httpserver

type AdminClient struct {
	ID            string    `json:"id"`
	RedirectURIs  []string  `json:"redirect_uris,omitempty"`
	GrantTypes    []string  `json:"grant_types,omitempty"`
	ResponseTypes []string  `json:"response_types,omitempty"`
	Scopes        []string  `json:"scopes,omitempty"`
	Public        bool      `json:"public"`
	CreatedAt     time.Time `json:"created_at"`

	// ServiceSubject is the identity a client_credentials token from this
	// client asserts (the IDTOKEN subject the schedd authorizes). Empty unless
	// set by an admin; required before client_credentials will issue a token.
	ServiceSubject string `json:"service_subject,omitempty"`

	// Name is what the client called itself at registration (RFC 7591
	// client_name). Empty for seeded clients and for anything registered
	// before we started keeping it.
	Name string `json:"name,omitempty"`
	// Notes is the operator's own annotation, editable from the UI. It
	// is the only identifying field available for clients that predate
	// provenance tracking.
	Notes string `json:"notes,omitempty"`
	// Origin is "dynamic", "seeded", or empty for unknown. Empty is not
	// the same as "not dynamic" -- it means nobody recorded the answer.
	Origin string `json:"origin,omitempty"`
	// LastUsedAt is when this client last obtained a token. Absent means
	// never, which for a dynamically registered client usually means an
	// app registered once and never came back.
	//
	// Written on a debounced background flush, so it can lag real usage
	// by up to a flush interval. It is a "roughly when", not an audit
	// record; oauth2_access_tokens has the per-token history.
	LastUsedAt *time.Time `json:"last_used_at,omitempty"`
	// RecentUsers is a rolling sample of the last few distinct subjects
	// to obtain a token through this client, newest first.
	RecentUsers []AdminClientUse `json:"recent_users,omitempty"`
	// RefreshBlockedBy names what stops this client from ever receiving
	// a refresh token, so its users re-authorize on every access-token
	// expiry. Empty means nothing does -- or that the client has no
	// interactive flow and so has no user to inconvenience.
	RefreshBlockedBy []string `json:"refresh_blocked_by,omitempty"`
}

type AdminClientUse struct {
	Subject string    `json:"subject"`
	At      time.Time `json:"at"`
}

type AdminCondorConfigEntry struct {
	Key      string `json:"key"`
	Value    string `json:"value,omitempty"`
	Redacted bool   `json:"redacted,omitempty"`
	// IsDefault reports that this key still holds HTCondor's compiled-in
	// value — nothing in this deployment's config files or environment
	// touched it. Roughly a thousand of the ~1085 keys in a stock config
	// are in this state, which is what makes an unfiltered dump tedious
	// to read, so the SPA offers to hide them.
	IsDefault bool `json:"is_default,omitempty"`
}

type AdminCondorConfigResponse struct {
	Configured bool                     `json:"configured"`
	Entries    []AdminCondorConfigEntry `json:"entries"`
	// ModifiedCount is how many entries this deployment actually set,
	// so the SPA can label its filter without counting client-side.
	ModifiedCount int `json:"modified_count"`
}

type AdminLogsResponse struct {
	Enabled bool                  `json:"enabled"`
	Entries []logging.BufferEntry `json:"entries"`
}

type AdminRevokeRequest struct {
	// Subject is the user whose grants should be revoked. Matched exactly
	// against the subject recorded on each token row, which is the same
	// value the OAuth2 session carries (typically the username claim, not
	// the schedd's "user@domain" form).
	Subject string `json:"subject"`
}

type AdminRevokeResponse struct {
	Subject string `json:"subject"`
	// Revoked counts token rows deactivated across both issuers.
	Revoked int64 `json:"revoked"`
	// OAuth2 and IDP break that count down by issuer, so an operator can
	// tell whether the user held MCP grants, IDP grants, or both.
	OAuth2 int64 `json:"oauth2"`
	IDP    int64 `json:"idp"`
}

type AdminRevokeTokenRequest struct {
	// Kind is "access" or "refresh" -- which table the fingerprint is in.
	Kind string `json:"kind"`
	// Fingerprint is the redacted signature shown in the listing. The
	// trailing "..." may be included or not.
	Fingerprint string `json:"fingerprint"`
}

type AdminRevokeTokenResponse struct {
	Revoked  int64  `json:"revoked"`
	ClientID string `json:"client_id"`
	Subject  string `json:"subject,omitempty"`
}

type AdminSetTokenScopesRequest struct {
	// Kind is "access" or "refresh" -- which table the fingerprint is in.
	Kind string `json:"kind"`
	// Fingerprint is the redacted signature shown in the listing.
	Fingerprint string `json:"fingerprint"`
	// Scopes is the set to keep. Anything currently granted and absent
	// here is removed; anything here that is not currently granted is an
	// error rather than an addition.
	Scopes []string `json:"scopes"`
}

type AdminSetTokenScopesResponse struct {
	ClientID string   `json:"client_id"`
	Subject  string   `json:"subject,omitempty"`
	Scopes   []string `json:"scopes"`
	Removed  []string `json:"removed,omitempty"`
	Added    []string `json:"added,omitempty"`
	Rows     int64    `json:"rows"`
}

type AdminToken struct {
	Kind            string `json:"kind"` // "access" or "refresh"
	SignaturePrefix string `json:"signature_prefix"`
	ClientID        string `json:"client_id"`
	// ClientName and Notes are the client's own label and the operator's
	// annotation, carried over from the clients page. A client id is a
	// generated string; "OpenClaw MCP" is what somebody reading this page
	// is actually looking for.
	ClientName string   `json:"client_name,omitempty"`
	Notes      string   `json:"notes,omitempty"`
	Subject    string   `json:"subject,omitempty"`
	Scopes     []string `json:"scopes,omitempty"`
	// AuthorizedScopes is everything this authorization ended with. Scopes
	// is the subset in force now, so the difference is what an operator
	// switched off and may switch back on.
	AuthorizedScopes []string  `json:"authorized_scopes,omitempty"`
	Active           bool      `json:"active"`
	RequestedAt      time.Time `json:"requested_at"`
	ExpiresAt        time.Time `json:"expires_at,omitempty"`
}

type AdvertiseRequest struct {
	Ad      *classad.ClassAd `json:"ad,omitempty"`       // Single ad (JSON body)
	Command string           `json:"command,omitempty"`  // Optional UPDATE command (e.g., "UPDATE_STARTD_AD")
	WithAck bool             `json:"with_ack,omitempty"` // Request acknowledgment
}

type AdvertiseResponse struct {
	Success   bool     `json:"success"`
	Message   string   `json:"message,omitempty"`
	Succeeded int      `json:"succeeded"`        // Number of ads successfully advertised
	Failed    int      `json:"failed"`           // Number of ads that failed
	Errors    []string `json:"errors,omitempty"` // Error messages for failed ads
}

type AuthMeResponse struct {
	Authenticated bool     `json:"authenticated"`
	Username      string   `json:"username,omitempty"`
	Groups        []string `json:"groups,omitempty"`
	IsAdmin       bool     `json:"is_admin"`
	// SuperuserAllowed reports that this session MAY arm superuser mode --
	// the feature is configured and the session is in the superuser group.
	// It says nothing about whether the mode is currently on.
	SuperuserAllowed bool `json:"superuser_allowed"`
	// SuperuserActive reports that the mode is armed right now. The SPA
	// shows its warning banner on this, so every page can tell the user
	// that their next action may land on somebody else's job.
	SuperuserActive bool `json:"superuser_active"`
	// SuperuserExpiresAt is when the mode disarms itself. Surfaced so the
	// banner can say how long is left rather than have the mode silently
	// lapse mid-task.
	SuperuserExpiresAt *time.Time `json:"superuser_expires_at,omitempty"`
	// SuperuserIdentity is what actions will be attributed to on the schedd
	// while the mode is armed, and SuperuserNote explains it if that is not
	// the operator themselves.
	SuperuserIdentity string `json:"superuser_identity,omitempty"`
	SuperuserNote     string `json:"superuser_note,omitempty"`
}

type ClientOrigin string

type CollectorAdsResponse struct {
	Ads []*classad.ClassAd `json:"ads"`
}

type Config struct {
	ListenAddr string // Address to listen on (e.g., ":8080")
	// MCPListenAddr, when set, serves MCP on its own listener instead of
	// alongside the web UI and the REST API. Empty is the default and
	// keeps everything on one port.
	//
	// A separate port is worth having only if the split is real, so the
	// protocol endpoint then answers there and not on the main listener.
	// The OAuth2 endpoints stay on both: a client that reaches either has
	// to be able to finish authenticating.
	MCPListenAddr string
	ScheddName    string // Schedd name
	ScheddAddr    string // Schedd address (e.g., "127.0.0.1:9618"). If empty, discovered from collector.

