyUnsafe. Configurable via
	// HTTP_API_USER_HEADER_TRUST_ANY.
	UserHeaderTrustAnyUnsafe bool
	SigningKeyPath           string              // Path to token signing key (optional, for token generation)
	TrustDomain              string              // Trust domain for token issuer (optional; only used if UserHeader is set)
	UIDDomain                string              // UID domain for generated token username (optional; only used if UserHeader is set)
	HTTPBaseURL              string              // Base URL for HTTP API (e.g., "http://localhost:8080") for generating file download links in MCP responses
	TLSCertFile              string              // Path to TLS certificate file (optional, enables HTTPS)
	TLSKeyFile               string              // Path to TLS key file (optional, enables HTTPS)
	TLSCACertFile            string              // Path to TLS CA certificate file (optional, for trusting self-signed certs)
	ReadTimeout              time.Duration       // HTTP read timeout (default: 30s)
	WriteTimeout             time.Duration       // HTTP write timeout (default: 30s)
	IdleTimeout              time.Duration       // HTTP idle timeout (default: 120s)
	Collector                *htcondor.Collector // Collector for metrics (optional)
	EnableMetrics            bool                // Enable /metrics endpoint (default: true if Collector is set)
	MetricsCacheTTL          time.Duration       // Metrics cache TTL (default: 10s)
	// MetricsPublic disables the API-key auth gate on /metrics.
	// Configurable via HTTP_API_METRICS_PUBLIC; see HandlerConfig.
	MetricsPublic  bool
	Logger         *logging.Logger // Logger instance (optional, creates default if nil)
	JupyterWorkDir string          // Per-instance scratch dir for JupyterLab submission artifacts; default <TempDir>/htcondor-api-jupyter

	// InteractiveExtraSubmit is an optional verbatim block of extra
	// HTCondor submit-file directives merged into every
	// interactive-terminal and Jupyter job. See
	// HandlerConfig.InteractiveExtraSubmit for the trust model and
	// full documentation. Configurable via
	// HTTP_API_INTERACTIVE_EXTRA_SUBMIT.
	InteractiveExtraSubmit string

	// Batch-submission template paths.
	TemplateGlobalPath string // Optional YAML file with operator-curated templates
	// TemplateUserStoreDBPath is deprecated; the templates store
	// shares the unified DBPath. Kept so existing callers compile.
	TemplateUserStoreDBPath string //nolint:unused // back-compat; ignored.
	EnableMCP               bool   // Enable MCP endpoints with OAuth2 (default: false)
	// DBPath is the unified SQLite database file. See HandlerConfig.DBPath.
	DBPath string
	// KEKFilePath enables envelope encryption for long-lived secrets
	// in the DB. See HandlerConfig.KEKFilePath.
	KEKFilePath string
	// OAuth2DBPath is the legacy name for DBPath; kept for back-compat.
	OAuth2DBPath        string
	OAuth2Issuer        string   // OAuth2 issuer URL (default: listen address)
	OAuth2ClientID      string   // OAuth2 client ID for SSO (optional)
	OAuth2ClientSecret  string   // OAuth2 client secret for SSO (optional)
	OAuth2AuthURL       string   // OAuth2 authorization URL for SSO (optional)
	OAuth2TokenURL      string   // OAuth2 token URL for SSO (optional)
	OAuth2RedirectURL   string   // OAuth2 redirect URL for SSO (optional)
	OAuth2UserInfoURL   string   // OAuth2 user info endpoint for SSO (optional)
	OAuth2Scopes        []string // OAuth2 scopes to request (default: ["openid", "profile", "email"])
	OAuth2UsernameClaim string   // Claim name for username in token (default: "sub")
	OAuth2GroupsClaim   string   // Claim name for groups in user info (default: "groups")
	// OAuth2AccessTokenLifespan / OAuth2RefreshTokenLifespan control how long the
	// embedded MCP issuer's tokens are valid. Zero means "use the package default"
	// (1h access, 30d refresh). RefreshTokenLifespan must be >= AccessTokenLifespan.
	OAuth2AccessTokenLifespan  time.Duration
	OAuth2RefreshTokenLifespan time.Duration
	MCPAccessGroup             string // Group required for any MCP access (empty = all authenticated)
	MCPReadGroup               string // Group required for read operations (empty = all have read)
	MCPWriteGroup              string // Group required for write operations (empty = all have write)
	MCPInstructions            string // Server-level instructions provided to all MCP agents (e.g., AP-specific guidance)
	WebUIAdminGroup            string // Group required for Web UI admin pages (empty disables admin UI). Configurable via HTTP_API_WEBUI_ADMIN_GROUP.
	EnableIDP                  bool   // Enable built-in IDP (always enabled in demo mode)
	// IDPDBPath is deprecated; the IDP shares the unified DBPath.
	IDPDBPath string //nolint:unused // back-compat; ignored.
	IDPIssuer string // IDP issuer URL (default: listen address)
	// IDPAccessTokenLifespan / IDPRefreshTokenLifespan: see OAuth2*Lifespan above.
	IDPAccessTokenLifespan  time.Duration
	IDPRefreshTokenLifespan time.Duration
	SessionTTL              time.Duration        // HTTP session TTL (default: 24h)
	HTCondorConfig          *config.Config       // HTCondor configuration (optional, used for LOCAL_DIR default)
	PingInterval            time.Duration        // Interval for periodic daemon pings (default: 1 minute, 0 = disabled)
	StreamBufferSize        int                  // Buffer size for streaming queries (default: 100)
	StreamWriteTimeout      time.Duration        // Write timeout for streaming queries (default: 5s)
	Token                   string               // Token for daemon authentication (optional)
	Credd                   htcondor.CreddClient // Optional credd client; defaults to in-memory implementation

