ui

type ChatMessage struct {
	Role      string    `json:"role"` // "user" or "assistant"
	Content   string    `json:"content"`
	Timestamp time.Time `json:"timestamp"`
	Action    string    `json:"action,omitempty"` // resolved cloop command, if any
}

type Server struct {
	WorkDir  string
	Port     int
	Token    string   // optional auth token; empty = no auth
	Projects []string // extra project directories for multi-project dashboard

	// RPS and Burst control the per-IP token-bucket rate limiter.
	// Zero values use 20 req/s and burst 50.
	RPS   float64
	Burst int

	// MaxWebSocketConns caps the total number of concurrent WebSocket
	// connections accepted across every remote IP. Zero substitutes
	// config.WebSocketConnsDefault (256). Each accepted upgrade spawns
	// at least three goroutines (handler, drain, ping ticker) plus a
	// hubClient registry entry; without a cap a flood of upgrades can
	// exhaust scheduler resources and the per-project broadcast budget.
	MaxWebSocketConns int

	// MaxWebSocketConnsPerIP caps the number of concurrent WebSocket
	// connections any single remote IP may hold. Zero substitutes
	// config.WebSocketConnsPerIPDefault (8). Reaching the cap causes
	// new upgrades from that IP to be rejected with HTTP 429 and a
	// Retry-After header before nhooyr.Accept hijacks the response.
	MaxWebSocketConnsPerIP int

	// MaxRequestBodyBytes caps any incoming POST/PUT/PATCH request body
	// the server will accept. Zero substitutes maxJSONBodyBytes (10 MiB).
	// Oversize requests are rejected with HTTP 413 (Request Entity Too
	// Large). Set via config.UIConfig.MaxRequestBodyBytes; bounded by
	// config.MaxRequestBodyBytesLower / Upper. Task 20102.
	MaxRequestBodyBytes int64

	// AllowedWSOrigins lists extra Origin hosts (host or host:port) that may
	// open a WebSocket, in addition to the always-allowed loopback origins
	// and same-origin requests. Needed only when the dashboard sits behind a
	// reverse proxy that rewrites Host so same-origin detection can't see the
	// public hostname. Populated from config.UIConfig.AllowedWSOrigins.
	AllowedWSOrigins []string

	// AllowedOrigins is the deployment-wide origin allowlist: it applies to
	// the dashboard socket AND to the executor-agent endpoint. Populated from
	// config.UIConfig.AllowedOrigins.
	//
	// It is separate from AllowedWSOrigins because the two have different
	// blast radii. An entry here can open an agent connection; an entry in
	// AllowedWSOrigins cannot. Merging them would silently promote every
	// dashboard-scoped origin to the agent endpoint.
	AllowedOrigins []string

	// ExternalURL is what this deployment calls itself, e.g.
	// https://cloop.example.com. Its host is an accepted WebSocket Origin for
	// both the dashboard and the executor-agent endpoint. Populated from
	// config.UIConfig.ExternalURL.
	ExternalURL string

	// TLSCertFile / TLSKeyFile enable native HTTPS. Both must be set or
	// neither; Run refuses to start on a half-configuration rather than
	// silently falling back to plaintext. TLSMinVersion is "1.2" (default)
	// or "1.3". Populated from config.UIConfig.TLS or --tls-cert/--tls-key.
	TLSCertFile   string
	TLSKeyFile    string
	TLSMinVersion string

	// SelfExe is the cloop binary this server hands to an executor when a
	// handler needs to run a subcommand (`init`, `run`, `reset`, `do`,
	// `listen`, `suggest`). Empty means os.Executable(), which is correct in
	// production and wrong under `go test`: there os.Executable() is the
	// compiled test binary, so a handler that spawns it re-runs the package's
	// own test suite as a child process with CLI-looking argv. That child
	// passes and is never reported, so the only visible symptom was pkg/ui
	// taking ten minutes — long enough to trip the default per-package test
	// timeout and fail CI. Tests point this at a stub.
	SelfExe string

	// Lease fences this process as the sole control plane for its state.db
	// (Task 20214). Set by `cloop ui` before the server is constructed, so
	// nothing in New — which already reconciles executors and sweeps orphaned
	// sessions — can run against a control plane another hub owns.
	//
	// nil means unfenced, which is what every in-process test wants: each one
	// gets its own temp directory, so there is nothing to fence against, and
	// requiring a lease would make the lifecycle harder to drive without
	// testing anything. Run starts the heartbeat, watches for the lease being
	// lost, and Shutdown releases it; every one of those is nil-safe.
	Lease *hublease.Lease

	// ReadyCheck overrides the readiness check used by /readyz. nil
	// means use defaultReadyCheck (stat state.db, open it, run SELECT 1
	// bounded by ctx). Tests use this field to simulate degraded states
	// like "closed db handle" or "state store not initialized".
	ReadyCheck func(ctx context.Context) error

	// Log is the structured logger used for lifecycle / error messages
	// emitted by the UI server itself (panics in HTTP middleware, client
	// JavaScript errors POSTed to /api/client-error, watcher failures).
	// Nil means the package picks a sensible default at first use (text
	// output to stdout, project bound).
	Log logger.Logger

	// OIDC is the optional OpenID Connect authenticator (Task 20152). Nil
	// (the default) means OIDC is disabled and the dashboard behaves
	// exactly as before: token auth if Token is set, otherwise open. Set
	// from ui.oidc.* in .cloop/config.yaml by cmd/ui_cmd.go; when active it
	// gates every route behind an IdP session and scopes the multi-project
	// registry per user (see pkg/ui/oidc.go).
	OIDC *oidcauth.Authenticator

	// Authz resolves OIDC claims to roles and permissions (Task 20164).
	// Nil means "no role mappings configured": every session identity then
	// falls back to the resolver's deny-by-default, which is why
	// authzActive() also requires OIDC to be enabled. With OIDC disabled
	// this field is ignored entirely and every request is granted
	// everything, preserving single-tenant local behavior.
	Authz *authz.Resolver
	// contains filtered or unexported fields
}