	// ScheddAddrDiscovered says ScheddAddr was resolved from the collector
	// rather than set by an operator.
	//
	// It matters because the two look identical here and behave
	// differently: a pinned address is honoured even when the collector
	// disagrees, while a discovered one must follow the collector. The
	// daemon resolves the address in main() and passes the result, so
	// without this every deployment that only sets SCHEDD_NAME looked
	// pinned -- and kept dialling the dead socket of a schedd that had
	// restarted, forever. See issue #308.
	ScheddAddrDiscovered bool
	UserHeader           string // HTTP header to extract username from (optional)
	// UserHeaderTrustedProxies is the CIDR list from which UserHeader
	// is honored. See HandlerConfig.UserHeaderTrustedProxies for
	// full docs and the security rationale. Configurable via
	// HTTP_API_USER_HEADER_TRUSTED_PROXIES.
	UserHeaderTrustedProxies []string
	// TrustedProxies lists CIDRs whose forwarded headers are honored for
	// access logging. Empty means none are. HTTP_API_TRUSTED_PROXIES.
	TrustedProxies []string
	// UserHeaderTrustAnyUnsafe disables the trusted-proxy gate and
	// honors UserHeader from any source. Demo / test only — see
	// HandlerConfig.UserHeaderTrustAnyUnsafe. Configurable via
	// HTTP_API_USER_HEADER_TRUST_ANY.
	UserHeaderTrustAnyUnsafe bool
	SigningKeyPath           string // Path to token signing key (optional, for token generation)
	TrustDomain              string // Trust domain for token issuer (optional; only used if UserHeader is set)
	UIDDomain                string // UID domain for generated token username (optional; only used if UserHeader is set)
	HTTPBaseURL              string // Base URL for HTTP API (e.g., "http://localhost:8080") for generating file download links in MCP responses

	// MCPBaseURL is the public base URL of the MCP listener, when MCP has
	// its own port and that port is published under a different origin
	// than the web UI. Empty means MCP is reached at the same base URL as
	// everything else, which is true whenever the ports are combined and
	// whenever a split is only local.
	//
	// It exists for one attribute: RFC 9728 requires the protected-resource
	// document to name the resource the client asked about, and a client
	// that reaches MCP on another origin asked about that origin. Naming
	// the web UI's instead makes the document one the client must reject.
	MCPBaseURL string
	// CCB decides how to reach a daemon behind a Condor Connection Broker:
	// on an inbound path of this server's own (see sharedportrouter), or by
	// having the broker relay. Set once by the operator and applied to every
	// surface that reaches into a running job -- a shell, a session, tailing
	// output -- so two of them cannot disagree. Nil keeps cedar's default,
	// which only works on a host the execute nodes can reach.
	CCB           *htcondor.CCBDialer
	TLSCertFile   string              // Path to TLS certificate file (optional, enables HTTPS)
	TLSKeyFile    string              // Path to TLS key file (optional, enables HTTPS)
	TLSCACertFile string              // Path to TLS CA certificate file (optional, for trusting self-signed certs)
	ReadTimeout   time.Duration       // HTTP read timeout (default: 30s)
	WriteTimeout  time.Duration       // HTTP write timeout (default: 30s)
	IdleTimeout   time.Duration       // HTTP idle timeout (default: 120s)
	Collector     *htcondor.Collector // Collector for metrics (optional)
	// JobQueueLogPath, if set, is the path to the schedd's job_queue.log; the
	// server mirrors it into a watch-enabled collection and serves
	// /api/v1/jobs/watch (SSE) from it. Empty disables the jobs watch endpoint.
	JobQueueLogPath string
	EnableMetrics   bool          // Enable /metrics endpoint (default: true if Collector is set)
	MetricsCacheTTL time.Duration // Metrics cache TTL (default: 10s)
	// MetricsPublic disables the API-key auth gate on /metrics.
	// Configurable via HTTP_API_METRICS_PUBLIC; see HandlerConfig.
	MetricsPublic bool

	// htcondordb mirror routing; see HandlerConfig for what each does.
	DBMirrorName     string          // HTTP_API_DBMIRROR_NAME
	DBMirrorAddress  string          // HTTP_API_DBMIRROR_ADDRESS
	DBMirrorRequired bool            // HTTP_API_DBMIRROR_REQUIRED
	Logger           *logging.Logger // Logger instance (optional, creates default if nil)
	JupyterWorkDir   string          // Per-instance scratch dir for JupyterLab submission artifacts; default <TempDir>/htcondor-api-jupyter
	// JupyterMaxLifetimeSec is the wall-clock ceiling on a JupyterLab
	// session, and JupyterKernelIdleSec the kernel-idle limit after
	// which JupyterLab culls and shuts down. Zero disables either.
	JupyterMaxLifetimeSec int
	JupyterKernelIdleSec  int

	// InteractiveExtraSubmit is an optional verbatim block of extra
	// HTCondor submit-file directives merged into every
	// interactive-terminal and Jupyter job. See
	// HandlerConfig.InteractiveExtraSubmit for the trust model and
	// full documentation. Configurable via
	// HTTP_API_INTERACTIVE_EXTRA_SUBMIT.
	InteractiveExtraSubmit string

	// DagmanPath is where condor_dagman lives on the access point, for
	// the submit_dag tool. See HandlerConfig.DagmanPath. Configurable
	// via HTTP_API_DAGMAN_PATH.
	DagmanPath string

	// DagmanEnvironment is extra environment for the DAGMan manager job.
	// See HandlerConfig.DagmanEnvironment. Configurable via
	// HTTP_API_DAGMAN_ENVIRONMENT.
	DagmanEnvironment map[string]string

	// InteractiveRequirements is an optional ClassAd expression ANDed into
	// the interactive terminal job's Requirements. See
	// HandlerConfig.InteractiveRequirements.
	InteractiveRequirements string

	// Build is the site's container-build configuration; see
	// mcpserver.BuildConfig and HandlerConfig.Build.
	Build mcpserver.BuildConfig
	// SubmitFileDefaults and SubmitFileOverrides are the site-wide
	// submit-file policy applied to EVERY submission -- REST, templates,
	// interactive, Jupyter and MCP alike. Defaults apply only where the
	// submit file is silent; overrides win over it. See
	// HandlerConfig for the trust model.
	// DBMirrorTokenSubject overrides the identity the htcondordb token
	// asserts. See HandlerConfig.
	DBMirrorTokenSubject string

	SubmitFileDefaults  string
	SubmitFileOverrides string

	// Batch-submission template paths.
	TemplateGlobalPath string // Optional YAML file with operator-curated templates
	// TemplateUserStoreDBPath is deprecated; the templates store
	// shares the unified DBPath. Kept so existing callers compile.
	TemplateUserStoreDBPath string //nolint:unused // back-compat; ignored.
	EnableMCP               bool   // Enable MCP endpoints with OAuth2 (default: false)
	// DBPath is the unified SQLite database file. See HandlerConfig.DBPath.
	DBPath string
	// KEKFilePath enables envelope encryption for long-lived secrets
	// in the DB. See HandlerConfig.KEKFilePath.
	KEKFilePath string
	// OAuth2DBPath is the legacy name for DBPath; kept for back-compat.
	OAuth2DBPath string
	OAuth2Issuer string // OAuth2 issuer URL (default: listen address)
	// MCPCIMDEnabled resolves an https:// MCP client_id as a Client ID Metadata
	// Document (public client); MCPCIMDAllowedHosts optionally restricts it.
	MCPCIMDEnabled      bool
	MCPCIMDAllowedHosts []string
	// MCPTokenExchangeIssuers: JSON list of trusted external issuers for token
	// exchange (HTTP_API_MCP_TOKEN_EXCHANGE_ISSUERS).
	MCPTokenExchangeIssuers string
	OAuth2ClientID          string   // OAuth2 client ID for SSO (optional)
	OAuth2ClientSecret      string   // OAuth2 client secret for SSO (optional)
	OAuth2AuthURL           string   // OAuth2 authorization URL for SSO (optional)
	OAuth2TokenURL          string   // OAuth2 token URL for SSO (optional)
	OAuth2RedirectURL       string   // OAuth2 redirect URL for SSO (optional)
	OAuth2UserInfoURL       string   // OAuth2 user info endpoint for SSO (optional)
	OAuth2Scopes            []string // OAuth2 scopes to request (default: ["openid", "profile", "email"])
	OAuth2UsernameClaim     string   // Claim name for username in token (default: "sub")
	OAuth2GroupsClaim       string   // Claim name for groups in user info (default: "groups")
	// OAuth2Requirements is a ClassAd expression evaluated against the
	// token's claims at login. Empty means no policy.
	OAuth2Requirements string

	// IdentityMapStrategies is the ordered list of ways to turn an OIDC
	// subject into a local account -- "gecos", "username", or both, as in
	// "gecos,username". Empty disables mapping entirely. When set, group
	// membership comes from the system rather than the token, and a
	// caller that maps to no single account is refused a session.
	IdentityMapStrategies []idmap.Strategy
	// IdentityGroupSources lists where group membership comes from, as
	// parsed specs: "system" and/or "file:<path>". Empty keeps the
	// token's groups claim, which is what a container wants because it
	// holds no account database to read. Independent of
	// IdentityMapStrategies: a deployment may want either, both, or
	// neither. Several sources are unioned, the way glibc merges NSS
	// services, so a site can carry directory groups and hand-maintained
	// ones at once.
	IdentityGroupSources []string
	// IdentityMapPasswdFile reads accounts from this file instead of
	// /etc/passwd. Empty means /etc/passwd, which is the only account
	// source that enumerates: the GECOS index cannot list accounts that
	// live only in a directory. Accounts it does map are still verified
	// against the live database, directory included.
	IdentityMapPasswdFile string
	// IdentityMapTTL is how long the GECOS index and the group lookups
	// are reused. Zero means five minutes.
	IdentityMapTTL time.Duration

	// IdentityMapStripDomain also tries the local part of a scoped
	// subject -- "bockelman@wisc.edu" as "bockelman". Only sound where
	// something else constrains which identity providers may log in,
	// since the local part is not unique across domains.
	IdentityMapStripDomain bool
	// OAuth2AccessTokenLifespan / OAuth2RefreshTokenLifespan control how long the
	// embedded MCP issuer's tokens are valid. Zero means "use the package default"
	// (1h access, 30d refresh). RefreshTokenLifespan must be >= AccessTokenLifespan.
	OAuth2AccessTokenLifespan  time.Duration
	OAuth2RefreshTokenLifespan time.Duration
	// OAuth2MaxGrantLifetime caps the total age of a grant measured from
	// the consent that created it, regardless of how often it is
	// refreshed. Defaults to DefaultMaxGrantLifetime (30 days) if zero.
	// See HandlerConfig.OAuth2MaxGrantLifetime.
	OAuth2MaxGrantLifetime time.Duration
	// OAuth2RevocationOracles selects the refresh-time revocation oracles.
	// Nil selects the default set; see HandlerConfig.OAuth2RevocationOracles
	// for the recognized names.
	OAuth2RevocationOracles []string
	MCPAccessGroup          string // Group required for any MCP access (empty = all authenticated)
	MCPReadGroup            string // Group required for read operations (empty = all have read)
	MCPWriteGroup           string // Group required for write operations (empty = all have write)
	// UpstreamRefresh is HTTP_API_UPSTREAM_REFRESH: auto, on or off.
	// Decides whether this server keeps the identity provider's refresh
	// token so it can ask about a user later. See upstream_refresh.go.
	UpstreamRefresh string
	// TokenRetention is HTTP_API_TOKEN_RETENTION: how long a dead token
	// row is kept before deletion. Empty means the default (90 days),
	// "off" keeps them forever. See oauth2_retention.go.
	TokenRetention string