	// LLMAPIKeyFile is the path to a file holding the Anthropic API
	// key. Empty disables the chat endpoint. See HandlerConfig.
	LLMAPIKeyFile string
	// LLMAPIURL is an optional override for the upstream Anthropic
	// endpoint, useful when the operator runs an LLM gateway. Empty
	// = direct to api.anthropic.com.
	LLMAPIURL string
	// LLMModel overrides the default model id. Empty = package default.
	LLMModel string
	// LLMOperatorInstructionsFile is the path to a file with extra
	// system-prompt rules the operator wants the chat assistant to
	// follow on every turn. Empty disables. See HandlerConfig for
	// the file-mode requirement and rationale.
	LLMOperatorInstructionsFile string
}

type DashboardResponse struct {
	Username     string         `json:"username"`
	JobsByStatus map[string]int `json:"jobs_by_status"`
	JobsTotal    int            `json:"jobs_total"`
}

type DeviceAuthorizationResponse struct {
	DeviceCode              string `json:"device_code"`
	UserCode                string `json:"user_code"`
	VerificationURI         string `json:"verification_uri"`
	VerificationURIComplete string `json:"verification_uri_complete,omitempty"`
	ExpiresIn               int    `json:"expires_in"`
	Interval                int    `json:"interval,omitempty"`
}

type DeviceCodeHandler struct {
	// contains filtered or unexported fields
}

type ErrorResponse struct {
	Error   string `json:"error"`
	Message string `json:"message,omitempty"`
	Code    int    `json:"code"`
}