	// MCPAdminGroup / MCPSuperuserGroup gate the two cross-user MCP
	// privileges. Empty means NOBODY, not everybody -- see
	// HandlerConfig for why these invert the default above.
	MCPAdminGroup     string
	MCPSuperuserGroup string
	ScheddHost        string // SCHEDD_HOST: the host (optionally name@host, optionally with a port) whose schedd to use
	MCPInstructions   string // Server-level instructions provided to all MCP agents (e.g., AP-specific guidance)
	// MCPDisabledTools (HTTP_API_MCP_DISABLED_TOOLS) names tools this site cannot
	// offer, as path.Match patterns separated by commas or whitespace.
	MCPDisabledTools string
	// MCPSkillsReloadInterval is how often that directory is re-read so a
	// checkout updated underneath this process is noticed without a
	// reconfigure. Zero disables the poll.
	MCPSkillsReloadInterval time.Duration
	// MCPSkillsDir publishes a directory of site-authored Markdown skills
	// to agents. Empty disables the feature.
	MCPSkillsDir    string
	MCPAdminUsers   []string // Authenticated subjects exempt from the MCP owner-scope wrapper
	WebUIAdminGroup string   // Group required for Web UI admin pages (empty disables admin UI). Configurable via HTTP_API_WEBUI_ADMIN_GROUP.
	// WebUIAccessGroup gates web interface login; empty falls back to
	// MCPAccessGroup. Comma-separated.
	WebUIAccessGroup string
	// SpoolBufferDir is where a cluster-wide upload buffers its tar
	// before fanning it out to each proc. Empty selects the system temp
	// directory.
	SpoolBufferDir string
	// SuperuserGroup gates superuser mode. Empty disables it. See
	// HandlerConfig.SuperuserGroup -- notably, it is NOT WebUIAdminGroup.
	SuperuserGroup string
	// SuperuserFallbackIdentity overrides the identity used when the
	// operator is not themselves a usable queue superuser. Empty selects
	// condor@$(UID_DOMAIN). See HandlerConfig.
	SuperuserFallbackIdentity string
	EnableIDP                 bool // Enable built-in IDP (always enabled in demo mode)
	// SeedDemoUser seeds a second, non-admin IDP account. Demo mode only;
	// see HandlerConfig.SeedDemoUser for why it is not keyed on EnableIDP.
	SeedDemoUser bool
	// IDPDBPath is deprecated; the IDP shares the unified DBPath.
	IDPDBPath string //nolint:unused // back-compat; ignored.
	IDPIssuer string // IDP issuer URL (default: listen address)
	// IDPAccessTokenLifespan / IDPRefreshTokenLifespan: see OAuth2*Lifespan above.
	IDPAccessTokenLifespan  time.Duration
	IDPRefreshTokenLifespan time.Duration
	SessionTTL              time.Duration  // HTTP session TTL (default: 24h)
	HTCondorConfig          *config.Config // HTCondor configuration (optional, used for LOCAL_DIR default)
	// PingInterval is the periodic collector/schedd ping cadence; zero
	// or negative disables it. See HandlerConfig.PingInterval.
	PingInterval time.Duration
	// MCPWatchMaxWait caps in-call MCP watch_jobs blocking; keep it
	// under the front gateway timeout. See HandlerConfig.MCPWatchMaxWait.
	MCPWatchMaxWait time.Duration
	// MCPMaxRequestDuration is the hard stop on an MCP request that keeps
	// making progress. See HandlerConfig.MCPMaxRequestDuration.
	MCPMaxRequestDuration time.Duration

	// MCPUseSDKTransport serves /mcp with the upstream MCP SDK's transport.
	// See HandlerConfig.MCPUseSDKTransport.
	MCPUseSDKTransport bool
	// RequiredCredentials names the OAuth service credentials that must
	// exist before a job may be submitted. See
	// HandlerConfig.RequiredCredentials.
	RequiredCredentials []string
	// CreddAddress pins the credd to talk to. See HandlerConfig.CreddAddress.
	CreddAddress       string
	StreamBufferSize   int                  // Buffer size for streaming queries (default: 100)
	StreamWriteTimeout time.Duration        // Write timeout for streaming queries (default: 5s)
	Token              string               // Token for daemon authentication (optional)
	Credd              htcondor.CreddClient // Optional credd client; defaults to in-memory implementation
	// Placementd is an optional condor_placementd client; nil means
	// "discover one". See HandlerConfig.
	Placementd htcondor.PlacementdClient

	// LLMAPIKeyFile is the path to a file holding the Anthropic API
	// key. Empty disables the chat endpoint. See HandlerConfig.
	LLMAPIKeyFile string
	// LLMAPIURL is an optional override for the upstream Anthropic
	// endpoint, useful when the operator runs an LLM gateway. Empty
	// = direct to api.anthropic.com.
	LLMAPIURL string
	// LLMModel overrides the default model id. Empty = package default.
	LLMModel string
	// LLMOperatorInstructionsFile is the path to a file with extra
	// system-prompt rules the operator wants the chat assistant to
	// follow on every turn. Empty disables. See HandlerConfig for
	// the file-mode requirement and rationale.
	LLMOperatorInstructionsFile string
}

type DagGraphGroup struct {
	ID    string `json:"id"`
	Label string `json:"label"`
	// Description is what the group's nodes run, when it is known. It is
	// empty for a workflow read from a DOT file, which carries no submit
	// descriptions.
	Description string         `json:"description"`
	Count       int            `json:"count"`
	ParentIDs   []string       `json:"parent_ids"`
	Status      map[string]int `json:"status"`
}

type DagGraphNode struct {
	Name    string `json:"name"`
	GroupID string `json:"group_id"`
	State   string `json:"state"`
	// JobID, HoldReason and ExitCode are the "why" behind a state, and
	// they come from the queue or the archive even when the state itself
	// came from the status file -- a node the status file calls an error
	// is a number until something says which job failed and how.
	JobID      string `json:"job_id,omitempty"`
	HoldReason string `json:"hold_reason,omitempty"`
	ExitCode   *int   `json:"exit_code,omitempty"`
	// Detail is DAGMan's own note about the node, when the status file
	// carried one ("idle: 2 held", an error message, "Had an ancestor
	// node fail").
	Detail string `json:"detail,omitempty"`
	Source string `json:"source"`
}

type DagGraphResponse struct {
	Cluster int    `json:"cluster"`
	DagFile string `json:"dag_file"`
	// DotFile and StatusFile name the files this answer was read out of,
	// so a caller looking at the spool can find them.
	DotFile    string `json:"dot_file"`
	StatusFile string `json:"status_file,omitempty"`
	NodeCount  int    `json:"node_count"`
	EdgeCount  int    `json:"edge_count"`
	GroupCount int    `json:"group_count"`

	Groups []DagGraphGroup `json:"groups"`
	// Nodes is the per-node overlay, or null when the workflow is too
	// large to list node by node. NodesOmitted then says so and
	// NodesOmittedReason says why.
	Nodes              []DagGraphNode `json:"nodes"`
	NodesOmitted       bool           `json:"nodes_omitted,omitempty"`
	NodesOmittedReason string         `json:"nodes_omitted_reason,omitempty"`

	// ApproximateLayering is set when the grouping is not the exact
	// structural one -- a cycle, or a refinement that hit its bound -- so
	// the group layering is a best effort rather than a topology.
	ApproximateLayering bool `json:"approximate_layering,omitempty"`

	// StateSources names which of status-file/dot-file/queue/archive
	// actually contributed a node state.
	StateSources []string `json:"state_sources"`
	// StatusFileTime is the node status file's own timestamp, present
	// only when that file contributed. It matters: the queue half of this
	// response is live, while the status file is only as fresh as DAGMan's
	// last write plus the last whole-sandbox fetch.
	StatusFileTime int64 `json:"status_file_time,omitempty"`
	// Warnings carry what could not be consulted, so a missing archive
	// reads as "not available" rather than as "nothing ran".
	Warnings []string `json:"warnings,omitempty"`
	// FetchedAt is when the structure and the node states in this answer
	// were actually read out of the spool -- NOT when this response was
	// assembled. On a cached load those are minutes apart, and the panel
	// reports this as the age of what it is drawing.
	FetchedAt time.Time `json:"fetched_at"`
	// TookMS is how long this request spent producing the answer, which
	// is the number the panel shows and the one an operator compares a
	// cached load against a refresh with.
	TookMS int64 `json:"took_ms"`
}

type DashboardActivity struct {
	HoldReasons []HoldReasonCount `json:"hold_reasons,omitempty"`

	RecentlySubmitted []RecentJob `json:"recently_submitted,omitempty"`
	RecentlyStarted   []RecentJob `json:"recently_started,omitempty"`
	RecentlyHeld      []RecentJob `json:"recently_held,omitempty"`
	RecentlyCompleted []RecentJob `json:"recently_completed,omitempty"`

	// CompletedAvailable is false when nothing could answer "what
	// finished recently". Reported rather than left as an empty list,
	// which would read as "nothing finished".
	CompletedAvailable bool `json:"completed_available"`
	// CompletedPartial says the list came from the queue alone -- the
	// handful still in JobStatus == 4 before the reaper destroys them.
	// That is minutes of history at best, and a viewer told otherwise
	// would read a short list as a quiet access point.
	CompletedPartial bool `json:"completed_partial"`

	// HoldWindowSeconds is the span the hold breakdown covers. Reported
	// rather than assumed: the rows answer "why did jobs BECOME held
	// recently", which is a different question from the HELD tile beside
	// them, and a reader who takes it for the latter will conclude the
	// backlog vanished.
	HoldWindowSeconds int64 `json:"hold_window_seconds,omitempty"`

	// Source is what answered, and ComputedAt when. A cached snapshot is
	// minutes old by design; saying so is the difference between a stale
	// number and a wrong one.
	Source     string `json:"source"`
	ComputedAt int64  `json:"computed_at"`
}

type DashboardActivityResponse struct {
	Activity DashboardActivity `json:"activity"`
	// Goodput is absent where nothing could answer it -- no history
	// archive means no rate, and an omitted field says that where a
	// zeroed one would read as "everything failed".
	Goodput *GoodputSummary `json:"goodput,omitempty"`
}

type DashboardResponse struct {
	Username     string         `json:"username"`
	JobsByStatus map[string]int `json:"jobs_by_status"`
	JobsTotal    int            `json:"jobs_total"`
	// Activity is the "how is this access point doing" half: why jobs
	// are held, and what changed recently. Computed from the same walk
	// as the counts.
	// Activity and Goodput are served by /api/v1/dashboard/activity and
	// omitted here. They stay on the type so a client that has not moved
	// yet gets a response missing two optional fields rather than one
	// that fails to decode.
	Activity DashboardActivity `json:"activity,omitzero"`
	// Goodput is absent where nothing could answer it -- no history
	// archive means no rate, and an omitted field says that where a
	// zeroed one would read as "everything failed".
	Goodput *GoodputSummary `json:"goodput,omitempty"`
}

type DeviceAuthorizationResponse struct {
	DeviceCode              string `json:"device_code"`
	UserCode                string `json:"user_code"`
	VerificationURI         string `json:"verification_uri"`
	VerificationURIComplete string `json:"verification_uri_complete,omitempty"`
	ExpiresIn               int    `json:"expires_in"`
	Interval                int    `json:"interval,omitempty"`
}

type DeviceCodeHandler struct {
	// contains filtered or unexported fields
}

type ErrorResponse struct {
	Error   string `json:"error"`
	Message string `json:"message,omitempty"`
	Code    int    `json:"code"`
}

type ExitCodeCount struct {
	// Code is the exit status. Signal is set instead when the job was
	// killed, in which case Code has no meaning.
	Code   int64 `json:"code"`
	Signal bool  `json:"signal"`
	Count  int   `json:"count"`
	// Seconds is the wall clock spent on jobs that ended this way.
	Seconds int64 `json:"seconds"`
}

type GoodputSummary struct {
	WindowHours int `json:"window_hours"`
	// Since is the exact lower bound the numbers were computed over, so
	// a drill-down can ask the archive the same question and get a list
	// whose length matches the count that was clicked. Deriving it in
	// the browser from WindowHours would drift by the age of the
	// response.
	Since int64 `json:"since"`

	// Succeeded is jobs that ran to completion and said so: exit 0, not
	// killed by a signal.
	Succeeded int `json:"succeeded"`
	// Failed is jobs that ran to completion and reported a problem --
	// a non-zero exit or a fatal signal.
	Failed int `json:"failed"`
	// Unfinished is jobs that left without an outcome, which is what a
	// removal looks like from here. Counted separately rather than
	// folded into failures: a job its owner cancelled is not the access
	// point going wrong.
	Unfinished int `json:"unfinished"`

	// GoodSeconds and BadSeconds are wall-clock time on the execute
	// node, split the same way. This is the half that makes the panel
	// worth having.
	GoodSeconds int64 `json:"good_seconds"`
	BadSeconds  int64 `json:"bad_seconds"`

	// TopFailures ranks the exit codes behind Failed, because "412 jobs
	// failed" and "412 jobs failed with exit 127" are different amounts
	// of information.
	TopFailures []ExitCodeCount `json:"top_failures,omitempty"`
}

type GrantRef struct {
	RequestID string
	ClientID  string
	Subject   string
	Signature string
}

type Handler struct {
	// contains filtered or unexported fields
}

type HandlerConfig struct {
	ScheddName string // Schedd name
	ScheddAddr string // Schedd address (e.g., "127.0.0.1:9618"). If empty, discovered from collector.

	// ScheddAddrDiscovered says ScheddAddr was resolved from the collector
	// rather than set by an operator.
	//
	// It matters because the two look identical here and behave
	// differently: a pinned address is honoured even when the collector
	// disagrees, while a discovered one must follow the collector. The
	// daemon resolves the address in main() and passes the result, so
	// without this every deployment that only sets SCHEDD_NAME looked
	// pinned -- and kept dialling the dead socket of a schedd that had
	// restarted, forever. See issue #308.
	ScheddAddrDiscovered bool
	// ScheddHost is the SCHEDD_HOST setting: the host (optionally
	// "name@host", optionally with a port) whose schedd to talk to.
	// Consulted when neither ScheddAddr nor ScheddName is set; it picks
	// that host's schedd rather than whichever one the collector
	// happens to list first.
	ScheddHost string
	// InteractiveExtraSubmit holds extra HTCondor submit-file
	// directives merged into the submit file produced for each
	// interactive-terminal and JupyterLab job. The string value is
	// spliced in verbatim just before the `queue` directive, so it
	// can override or extend anything the builder emits (typical
	// use: pin an accounting group, add +ProjectName, set a
	// site-wide `requirements` fragment, force `concurrency_limits`,
	// etc.).
	//
	// Trust model: the value comes from operator-only configuration
	// (HTCondor config or env), so it's inserted into every submit
	// file verbatim — no whitelist, no quoting. Treat this as the
	// operator's hook into job admission policy, equivalent in
	// privilege to writing the schedd's site_local config.
	//
	// Multi-line content is supported via HTCondor config syntax (a
	// quoted multi-line value, or backslash continuations). Empty
	// disables the feature. Configurable via
	// HTTP_API_INTERACTIVE_EXTRA_SUBMIT.
	InteractiveExtraSubmit string

	// DagmanPath is where condor_dagman lives on the access point
	// (HTTP_API_DAGMAN_PATH). Empty means the package default.
	DagmanPath string

	// DagmanEnvironment is extra environment for the DAGMan manager job
	// (HTTP_API_DAGMAN_ENVIRONMENT).
	DagmanEnvironment map[string]string

	// InteractiveRequirements is an optional ClassAd expression ANDed into
	// the interactive terminal job's Requirements.
	//
	// It exists because a terminal is only useful if it can be attached to,
	// and whether that works is a property of the machine. condor_ssh_to_job
	// enters the job's namespace with setns, which fails when the container
	// runtime made that namespace as root and HTCondor is not root -- the
	// job runs, and every attempt to open a shell on it fails. Constraining
	// where these jobs land is the only lever the submitter has.
	//
	// Operator-only configuration, never caller-supplied: it is an
	// expression, and a submitter who could set it could widen their own
	// match rather than narrow it.
	InteractiveRequirements string

	// Build is the site's container-build configuration, handed to the
	// MCP server's build_container tool. See mcpserver.BuildConfig.
	Build mcpserver.BuildConfig
	// DBMirrorTokenSubject overrides the identity the htcondordb token
	// asserts, default "condor@<trust domain>". Configure via
	// HTTP_API_DBMIRROR_TOKEN_SUBJECT.
	DBMirrorTokenSubject string

	// SubmitFileDefaults are submit-file lines applied to every
	// submission ONLY where the submit file is silent, so a user who
	// sets the same command keeps their own value. Configure via
	// HTTP_API_SUBMIT_FILE_DEFAULTS.
	SubmitFileDefaults string
	// SubmitFileOverrides are submit-file lines applied to every
	// submission that WIN over whatever the submit file says. Use for
	// requirements that are not the user's to opt out of -- an access
	// point that rejects a `log =` outside the home directory, say.
	// Configure via HTTP_API_SUBMIT_FILE_OVERRIDES.
	//
	// Same trust model as InteractiveExtraSubmit: operator-only config,
	// spliced in verbatim.
	SubmitFileOverrides string
	UserHeader          string // HTTP header to extract username from (optional)
	// UserHeaderTrustedProxies is a list of CIDRs from which UserHeader
	// is honored. When UserHeader is set, this list MUST be non-empty
	// (or UserHeaderTrustAnyUnsafe must be true) — otherwise the
	// header is silently ignored, treating the request as
	// unauthenticated. Configure via HTTP_API_USER_HEADER_TRUSTED_PROXIES
	// (comma-separated CIDRs, e.g. "127.0.0.1/32,::1/128,10.0.0.0/8")
	// or programmatically.
	UserHeaderTrustedProxies []string

	// TrustedProxies lists CIDRs (or bare addresses) whose X-Forwarded-For
	// and X-Real-IP headers are honoured for access logging. Empty means
	// no forwarded header is believed and the peer address is logged.
	// Configure via HTTP_API_TRUSTED_PROXIES.
	TrustedProxies []string
	// UserHeaderTrustAnyUnsafe disables the trusted-proxy check and
	// accepts UserHeader from any source. This is the demo / test
	// mode only — it is unsafe in any production deployment because
	// it lets any client spoof identity by setting the header.
	// Configure via HTTP_API_USER_HEADER_TRUST_ANY=1 (loud warning
	// at startup).
	UserHeaderTrustAnyUnsafe bool
	SigningKeyPath           string // Path to token signing key (optional, for token generation)
	TrustDomain              string // Trust domain for token issuer (optional; only used if UserHeader is set)
	UIDDomain                string // UID domain for generated token username (optional; only used if UserHeader is set)
	HTTPBaseURL              string // Base URL for HTTP API (e.g., "http://localhost:8080") for generating file download links in MCP responses