type Handler struct {
	// contains filtered or unexported fields
}

type HandlerConfig struct {
	ScheddName string // Schedd name
	ScheddAddr string // Schedd address (e.g., "127.0.0.1:9618"). If empty, discovered from collector.
	// InteractiveExtraSubmit holds extra HTCondor submit-file
	// directives merged into the submit file produced for each
	// interactive-terminal and JupyterLab job. The string value is
	// spliced in verbatim just before the `queue` directive, so it
	// can override or extend anything the builder emits (typical
	// use: pin an accounting group, add +ProjectName, set a
	// site-wide `requirements` fragment, force `concurrency_limits`,
	// etc.).
	//
	// Trust model: the value comes from operator-only configuration
	// (HTCondor config or env), so it's inserted into every submit
	// file verbatim — no whitelist, no quoting. Treat this as the
	// operator's hook into job admission policy, equivalent in
	// privilege to writing the schedd's site_local config.
	//
	// Multi-line content is supported via HTCondor config syntax (a
	// quoted multi-line value, or backslash continuations). Empty
	// disables the feature. Configurable via
	// HTTP_API_INTERACTIVE_EXTRA_SUBMIT.
	InteractiveExtraSubmit string
	UserHeader             string // HTTP header to extract username from (optional)
	// UserHeaderTrustedProxies is a list of CIDRs from which UserHeader
	// is honored. When UserHeader is set, this list MUST be non-empty
	// (or UserHeaderTrustAnyUnsafe must be true) — otherwise the
	// header is silently ignored, treating the request as
	// unauthenticated. Configure via HTTP_API_USER_HEADER_TRUSTED_PROXIES
	// (comma-separated CIDRs, e.g. "127.0.0.1/32,::1/128,10.0.0.0/8")
	// or programmatically.
	UserHeaderTrustedProxies []string
	// UserHeaderTrustAnyUnsafe disables the trusted-proxy check and
	// accepts UserHeader from any source. This is the demo / test
	// mode only — it is unsafe in any production deployment because
	// it lets any client spoof identity by setting the header.
	// Configure via HTTP_API_USER_HEADER_TRUST_ANY=1 (loud warning
	// at startup).
	UserHeaderTrustAnyUnsafe bool
	SigningKeyPath           string              // Path to token signing key (optional, for token generation)
	TrustDomain              string              // Trust domain for token issuer (optional; only used if UserHeader is set)
	UIDDomain                string              // UID domain for generated token username (optional; only used if UserHeader is set)
	HTTPBaseURL              string              // Base URL for HTTP API (e.g., "http://localhost:8080") for generating file download links in MCP responses
	TLSCACertFile            string              // Path to TLS CA certificate file (optional, for trusting self-signed certs)
	Collector                *htcondor.Collector // Collector for metrics (optional)
	EnableMetrics            bool                // Enable /metrics endpoint (default: true if Collector is set)
	MetricsCacheTTL          time.Duration       // Metrics cache TTL (default: 10s)
	// MetricsPublic disables the API-key auth gate on /metrics. Use
	// only when network ACLs already isolate the endpoint (e.g. a
	// private listening address or a sidecar proxy). Default: false
	// — an admin must mint an API key with the `metrics` scope and
	// configure Prometheus to send it as a Bearer token.
	MetricsPublic bool
	Logger        *logging.Logger // Logger instance (optional, creates default if nil)
	EnableMCP     bool            // Enable MCP endpoints with OAuth2 (default: false)

	// DBPath is the unified SQLite database file backing OAuth2/MCP
	// storage, the embedded IDP, browser sessions, and user-saved
	// batch-submission templates. Defaults to LOCAL_DIR/htcondor-api.db
	// (or /var/lib/condor/htcondor-api.db when LOCAL_DIR is unset).
	// Configure via HTTP_API_DB_PATH.
	DBPath string

	// KEKFilePath is the path to a file holding the master Key
	// Encryption Key used to envelope-encrypt long-lived secrets in
	// the application database (the OAuth2 / IDP issuer's RSA
	// signing key, fosite's HMAC GlobalSecret). Configured via
	// HTTP_API_KEK_FILE — the FILE PATH lives in HTCondor config,
	// the KEY BYTES never do (HTCondor treats config values as
	// public).
	//
	// Empty disables encryption: secrets are stored in plaintext as
	// before. When set, the file must contain exactly 32 raw bytes
	// or a 32-byte hex string and must be 0600/0400. See
	// httpserver/appdb/seal for the design.
	KEKFilePath string