	// MCPBaseURL is the public base URL of the MCP listener, when MCP has
	// its own port and that port is published under a different origin
	// than the web UI. Empty means MCP is reached at the same base URL as
	// everything else, which is true whenever the ports are combined and
	// whenever a split is only local.
	//
	// It exists for one attribute: RFC 9728 requires the protected-resource
	// document to name the resource the client asked about, and a client
	// that reaches MCP on another origin asked about that origin. Naming
	// the web UI's instead makes the document one the client must reject.
	MCPBaseURL string
	// CCB decides how to reach a daemon behind a Condor Connection Broker:
	// on an inbound path of this server's own (see sharedportrouter), or by
	// having the broker relay. Set once by the operator and applied to every
	// surface that reaches into a running job -- a shell, a session, tailing
	// output -- so two of them cannot disagree. Nil keeps cedar's default,
	// which only works on a host the execute nodes can reach.
	CCB           *htcondor.CCBDialer
	TLSCACertFile string              // Path to TLS CA certificate file (optional, for trusting self-signed certs)
	Collector     *htcondor.Collector // Collector for metrics (optional)

	// htcondordb mirror routing. Empty/false is the default: discover
	// whatever htcondordb advertises to the collector and use it as an
	// optional accelerator. See dbmirror.Options for what each does and
	// when an operator needs it.
	DBMirrorName     string // HTTP_API_DBMIRROR_NAME: pin routing to this mirror
	DBMirrorAddress  string // HTTP_API_DBMIRROR_ADDRESS: dial this sinful instead of the advertised one
	DBMirrorRequired bool   // HTTP_API_DBMIRROR_REQUIRED: fail rather than fall back to the schedd

	JobQueueLogPath string        // schedd job_queue.log to mirror for /api/v1/jobs/watch (optional)
	EnableMetrics   bool          // Enable /metrics endpoint (default: true if Collector is set)
	MetricsCacheTTL time.Duration // Metrics cache TTL (default: 10s)
	// MetricsPublic disables the API-key auth gate on /metrics. Use
	// only when network ACLs already isolate the endpoint (e.g. a
	// private listening address or a sidecar proxy). Default: false
	// — an admin must mint an API key with the `metrics` scope and
	// configure Prometheus to send it as a Bearer token.
	MetricsPublic bool
	Logger        *logging.Logger // Logger instance (optional, creates default if nil)
	EnableMCP     bool            // Enable MCP endpoints with OAuth2 (default: false)

	// DBPath is the unified SQLite database file backing OAuth2/MCP
	// storage, the embedded IDP, browser sessions, and user-saved
	// batch-submission templates. Defaults to LOCAL_DIR/htcondor-api.db
	// (or /var/lib/condor/htcondor-api.db when LOCAL_DIR is unset).
	// Configure via HTTP_API_DB_PATH.
	DBPath string

	// KEKFilePath is the path to a file holding the master Key
	// Encryption Key used to envelope-encrypt long-lived secrets in
	// the application database (the OAuth2 / IDP issuer's RSA
	// signing key, fosite's HMAC GlobalSecret). Configured via
	// HTTP_API_KEK_FILE — the FILE PATH lives in HTCondor config,
	// the KEY BYTES never do (HTCondor treats config values as
	// public).
	//
	// Empty disables encryption: secrets are stored in plaintext as
	// before. When set, the file must contain exactly 32 raw bytes
	// or a 32-byte hex string and must be 0600/0400. See
	// httpserver/appdb/seal for the design.
	KEKFilePath string

	// OAuth2DBPath is a deprecated alias for DBPath kept so existing
	// in-process embedders (and the test suite) keep compiling without
	// a wholesale rename. NewHandler honors it only when DBPath is
	// empty. The cmd-line wrapper does NOT bridge HTTP_API_OAUTH2_DB_PATH
	// into this field — pointing the unified DB at a pre-unification
	// oauth.db is a guaranteed crash-loop (the legacy schema conflicts
	// with goose 0001_init.sql), and the wrapper logs a deprecation
	// warning instead. New code should set DBPath.
	OAuth2DBPath string
	OAuth2Issuer string // OAuth2 issuer URL (default: listen address)
	// MCPCIMDEnabled resolves an https:// MCP client_id as a Client ID Metadata
	// Document (a public client) instead of requiring DCR. MCPCIMDAllowedHosts,
	// when set, restricts which hosts such a client_id may point at.
	MCPCIMDEnabled      bool
	MCPCIMDAllowedHosts []string
	// MCPTokenExchangeIssuers is the JSON list of trusted external issuers for
	// RFC 8693 token exchange (HTTP_API_MCP_TOKEN_EXCHANGE_ISSUERS). Empty = off.
	MCPTokenExchangeIssuers string
	OAuth2ClientID          string   // OAuth2 client ID for SSO (optional)
	OAuth2ClientSecret      string   // OAuth2 client secret for SSO (optional)
	OAuth2AuthURL           string   // OAuth2 authorization URL for SSO (optional)
	OAuth2TokenURL          string   // OAuth2 token URL for SSO (optional)
	OAuth2RedirectURL       string   // OAuth2 redirect URL for SSO (optional)
	OAuth2UserInfoURL       string   // OAuth2 user info endpoint for SSO (optional)
	OAuth2Scopes            []string // OAuth2 scopes to request (default: ["openid", "profile", "email"])
	OAuth2UsernameClaim     string   // Claim name for username in token (default: "sub")
	OAuth2GroupsClaim       string   // Claim name for groups in user info (default: "groups")
	// OAuth2Requirements is a ClassAd expression evaluated against the
	// token's claims at login. Empty means no policy.
	OAuth2Requirements string

	// IdentityMapStrategies is the ordered list of ways to turn an OIDC
	// subject into a local account -- "gecos", "username", or both, as in
	// "gecos,username". Empty disables mapping entirely. When set, group
	// membership comes from the system rather than the token, and a
	// caller that maps to no single account is refused a session.
	IdentityMapStrategies []idmap.Strategy
	// IdentityGroupSources lists where group membership comes from, as
	// parsed specs: "system" and/or "file:<path>". Empty keeps the
	// token's groups claim, which is what a container wants because it
	// holds no account database to read. Independent of
	// IdentityMapStrategies: a deployment may want either, both, or
	// neither. Several sources are unioned, the way glibc merges NSS
	// services, so a site can carry directory groups and hand-maintained
	// ones at once.
	IdentityGroupSources []string
	// IdentityMapPasswdFile reads accounts from this file instead of
	// /etc/passwd. Empty means /etc/passwd, which is the only account
	// source that enumerates: the GECOS index cannot list accounts that
	// live only in a directory. Accounts it does map are still verified
	// against the live database, directory included.
	IdentityMapPasswdFile string
	// IdentityMapTTL is how long the GECOS index and the group lookups
	// are reused. Zero means five minutes.
	IdentityMapTTL time.Duration

	// IdentityMapStripDomain also tries the local part of a scoped
	// subject -- "bockelman@wisc.edu" as "bockelman". Only sound where
	// something else constrains which identity providers may log in,
	// since the local part is not unique across domains.
	IdentityMapStripDomain bool
	// OAuth2AccessTokenLifespan is how long an access token issued by the embedded
	// MCP issuer is valid. Defaults to 1 hour if zero.
	OAuth2AccessTokenLifespan time.Duration
	// OAuth2RefreshTokenLifespan is how long a refresh token issued by the embedded
	// MCP issuer is valid. Defaults to 30 days if zero. Must be >= OAuth2AccessTokenLifespan;
	// otherwise refresh grants will fail before the access token expires (see PelicanPlatform/pelican#3389).
	OAuth2RefreshTokenLifespan time.Duration
	// OAuth2MaxGrantLifetime caps the total age of a grant, measured from
	// the consent that created it, regardless of how often it is
	// refreshed. Defaults to DefaultMaxGrantLifetime (30 days) if zero.
	//
	// This is distinct from OAuth2RefreshTokenLifespan, which every
	// refresh resets: without a cap, a client that refreshes more often
	// than the refresh lifespan holds its access indefinitely, so removing
	// a user's entitlement never expires anything. The cap is the backstop
	// that bounds that exposure even when no revocation oracle notices the
	// removal. See reauthorizeRefreshGrant.
	//
	// Configurable via HTTP_API_OAUTH2_MAX_GRANT_LIFETIME.
	OAuth2MaxGrantLifetime time.Duration
	// OAuth2RevocationOracles names the oracles consulted on every refresh
	// grant to decide whether the user is still entitled to what they hold.
	// Recognized values:
	//
	//   "schedd-userrec" — honor `condor_qusers -disable <user>`. Reads the
	//       schedd's per-user record (READ authorization) and revokes the
	//       grant when it says Enabled=false, surfacing DisableReason.
	//       Cheap, and acts only on an explicit administrative decision.
	//   "schedd-acl"     — probe the schedd's ALLOW_READ / ALLOW_WRITE ACLs
	//       with DC_SEC_QUERY and strip scopes it refuses. Costs up to two
	//       extra schedd round trips per refresh and tells you nothing in a
	//       pool whose ACLs are wildcards, so it is opt-in.
	//
	// Nil selects the default set (schedd-userrec). An explicitly empty,
	// non-nil slice disables all oracles; the grant lifetime cap still
	// applies. Unrecognized names are logged and ignored.
	//
	// Configurable via HTTP_API_OAUTH2_REVOCATION_ORACLES, where the
	// literal "none" is the spelling for the empty set — a config file
	// cannot express nil-versus-empty on its own.
	OAuth2RevocationOracles []string
	// SuperuserGroup gates superuser mode, in which an administrator acts
	// on another user's jobs as that user. Empty (the default) disables it.
	//
	// Intentionally separate from WebUIAdminGroup. That group means "may
	// read the admin pages"; this one means "may act as anyone on this
	// access point", a categorically larger privilege that deserves its own
	// decision and its own off switch.
	//
	// Superuser mode additionally requires a pool signing key: without one
	// this server cannot mint the credential it would act under, so the
	// feature stays off however this is set.
	//
	// Configurable via HTTP_API_SUPERUSER_GROUP.
	SuperuserGroup string
	// SuperuserRefreshInterval is how often the schedd's QUEUE_SUPER_USERS
	// set is re-read. Zero selects defaultSuperuserRefresh.
	SuperuserRefreshInterval time.Duration
	// SuperuserFallbackIdentity is the identity used when the operator is
	// not themselves a usable queue superuser. Empty selects
	// "condor@$(UID_DOMAIN)".
	//
	// That default suits a schedd running as the condor user, where
	// real_owner_is_condor matches the daemon's own OS user. It does NOT
	// suit a personal condor: there personal_condor is true, that branch is
	// disabled, and the equivalent identity is the user the pool runs as.
	// Deployments that run the schedd as something else need this knob, and
	// so does any test that wants to exercise the fallback without root.
	//
	// Configurable via HTTP_API_SUPERUSER_FALLBACK_IDENTITY.
	SuperuserFallbackIdentity string
	// SuperuserArmTTL is how long superuser mode stays on before disarming
	// itself. Zero selects defaultSuperuserArmTTL.
	SuperuserArmTTL time.Duration
	MCPAccessGroup  string // Group required for any MCP access (empty = all authenticated)
	MCPReadGroup    string // Group required for read operations (empty = all have read)
	MCPWriteGroup   string // Group required for write operations (empty = all have write)
	// MCPAdminGroup grants the mcp:admin scope -- reading every user's
	// jobs through MCP. Empty disables it: unlike MCPReadGroup and
	// MCPWriteGroup, an empty value here grants the privilege to NOBODY
	// rather than to everybody. HTTP_API_MCP_ADMIN_GROUP.
	MCPAdminGroup string
	// MCPSuperuserGroup grants the mcp:superuser scope -- changing
	// another user's jobs (remove, hold, release, edit). Empty disables.
	//
	// Separate from MCPAdminGroup for the same reason SuperuserGroup is
	// separate from WebUIAdminGroup: seeing every job and being able to
	// remove every job are different privileges, and the second deserves
	// its own decision and its own off switch.
	// HTTP_API_MCP_SUPERUSER_GROUP.
	MCPSuperuserGroup string
	MCPInstructions   string // Server-level instructions provided to all MCP agents (e.g., AP-specific guidance)
	// MCPDisabledTools (HTTP_API_MCP_DISABLED_TOOLS) names tools this site cannot
	// offer, as path.Match patterns separated by commas or whitespace.
	MCPDisabledTools string
	// MCPSkillsReloadInterval is how often to re-read MCPSkillsDir.
	MCPSkillsReloadInterval time.Duration
	// MCPSkillsDir is a directory of site-authored Markdown skills to
	// publish to agents. Empty disables the feature.
	MCPSkillsDir string
	// MCPAdminUsers lists authenticated subjects that MCP tool
	// dispatch treats as admins — most importantly they are exempt
	// from the owner-scope wrapper, so they can query and act on other
	// users' jobs. Match is exact against the authenticated actor
	// (typically "user@uid.domain"). Empty = no admins (default).
	MCPAdminUsers   []string
	WebUIAdminGroup string // Group(s) required for Web UI admin pages (empty disables admin UI). Comma-separated; HTTP_API_WEBUI_ADMIN_GROUP.