	// OAuth2DBPath is a deprecated alias for DBPath kept so existing
	// in-process embedders (and the test suite) keep compiling without
	// a wholesale rename. NewHandler honors it only when DBPath is
	// empty. The cmd-line wrapper does NOT bridge HTTP_API_OAUTH2_DB_PATH
	// into this field — pointing the unified DB at a pre-unification
	// oauth.db is a guaranteed crash-loop (the legacy schema conflicts
	// with goose 0001_init.sql), and the wrapper logs a deprecation
	// warning instead. New code should set DBPath.
	OAuth2DBPath        string
	OAuth2Issuer        string   // OAuth2 issuer URL (default: listen address)
	OAuth2ClientID      string   // OAuth2 client ID for SSO (optional)
	OAuth2ClientSecret  string   // OAuth2 client secret for SSO (optional)
	OAuth2AuthURL       string   // OAuth2 authorization URL for SSO (optional)
	OAuth2TokenURL      string   // OAuth2 token URL for SSO (optional)
	OAuth2RedirectURL   string   // OAuth2 redirect URL for SSO (optional)
	OAuth2UserInfoURL   string   // OAuth2 user info endpoint for SSO (optional)
	OAuth2Scopes        []string // OAuth2 scopes to request (default: ["openid", "profile", "email"])
	OAuth2UsernameClaim string   // Claim name for username in token (default: "sub")
	OAuth2GroupsClaim   string   // Claim name for groups in user info (default: "groups")
	// OAuth2AccessTokenLifespan is how long an access token issued by the embedded
	// MCP issuer is valid. Defaults to 1 hour if zero.
	OAuth2AccessTokenLifespan time.Duration
	// OAuth2RefreshTokenLifespan is how long a refresh token issued by the embedded
	// MCP issuer is valid. Defaults to 30 days if zero. Must be >= OAuth2AccessTokenLifespan;
	// otherwise refresh grants will fail before the access token expires (see PelicanPlatform/pelican#3389).
	OAuth2RefreshTokenLifespan time.Duration
	MCPAccessGroup             string // Group required for any MCP access (empty = all authenticated)
	MCPReadGroup               string // Group required for read operations (empty = all have read)
	MCPWriteGroup              string // Group required for write operations (empty = all have write)
	MCPInstructions            string // Server-level instructions provided to all MCP agents (e.g., AP-specific guidance)
	WebUIAdminGroup            string // Group required for Web UI admin pages (empty disables admin UI). Configurable via HTTP_API_WEBUI_ADMIN_GROUP.
	EnableIDP                  bool   // Enable built-in IDP (always enabled in demo mode)
	// IDPDBPath is deprecated; the IDP shares the unified DBPath.
	// Retained as an unused field so existing callers keep compiling
	// during the transition.
	IDPDBPath string //nolint:unused // kept for back-compat; ignored by NewHandler.
	IDPIssuer string // IDP issuer URL (default: listen address)
	// IDPAccessTokenLifespan / IDPRefreshTokenLifespan: see OAuth2*Lifespan above. Zero
	// uses the same defaults (1h / 30d).
	IDPAccessTokenLifespan  time.Duration
	IDPRefreshTokenLifespan time.Duration
	SessionTTL              time.Duration        // HTTP session TTL (default: 24h)
	HTCondorConfig          *config.Config       // HTCondor configuration (optional, used for LOCAL_DIR default)
	PingInterval            time.Duration        // Interval for periodic daemon pings (default: 1 minute, 0 = disabled)
	StreamBufferSize        int                  // Buffer size for streaming queries (default: 100)
	StreamWriteTimeout      time.Duration        // Write timeout for streaming queries (default: 5s)
	Token                   string               // Token for daemon authentication (optional)
	Credd                   htcondor.CreddClient // Optional credd client; defaults to in-memory implementation

	// LLMAPIKeyFile is the path to a file holding the Anthropic API
	// key used by the chat endpoint at /api/v1/chat. Empty disables
	// the chat feature. The bytes never live in HTCondor config —
	// only this file path does.
	LLMAPIKeyFile string
	// LLMAPIURL overrides the upstream Anthropic Messages endpoint.
	// Use to point at a self-hosted LLM gateway / cache. Empty falls
	// back to chat.DefaultAnthropicURL.
	LLMAPIURL string
	// LLMModel overrides the default Anthropic model id. Empty falls
	// back to chat.DefaultAnthropicModel.
	LLMModel string

	// LLMOperatorInstructionsFile is the path to a file containing
	// extra system-prompt rules the operator wants appended to every
	// chat turn (e.g. "users in this pool may not request more than
	// 64 GiB of memory; suggest fewer if asked"). Empty path = no
	// addendum.
	//
	// File mode is enforced 0600/0400 on load — same rationale as the
	// API-key file: the operator may put policy text here that they
	// don't want every local user to read. Loaded once at startup; a
	// hot-reload would need a server restart.
	LLMOperatorInstructionsFile string

	// JupyterWorkDir is where the embedded helper binary (materialized
	// from package jupyterhelperbin) and per-instance scratch artifacts
	// (token files) are staged. Files persist for the lifetime of the
	// job since HTCondor reads transfer_input_files at job-startup time.
	// Defaults to <os.TempDir>/htcondor-api-jupyter.
	JupyterWorkDir string

	// TemplateGlobalPath is an optional YAML file with operator-curated
	// batch-submission templates. Empty disables. Built-in templates
	// always ship.
	TemplateGlobalPath string

	// TemplateUserStoreDBPath is deprecated; the templates store now
	// shares the unified DBPath. Retained so existing callers
	// keep compiling; ignored by NewHandler.
	TemplateUserStoreDBPath string //nolint:unused // kept for back-compat; ignored by NewHandler.
}

type HistoryListResponse struct {
	Ads []*classad.ClassAd `json:"ads"`
}

type IDPProvider struct {
	// contains filtered or unexported fields
}

type IDPProviderOptions struct {
	DB                   *sql.DB
	Issuer               string
	AccessTokenLifespan  time.Duration
	RefreshTokenLifespan time.Duration
	// Sealer envelope-encrypts the IDP's RSA private key + HMAC
	// GlobalSecret. See OAuth2ProviderOptions.Sealer.
	Sealer *seal.Sealer
}

type IDPStorage struct {
	// contains filtered or unexported fields
}

type InteractiveCreateTerminalRequest struct {
	Cpus     int `json:"cpus,omitempty"`
	MemoryMB int `json:"memory_mb,omitempty"`
	DiskMB   int `json:"disk_mb,omitempty"`