	// WebUIAccessGroup gates logging in to the web interface, separately
	// from MCP. Comma-separated; HTTP_API_WEBUI_ACCESS_GROUP. Empty falls
	// back to MCPAccessGroup.
	WebUIAccessGroup string
	EnableIDP        bool // Enable built-in IDP (always enabled in demo mode)
	// SpoolBufferDir is where cluster-wide uploads buffer their tar.
	// Empty selects the system temp directory.
	SpoolBufferDir string
	// SeedDemoUser additionally seeds a second, non-admin IDP account
	// ("user") alongside "admin", printing its generated password the
	// same way.
	//
	// Deliberately NOT keyed on EnableIDP: the built-in IDP can be turned
	// on in a real deployment with HTTP_API_ENABLE_IDP, and seeding a
	// second standing account there — with its password on stdout — is
	// not something an operator asked for. Only -demo sets this.
	//
	// It exists so tests have two identities to check authorization
	// boundaries with: an admin, and someone who is not.
	SeedDemoUser bool
	// IDPDBPath is deprecated; the IDP shares the unified DBPath.
	// Retained as an unused field so existing callers keep compiling
	// during the transition.
	IDPDBPath string //nolint:unused // kept for back-compat; ignored by NewHandler.
	IDPIssuer string // IDP issuer URL (default: listen address)
	// IDPAccessTokenLifespan / IDPRefreshTokenLifespan: see OAuth2*Lifespan above. Zero
	// uses the same defaults (1h / 30d).
	IDPAccessTokenLifespan  time.Duration
	IDPRefreshTokenLifespan time.Duration
	SessionTTL              time.Duration  // HTTP session TTL (default: 24h)
	HTCondorConfig          *config.Config // HTCondor configuration (optional, used for LOCAL_DIR default)
	// PingInterval is the cadence of the periodic collector/schedd ping
	// that feeds /readyz. Zero or negative disables it, which is what a
	// deployment with no local HTCondor credential wants: the ping has
	// nothing to authenticate with there and can only fail. There is no
	// implicit default — the shipped daemon sets this from
	// HTTP_API_PING_INTERVAL (default 1m, 0 to disable).
	PingInterval time.Duration
	// MCPWatchMaxWait caps how long the MCP watch_jobs tool may block
	// in-call before returning (HTTP_API_MCP_WATCH_MAX_WAIT). Keep it
	// under the gateway/proxy timeout in front of this daemon: a block
	// that outlives it loses the response carrying the watch id. Zero
	// uses the mcpserver default.
	MCPWatchMaxWait time.Duration
	// CreddAddress pins the credd to talk to (HTTP_API_CREDD_ADDRESS),
	// overriding discovery. Needed where a schedd does not advertise its
	// credd; otherwise the credd is read from the schedd itself.
	CreddAddress string
	// RequiredCredentials names the OAuth service credentials that must
	// exist before a job may be submitted (HTTP_API_REQUIRED_CREDENTIALS).
	// Some access points hold every job submitted without them. Each submit
	// path creates a placeholder for any that is missing; see
	// required_creds.go.
	RequiredCredentials []string
	// UpstreamRefresh is HTTP_API_UPSTREAM_REFRESH. See Config.
	UpstreamRefresh string

	// MCPUseSDKTransport serves /mcp with the upstream MCP SDK's transport
	// instead of the hand-rolled JSON-RPC handler. HTTP_API_MCP_TRANSPORT.
	MCPUseSDKTransport bool

	// TokenRetention is HTTP_API_TOKEN_RETENTION. See Config.
	TokenRetention string

	// MCPMaxRequestDuration is the hard stop on an MCP request that is
	// still making progress (HTTP_API_MCP_MAX_REQUEST_DURATION). While a
	// request runs, its write deadline is moved forward rather than being
	// the server-wide HTTP_API_WRITE_TIMEOUT, so a deliberately waiting
	// tool is bounded by this instead. Zero uses
	// DefaultMCPMaxRequestDuration.
	MCPMaxRequestDuration time.Duration
	StreamBufferSize      int                  // Buffer size for streaming queries (default: 100)
	StreamWriteTimeout    time.Duration        // Write timeout for streaming queries (default: 5s)
	Token                 string               // Token for daemon authentication (optional)
	Credd                 htcondor.CreddClient // Optional credd client; defaults to in-memory implementation
	// Placementd is an optional condor_placementd client. Nil means
	// "discover one", and a failed discovery simply leaves the
	// placement endpoints disabled. Tests inject a fake here.
	Placementd htcondor.PlacementdClient

	// LLMAPIKeyFile is the path to a file holding the Anthropic API
	// key used by the chat endpoint at /api/v1/chat. Empty disables
	// the chat feature. The bytes never live in HTCondor config —
	// only this file path does.
	LLMAPIKeyFile string
	// LLMAPIURL overrides the upstream Anthropic Messages endpoint.
	// Use to point at a self-hosted LLM gateway / cache. Empty falls
	// back to chat.DefaultAnthropicURL.
	LLMAPIURL string
	// LLMModel overrides the default Anthropic model id. Empty falls
	// back to chat.DefaultAnthropicModel.
	LLMModel string

	// LLMOperatorInstructionsFile is the path to a file containing
	// extra system-prompt rules the operator wants appended to every
	// chat turn (e.g. "users in this pool may not request more than
	// 64 GiB of memory; suggest fewer if asked"). Empty path = no
	// addendum.
	//
	// File mode is enforced 0600/0400 on load — same rationale as the
	// API-key file: the operator may put policy text here that they
	// don't want every local user to read. Loaded once at startup; a
	// hot-reload would need a server restart.
	LLMOperatorInstructionsFile string

	// JupyterWorkDir is where the embedded helper binary (materialized
	// from package jupyterhelperbin) and per-instance scratch artifacts
	// (token files) are staged. Files persist for the lifetime of the
	// job since HTCondor reads transfer_input_files at job-startup time.
	// Defaults to <os.TempDir>/htcondor-api-jupyter.
	JupyterWorkDir string
	// JupyterMaxLifetimeSec / JupyterKernelIdleSec bound a JupyterLab
	// session; see handlers_jupyter.go. Zero disables that limit.
	JupyterMaxLifetimeSec int
	JupyterKernelIdleSec  int

	// TemplateGlobalPath is an optional YAML file with operator-curated
	// batch-submission templates. Empty disables. Built-in templates
	// always ship.
	TemplateGlobalPath string