	// GPU fields. Mirrored verbatim into request_gpus and the
	// gpus_minimum_* / cuda_version / require_gpus submit lines.
	// Gpus == 0 disables the entire GPU section in the submit file.
	Gpus                  int    `json:"gpus,omitempty"`
	GpusMinimumCapability string `json:"gpus_minimum_capability,omitempty"`
	GpusMinimumMemory     int    `json:"gpus_minimum_memory,omitempty"`
	GpusMinimumRuntime    string `json:"gpus_minimum_runtime,omitempty"`
	CudaVersion           string `json:"cuda_version,omitempty"`
	RequireGpus           string `json:"require_gpus,omitempty"`
}

type InteractiveCreateTerminalResponse struct {
	InstanceID string `json:"instance_id"`
	ClusterID  int    `json:"cluster_id"`
	ProcID     int    `json:"proc_id"`
	JobID      string `json:"job_id"` // "cluster.proc" — convenience for the SPA
	BatchName  string `json:"batch_name"`
}

type InteractiveTerminalSummary struct {
	InstanceID                   string `json:"instance_id"`
	JobID                        string `json:"job_id"`
	ClusterID                    int    `json:"cluster_id"`
	ProcID                       int    `json:"proc_id"`
	BatchName                    string `json:"batch_name"`
	JobStatus                    int    `json:"job_status"`
	JobCurrentStartExecutingDate int64  `json:"job_current_start_executing_date,omitempty"`
	HoldReasonCode               int    `json:"hold_reason_code,omitempty"`
	HoldReason                   string `json:"hold_reason,omitempty"`
	SubmittedAt                  string `json:"submitted_at,omitempty"` // RFC3339 from QDate
}

type JobActionFunc func(ctx context.Context, constraint, reason string) (*htcondor.JobActionResults, error)

type JobEditRequest struct {
	Attributes map[string]interface{} `json:"attributes"` // Attributes to update
}

type JobListResponse struct {
	Jobs []*classad.ClassAd `json:"jobs"`
}

type JobLogResponse struct {
	JobID     string          `json:"jobId"`
	Filename  string          `json:"filename"`
	Truncated bool            `json:"truncated"`
	Events    []userlog.Event `json:"events"`
}

type JobSubmitRequest struct {
	SubmitFile string `json:"submit_file"` // Submit file content
}

type JobSubmitResponse struct {
	ClusterID int      `json:"cluster_id"`
	JobIDs    []string `json:"job_ids"` // Array of "cluster.proc" strings
}

type JupyterCreateRequest struct {
	// Image is the Docker image to launch. Default
	// quay.io/jupyter/scipy-notebook:latest.
	Image string `json:"image"`
	// Cpus is the requested core count. Default 2.
	Cpus int `json:"cpus"`
	// MemoryMB is the requested RAM in mebibytes. Default 4096.
	MemoryMB int `json:"memory_mb"`
	// DiskMB is the requested scratch disk in mebibytes. Default 4096.
	DiskMB int `json:"disk_mb"`

	// GPU fields. Mirrored verbatim into request_gpus and the
	// gpus_minimum_* / cuda_version / require_gpus submit lines.
	// Gpus == 0 disables the entire GPU section in the submit file.
	Gpus                  int    `json:"gpus,omitempty"`
	GpusMinimumCapability string `json:"gpus_minimum_capability,omitempty"`
	GpusMinimumMemory     int    `json:"gpus_minimum_memory,omitempty"`
	GpusMinimumRuntime    string `json:"gpus_minimum_runtime,omitempty"`
	CudaVersion           string `json:"cuda_version,omitempty"`
	RequireGpus           string `json:"require_gpus,omitempty"`
}

type JupyterCreateResponse struct {
	InstanceID string `json:"instance_id"`
	ClusterID  string `json:"cluster_id"`
	// ProxyPath is where the browser should eventually point its iframe
	// (only useful once the helper has connected back; the SSE stream
	// from /events tells you when).
	ProxyPath string `json:"proxy_path"`
}