	// TemplateUserStoreDBPath is deprecated; the templates store now
	// shares the unified DBPath. Retained so existing callers
	// keep compiling; ignored by NewHandler.
	TemplateUserStoreDBPath string //nolint:unused // kept for back-compat; ignored by NewHandler.
}

type HistoryListResponse struct {
	Ads        []*classad.ClassAd `json:"ads"`
	Source     string             `json:"source,omitempty"`
	SourceNote string             `json:"source_note,omitempty"`
}

type HoldReasonCount struct {
	Code  int64  `json:"code"`
	Label string `json:"label"`
	Count int    `json:"count"`
	// Example is one hold reason string with this code, because the code
	// says the category and the message says which file or which host.
	Example string `json:"example,omitempty"`
}

type IDPProvider struct {
	// contains filtered or unexported fields
}

type IDPProviderOptions struct {
	DB                   *sql.DB
	Issuer               string
	AccessTokenLifespan  time.Duration
	RefreshTokenLifespan time.Duration
	// Sealer envelope-encrypts the IDP's RSA private key + HMAC
	// GlobalSecret. See OAuth2ProviderOptions.Sealer.
	Sealer *seal.Sealer
}

type IDPStorage struct {
	// contains filtered or unexported fields
}

type Impersonation struct {
	// Actor is the authenticated human who armed superuser mode.
	Actor string
	// Target is the job owner being acted for, derived from the job rather
	// than supplied by the caller.
	Target string
	// Identity is what this server authenticates to the schedd as. Either
	// Actor (when they are themselves a queue superuser) or the shared
	// fallback.
	Identity string
	// ActorIsSuperUser records which of those it was. When true the schedd's
	// own log names the human; when false the schedd only ever sees the
	// shared identity and this server's audit record is the only place the
	// actor appears.
	ActorIsSuperUser bool
}

type InteractiveCreateTerminalRequest struct {
	Cpus     int `json:"cpus,omitempty"`
	MemoryMB int `json:"memory_mb,omitempty"`
	DiskMB   int `json:"disk_mb,omitempty"`

	// GPU fields. Mirrored verbatim into request_gpus and the
	// gpus_minimum_* / cuda_version / require_gpus submit lines.
	// Gpus == 0 disables the entire GPU section in the submit file.
	Gpus                  int    `json:"gpus,omitempty"`
	GpusMinimumCapability string `json:"gpus_minimum_capability,omitempty"`
	GpusMinimumMemory     int    `json:"gpus_minimum_memory,omitempty"`
	GpusMinimumRuntime    string `json:"gpus_minimum_runtime,omitempty"`
	CudaVersion           string `json:"cuda_version,omitempty"`
	RequireGpus           string `json:"require_gpus,omitempty"`

	// SubmitLines are extra submit commands the user typed in the launch
	// form (e.g. "+ProjectName = ...", "environment = ..."). Untrusted:
	// validated with interactive.ValidateCallerSubmitLines, which rejects
	// anything that would redefine the session (executable, universe,
	// queue, ...). Merged before the operator's block so operator policy
	// still wins.
	SubmitLines string `json:"submit_lines,omitempty"`
}

type InteractiveCreateTerminalResponse struct {
	InstanceID string `json:"instance_id"`
	ClusterID  int    `json:"cluster_id"`
	ProcID     int    `json:"proc_id"`
	JobID      string `json:"job_id"` // "cluster.proc" — convenience for the SPA
	BatchName  string `json:"batch_name"`
}

type InteractiveTerminalSummary struct {
	InstanceID                   string `json:"instance_id"`
	JobID                        string `json:"job_id"`
	ClusterID                    int    `json:"cluster_id"`
	ProcID                       int    `json:"proc_id"`
	BatchName                    string `json:"batch_name"`
	JobStatus                    int    `json:"job_status"`
	JobCurrentStartExecutingDate int64  `json:"job_current_start_executing_date,omitempty"`
	HoldReasonCode               int    `json:"hold_reason_code,omitempty"`
	HoldReason                   string `json:"hold_reason,omitempty"`
	SubmittedAt                  string `json:"submitted_at,omitempty"` // RFC3339 from QDate
}

type IssueSection struct {
	Kind  string `json:"kind"`
	Title string `json:"title"`
	// Total and Users are over the whole section, so a section header
	// can say "4,812 jobs, 11 users" without the reader adding up rows
	// -- and so the numbers do not change when the slider does.
	Total    int              `json:"total"`
	Users    int              `json:"users"`
	Clusters []issues.Cluster `json:"clusters"`
}

type IssueTimings struct {
	// HoldsMs and RunAttemptsMs are the two reads, with what they
	// returned beside them -- a slow read of forty rows and a slow read
	// of forty thousand are different problems.
	HoldsMs       int64 `json:"holds_query_ms"`
	Holds         int   `json:"holds"`
	RunAttemptsMs int64 `json:"run_attempts_query_ms"`
	RunAttempts   int   `json:"run_attempts"`
	// ClusterMs is the grouping: masking, the parse tree, the merge pass
	// and the per-cluster summaries.
	ClusterMs int64 `json:"cluster_ms"`
	// Cached says the reads were not done for this request. Without it a
	// second page load looks fast and hides what the first one cost.
	Cached bool `json:"cached"`
	// AgeSeconds is how old the cached reads are.
	AgeSeconds int64 `json:"age_seconds,omitempty"`
}

type IssuesResponse struct {
	WindowSeconds int64 `json:"window_seconds"`
	ComputedAt    int64 `json:"computed_at"`
	// Granularity as applied, which may be the clamped form of what was
	// asked for.
	Granularity float64 `json:"granularity"`
	// IncludeEnded says whether run-attempt history was read: without
	// it the page describes what is stuck now, with it what has gone
	// wrong over the window.
	IncludeEnded bool `json:"include_ended"`
	// BucketSeconds is how much time one slice of a cluster's timeline
	// covers, so a caller can label it without re-deriving the window.
	BucketSeconds int64          `json:"bucket_seconds,omitempty"`
	Source        string         `json:"source,omitempty"`
	Truncated     bool           `json:"truncated,omitempty"`
	Notes         []string       `json:"notes,omitempty"`
	Sections      []IssueSection `json:"sections"`
	// Timings is what the answer cost to produce. Returned rather than
	// only logged: this page reads two large tables and then does real
	// work on what comes back, so "it is slow" has three possible
	// answers, and the person who can see the slowness is usually not
	// the person who can read the server's log.
	Timings *IssueTimings `json:"timings,omitempty"`
}

type JobActionFunc func(ctx context.Context, constraint, reason string) (*htcondor.JobActionResults, error)

type JobEditRequest struct {
	Attributes map[string]interface{} `json:"attributes"` // Attributes to update
}

type JobListResponse struct {
	Jobs []*classad.ClassAd `json:"jobs"`
}

type JobLogResponse struct {
	JobID     string          `json:"jobId"`
	Filename  string          `json:"filename"`
	Truncated bool            `json:"truncated"`
	Events    []userlog.Event `json:"events"`
}

type JobSubmitRequest struct {
	SubmitFile string `json:"submit_file"` // Submit file content
}

type JobSubmitResponse struct {
	ClusterID int      `json:"cluster_id"`
	JobIDs    []string `json:"job_ids"` // Array of "cluster.proc" strings
}

type JupyterCreateRequest struct {
	// Image is the Docker image to launch. Default
	// quay.io/jupyter/scipy-notebook:latest.
	Image string `json:"image"`
	// Cpus is the requested core count. Default 2.
	Cpus int `json:"cpus"`
	// MemoryMB is the requested RAM in mebibytes. Default 4096.
	MemoryMB int `json:"memory_mb"`
	// DiskMB is the requested scratch disk in mebibytes. Default 4096.
	DiskMB int `json:"disk_mb"`

	// GPU fields. Mirrored verbatim into request_gpus and the
	// gpus_minimum_* / cuda_version / require_gpus submit lines.
	// Gpus == 0 disables the entire GPU section in the submit file.
	Gpus                  int    `json:"gpus,omitempty"`
	GpusMinimumCapability string `json:"gpus_minimum_capability,omitempty"`
	GpusMinimumMemory     int    `json:"gpus_minimum_memory,omitempty"`
	GpusMinimumRuntime    string `json:"gpus_minimum_runtime,omitempty"`
	CudaVersion           string `json:"cuda_version,omitempty"`
	RequireGpus           string `json:"require_gpus,omitempty"`

	// SubmitLines are extra submit commands the user typed in the launch
	// form. Untrusted: validated with interactive.ValidateCallerSubmitLines,
	// which rejects anything that would redefine the job (executable,
	// universe, container_image, queue, ...). Merged before the operator's
	// extras so operator policy still wins.
	SubmitLines string `json:"submit_lines,omitempty"`
}

type JupyterCreateResponse struct {
	InstanceID string `json:"instance_id"`
	ClusterID  string `json:"cluster_id"`
	// ProxyPath is where the browser should eventually point its iframe
	// (only useful once the helper has connected back; the SSE stream
	// from /events tells you when).
	ProxyPath string `json:"proxy_path"`
}

type JupyterInstanceSummary struct {
	InstanceID                   string `json:"instance_id"`
	ClusterID                    string `json:"cluster_id,omitempty"`
	Image                        string `json:"image,omitempty"`
	Owner                        string `json:"owner"`
	CreatedAt                    string `json:"created_at"`
	Connected                    bool   `json:"connected"` // helper has dialed back
	ProxyPath                    string `json:"proxy_path"`
	EventsPath                   string `json:"events_path"`
	JobStatus                    int    `json:"job_status,omitempty"`
	JobCurrentStartExecutingDate int64  `json:"job_current_start_executing_date,omitempty"`
	HoldReasonCode               int    `json:"hold_reason_code,omitempty"`
	HoldReason                   string `json:"hold_reason,omitempty"`
}

type LoginRateLimiter struct {
	// contains filtered or unexported fields
}

type OAuth2Provider struct {
	// contains filtered or unexported fields
}

type OAuth2ProviderOptions struct {
	DB                   *sql.DB
	Issuer               string
	AccessTokenLifespan  time.Duration
	RefreshTokenLifespan time.Duration
	// Sealer envelope-encrypts long-lived secrets in the DB (the
	// issuer's RSA private key, fosite's HMAC GlobalSecret). When
	// non-nil, the storage adapter pulls/pushes ciphertext + wrapped
	// DEK on the corresponding load/save calls. Nil = plaintext.
	Sealer *seal.Sealer