type JupyterInstanceSummary struct {
	InstanceID                   string `json:"instance_id"`
	ClusterID                    string `json:"cluster_id,omitempty"`
	Image                        string `json:"image,omitempty"`
	Owner                        string `json:"owner"`
	CreatedAt                    string `json:"created_at"`
	Connected                    bool   `json:"connected"` // helper has dialed back
	ProxyPath                    string `json:"proxy_path"`
	EventsPath                   string `json:"events_path"`
	JobStatus                    int    `json:"job_status,omitempty"`
	JobCurrentStartExecutingDate int64  `json:"job_current_start_executing_date,omitempty"`
	HoldReasonCode               int    `json:"hold_reason_code,omitempty"`
	HoldReason                   string `json:"hold_reason,omitempty"`
}

type LoginRateLimiter struct {
	// contains filtered or unexported fields
}

type OAuth2Provider struct {
	// contains filtered or unexported fields
}

type OAuth2ProviderOptions struct {
	DB                   *sql.DB
	Issuer               string
	AccessTokenLifespan  time.Duration
	RefreshTokenLifespan time.Duration
	// Sealer envelope-encrypts long-lived secrets in the DB (the
	// issuer's RSA private key, fosite's HMAC GlobalSecret). When
	// non-nil, the storage adapter pulls/pushes ciphertext + wrapped
	// DEK on the corresponding load/save calls. Nil = plaintext.
	Sealer *seal.Sealer
}

type OAuth2StateEntry struct {
	AuthorizeRequest fosite.AuthorizeRequester
	Timestamp        time.Time
	OriginalURL      string   // Original URL to redirect back to after authentication
	Username         string   // Authenticated username for consent flow
	Groups           []string // User groups for scope filtering in consent flow
}

type OAuth2StateStore struct {
	// contains filtered or unexported fields
}

type OAuth2Storage struct {
	// contains filtered or unexported fields
}

type PeekResponse struct {
	Stdout *PeekedStreamResponse `json:"stdout,omitempty"`
	Stderr *PeekedStreamResponse `json:"stderr,omitempty"`
}

type PeekedStreamResponse struct {
	Text   string `json:"text"`
	Offset int64  `json:"offset"`
}

type PingResponse struct {
	Daemon         string `json:"daemon"`               // "collector" or "schedd"
	AuthMethod     string `json:"auth_method"`          // Authentication method used
	User           string `json:"user"`                 // Authenticated username
	SessionID      string `json:"session_id"`           // Session identifier
	ValidCommands  string `json:"valid_commands"`       // Commands authorized
	Encryption     bool   `json:"encryption"`           // Whether encryption is enabled
	Authentication bool   `json:"authentication"`       // Whether authentication is enabled
	Authorized     bool   `json:"authorized,omitempty"` // Whether authorized for requested permission (if permission checked)
	Permission     string `json:"permission,omitempty"` // Permission level checked (if any)
}

type Server struct {
	*Handler // Embedded handler for business logic
	// contains filtered or unexported fields
}

type SessionData struct {
	Username  string    // Authenticated username
	Groups    []string  // User groups from IDP (for scope filtering)
	CreatedAt time.Time // When the session was created
	ExpiresAt time.Time // When the session expires
}

type SessionStore struct {
	// contains filtered or unexported fields
}

type ShareOutputRequest struct {
	TTLSeconds int `json:"ttl_seconds,omitempty"`
}

type ShareOutputResponse struct {
	URL        string    `json:"url"`
	ExpiresAt  time.Time `json:"expires_at"`
	TTLSeconds int       `json:"ttl_seconds"`
	Owner      string    `json:"owner"`
}

type TokenCache struct {
	// contains filtered or unexported fields
}

type TokenCacheEntry struct {
	Token        string
	Username     string // sub from the JWT — unverified until Validated == true
	Validated    bool   // true once a schedd op authenticated successfully with this token
	Expiration   time.Time
	SessionCache *security.SessionCache
	// contains filtered or unexported fields
}

type UserInfo struct {
	Subject string                 `json:"sub"`
	Email   string                 `json:"email"`
	Name    string                 `json:"name"`
	Groups  interface{}            `json:"groups"` // Can be []string or string
	Claims  map[string]interface{} // Additional claims
}

type VersionResponse struct {
	Version string `json:"version"`
	Commit  string `json:"commit"`
}

type WhoAmIResponse struct {
	Authenticated bool   `json:"authenticated"`
	User          string `json:"user,omitempty"` // Omit if not authenticated
}