	// CIMDEnabled turns on Client ID Metadata Document resolution: an https://
	// client_id is fetched and treated as a public client (see oauth2_cimd.go).
	CIMDEnabled bool
	// CIMDAllowedHosts optionally restricts which hosts a CIMD client_id may
	// point at; empty means any host (the SSRF guards still apply).
	CIMDAllowedHosts []string
}

type OAuth2StateEntry struct {
	AuthorizeRequest fosite.AuthorizeRequester
	Timestamp        time.Time
	OriginalURL      string   // Original URL to redirect back to after authentication
	Username         string   // Authenticated username for consent flow
	Groups           []string // User groups for scope filtering in consent flow
}

type OAuth2StateStore struct {
	// contains filtered or unexported fields
}

type OAuth2Storage struct {
	// contains filtered or unexported fields
}

type PeekResponse struct {
	Stdout *PeekedStreamResponse `json:"stdout,omitempty"`
	Stderr *PeekedStreamResponse `json:"stderr,omitempty"`
}

type PeekedStreamResponse struct {
	Text   string `json:"text"`
	Offset int64  `json:"offset"`
}

type PingResponse struct {
	Daemon         string `json:"daemon"`               // "collector" or "schedd"
	AuthMethod     string `json:"auth_method"`          // Authentication method used
	User           string `json:"user"`                 // Authenticated username
	SessionID      string `json:"session_id"`           // Session identifier
	ValidCommands  string `json:"valid_commands"`       // Commands authorized
	Encryption     bool   `json:"encryption"`           // Whether encryption is enabled
	Authentication bool   `json:"authentication"`       // Whether authentication is enabled
	Authorized     bool   `json:"authorized,omitempty"` // Whether authorized for requested permission (if permission checked)
	Permission     string `json:"permission,omitempty"` // Permission level checked (if any)
}

type ReauthDecision struct {
	// Status is the verdict on the user as a whole.
	Status UserStatus
	// Reason is a short operator-facing explanation, surfaced in logs and
	// (for revocations) in the OAuth2 error description. HTCondor's
	// per-user records carry a DisableReason string that lands here.
	Reason string
	// DeniedScopes are scopes the oracle says this user may no longer
	// hold, even when Status is Active. They are removed from the
	// refreshed grant rather than failing it, so a user who loses write
	// access keeps working read-only instead of being logged out.
	DeniedScopes []string
}

type RecentJob struct {
	ClusterID int64  `json:"cluster_id"`
	ProcID    int64  `json:"proc_id"`
	Owner     string `json:"owner,omitempty"`
	// At is when the event this list is about happened, unix seconds.
	At int64 `json:"at"`
	// Detail is the one fact worth showing beside it: a hold reason, the
	// executable, the host it started on.
	Detail string `json:"detail,omitempty"`
	// Archived says this row came from the history archive rather than
	// the live queue, which decides where a click on it should go. The
	// queue destroys a finished job within seconds, so most completions
	// shown here no longer have a job page -- linking them all to one
	// sent people to "not found".
	Archived bool `json:"archived,omitempty"`
}

type RevocationOracle interface {
	// Name identifies the oracle in log lines.
	Name() string
	// Check reports on username, which is the grant's subject. scopes is
	// the set currently granted, so an oracle can skip work for scopes
	// nobody holds.
	Check(ctx context.Context, username string, scopes []string) (ReauthDecision, error)
}

type ScheddACLOracle struct {
	Schedd    func() *htcondor.Schedd
	UIDDomain string
	Logger    *logging.Logger
	// MintToken produces an HTCondor IDTOKEN asserting username, used as
	// the probe credential. The scopes argument is passed through to the
	// handler's minter; Check passes nil so the probe token carries no
	// limit_authz narrowing (see Check for why).
	MintToken func(username string, scopes []string) (string, error)
}

type Server struct {
	*Handler // Embedded handler for business logic
	// contains filtered or unexported fields
}

type Session struct {
	*openid.DefaultSession

	// Groups is the group list asserted by the upstream IDP (or the
	// browser session) at the time consent was granted.
	Groups []string `json:"groups,omitempty"`

	// AuthTime is when the user authenticated and consented, in UTC.
	// It is deliberately NOT refreshed when the grant is refreshed.
	AuthTime time.Time `json:"authTime,omitempty"`

	// AuthorizedScopes is what this authorization ENDED with: the set the
	// policy allowed and the user did not untick, recorded once at
	// consent and carried unchanged across every refresh.
	//
	// It is the bound on what an operator may re-enable from the admin
	// page. GrantedScope is the set in force now, which an operator may
	// have narrowed; this is the set that narrowing started from, so
	// putting one back is restoring something this user already agreed
	// to rather than granting something new. A scope the user unticked at
	// consent never appears here, so no operator can undo that choice.
	AuthorizedScopes []string `json:"authorizedScopes,omitempty"`

	// Actor names the client that obtained this token by RFC 8693 token
	// exchange on the subject's behalf (delegation): the token acts AS Subject
	// but was minted FOR this actor. Empty for tokens obtained directly. It is
	// the `act.sub` an exchanged token records, and is surfaced for audit and
	// on the HTCondor IDTOKEN minted downstream.
	Actor string `json:"actor,omitempty"`
}

type SessionData struct {
	Username  string    // Authenticated username
	Groups    []string  // User groups from IDP (for scope filtering)
	CreatedAt time.Time // When the session was created
	ExpiresAt time.Time // When the session expires
}

type SessionStore struct {
	// contains filtered or unexported fields
}

type ShareInputResponse struct {
	ClusterID      int                `json:"cluster_id"`
	Owner          string             `json:"owner"`
	ExpiresAt      time.Time          `json:"expires_at"`
	TTLSeconds     int                `json:"ttl_seconds"`
	Count          int                `json:"count"`
	ProcsRemaining int                `json:"procs_remaining,omitempty"`
	Uploads        []ShareInputUpload `json:"uploads"`
	Note           string             `json:"note,omitempty"`
}

type ShareInputUpload struct {
	JobID         string   `json:"job_id"`
	URL           string   `json:"url"`
	ExpectedFiles []string `json:"expected_files"`
}

type ShareOutputRequest struct {
	TTLSeconds int `json:"ttl_seconds,omitempty"`
}

type ShareOutputResponse struct {
	URL        string    `json:"url"`
	ExpiresAt  time.Time `json:"expires_at"`
	TTLSeconds int       `json:"ttl_seconds"`
	Owner      string    `json:"owner"`
}

type ShareWatchRequest struct {
	TTLSeconds int `json:"ttl_seconds,omitempty"`
}

type ShareWatchResponse struct {
	URL        string    `json:"url"`
	WatchID    string    `json:"watch_id"`
	Owner      string    `json:"owner"`
	ExpiresAt  time.Time `json:"expires_at"`
	TTLSeconds int       `json:"ttl_seconds"`
	// MaxWaitSeconds is what the redeem endpoint will block for, so a
	// poller can size its own client timeout from the answer rather than
	// from a number hard-coded on its side.
	MaxWaitSeconds     int `json:"max_wait_seconds"`
	DefaultWaitSeconds int `json:"default_wait_seconds"`
}

type SharedInputResult struct {
	Message       string   `json:"message"`
	JobID         string   `json:"job_id"`
	ExpectedFiles []string `json:"expected_files"`
	IgnoredFiles  []string `json:"ignored_files,omitempty"`
	Warning       string   `json:"warning,omitempty"`
}

type SuperuserModeRequest struct {
	Enabled bool `json:"enabled"`
}

type SuperuserModeResponse struct {
	Active    bool       `json:"active"`
	ExpiresAt *time.Time `json:"expires_at,omitempty"`
	// Identity is what the server will authenticate to the schedd as while
	// the mode is on, and ActorIsQueueSuperUser whether that is the caller
	// themselves. Surfaced because the two differ in how well the action
	// can be attributed: as themselves, the schedd records the human; via
	// the shared account, only this server and the job's reason string do.
	Identity              string `json:"identity,omitempty"`
	ActorIsQueueSuperUser bool   `json:"actor_is_queue_superuser,omitempty"`
	// Note explains a fallback when one happened, including how to fix it.
	// Empty when the operator is acting as themselves.
	Note string `json:"note,omitempty"`
}

type TokenCache struct {
	// contains filtered or unexported fields
}

type TokenCacheEntry struct {
	Token        string
	Username     string // sub from the JWT — unverified until Validated == true
	Validated    bool   // true once a schedd op authenticated successfully with this token
	Expiration   time.Time
	SessionCache *security.SessionCache
	// contains filtered or unexported fields
}

type UpstreamRefreshMode string

type UserInfo struct {
	Subject string                 `json:"sub"`
	Email   string                 `json:"email"`
	Name    string                 `json:"name"`
	Groups  interface{}            `json:"groups"` // Can be []string or string
	Claims  map[string]interface{} // Additional claims
}

type UserRecordLookup interface {
	GetUserRecord(ctx context.Context, user string) (*htcondor.UserRecord, error)
}

type UserRecordOracle struct {
	// Lookup supplies the current schedd client. It is a function rather
	// than a value because the handler re-creates its Schedd when the
	// daemon's address changes.
	Lookup func() UserRecordLookup
	// UIDDomain qualifies bare usernames before the lookup; schedd records
	// are keyed on the fully-qualified "user@domain" form.
	UIDDomain string
	Logger    *logging.Logger
	// Strict makes "no record at all" a revocation instead of no opinion.
	//
	// Off by default, because the schedd creates records lazily on first
	// submit: in an ordinary pool "no record" means "has never submitted
	// here", and revoking on it would cut off every new user.
	//
	// It becomes correct — and much stronger — in a pool that provisions a
	// record for every user up front, since `condor_qusers -add <user>`
	// (ENABLE_USERREC with the create option) creates one without the user
	// submitting anything. There, absence really does mean "not a user of
	// this AP", and `condor_qusers -delete` becomes a revocation an admin
	// can perform. Do not enable it otherwise.
	Strict bool
}

type UserStatus int

type VersionResponse struct {
	Version string `json:"version"`
	Commit  string `json:"commit"`
	// StartTime is when this server process came up, RFC3339 in UTC.
	StartTime string `json:"start_time"`
	// UptimeSeconds is StartTime expressed as an elapsed duration, so a
	// caller does not have to trust its own clock to agree with ours.
	UptimeSeconds int64 `json:"uptime_seconds"`
}

type WhoAmIResponse struct {
	Authenticated bool   `json:"authenticated"`
	User          string `json:"user,omitempty"` // Omit if not authenticated
}