config

type AIConfig struct {
	Enabled              bool          `mapstructure:"enabled" json:"enabled"`
	Provider             string        `mapstructure:"provider" json:"provider"`
	APIKey               string        `mapstructure:"api_key" json:"-" yaml:"-"`
	Model                string        `mapstructure:"model" json:"model"`
	BaseURL              string        `mapstructure:"base_url" json:"baseUrl"`
	RequestTimeout       time.Duration `mapstructure:"request_timeout" json:"requestTimeout"`
	MaxControlsPerChunk  int           `mapstructure:"max_controls_per_chunk" json:"maxControlsPerChunk"`
	MaxLabelSetsPerChunk int           `mapstructure:"max_label_sets_per_chunk" json:"maxLabelSetsPerChunk"`
	QueueWorkers         int           `mapstructure:"queue_workers" json:"queueWorkers"`
	MaxCallsPerRun       int           `mapstructure:"max_calls_per_run" json:"maxCallsPerRun"`
	MaxSuggestionsPerRun int           `mapstructure:"max_suggestions_per_run" json:"maxSuggestionsPerRun"`
	// MaxOutputTokens caps the model's response length per cell. Too low a value
	// truncates the JSON (surfacing as "truncated non-json text content").
	MaxOutputTokens int `mapstructure:"max_output_tokens" json:"maxOutputTokens"`
	// GeneralizableLabelKeys are the label keys whose value identifies an
	// instance/provider rather than the evidence meaning. The deterministic
	// filter-merge detector may drop exactly one of these to generalize several
	// near-duplicate filters into one. Meaning-bearing keys (_policy, type) are
	// never dropped, so they must not appear here.
	GeneralizableLabelKeys []string `mapstructure:"generalizable_label_keys" json:"generalizableLabelKeys"`
	// GeneralizationMinSharedControls is the minimum number of controls the
	// candidate filters must have in common before a merge is proposed, so a
	// merge only fires when it is the same control intent across instances.
	GeneralizationMinSharedControls int `mapstructure:"generalization_min_shared_controls" json:"generalizationMinSharedControls"`
}

type AuthzConfig struct {
	Driver              string        `mapstructure:"driver" json:"driver"`
	FailMode            string        `mapstructure:"fail_mode" json:"failMode"`
	Endpoint            string        `mapstructure:"endpoint" json:"endpoint"`
	CacheTTL            time.Duration `mapstructure:"cache_ttl" json:"cacheTtl"`
	RoleAssignmentsPath string        `mapstructure:"role_assignments" json:"roleAssignments"`
	CedarPolicyDir      string        `mapstructure:"cedar_policy_dir" json:"cedarPolicyDir"`
}

type Config struct {
	AppPort                           string
	Environment                       string
	DBDriver                          string
	DBConnectionString                string
	DBDebug                           bool
	JWTSecret                         string
	JWTPrivateKey                     *rsa.PrivateKey
	JWTPublicKey                      *rsa.PublicKey
	APIAllowedOrigins                 []string
	MetricsEnabled                    bool
	MetricsPort                       string
	WebBaseURL                        string
	SSO                               *SSOConfig
	Email                             *EmailConfig
	Slack                             *SlackConfig
	Worker                            *WorkerConfig
	EvidenceDefaultExpiryMonths       int    // Default expiration in months for evidence without explicit expiry
	DigestEnabled                     bool   // Enable or disable the digest scheduler
	DigestSchedule                    string // Cron schedule for digest emails
	Workflow                          *WorkflowConfig
	Risk                              *RiskConfig
	Poam                              *PoamConfig
	AI                                *AIConfig
	PprofEnabled                      bool   // Enable or disable pprof debugging server
	PprofPort                         string // Port for pprof debugging server
	StrictDisablePublicAgentEndpoints bool
	Authz                             *AuthzConfig
}

type EmailConfig struct {
	Enabled   bool                     `yaml:"enabled" json:"enabled" mapstructure:"enabled"`
	Provider  string                   `yaml:"provider" json:"provider" mapstructure:"provider"` // default provider to use
	Providers *SupportedEmailProviders `yaml:"providers" json:"providers" mapstructure:"providers"`
}

type EmailProviderSettings interface {
	GetName() string
	GetType() string
	IsEnabled() bool
}

type EnvironmentType string

type JWTKeyBootstrapAction string

type PoamConfig struct {
	// DeadlineReminderEnabled enables the daily POAM deadline reminder scanner (0 0 8 * * *).
	DeadlineReminderEnabled  bool   `mapstructure:"deadline_reminder_enabled"  yaml:"deadline_reminder_enabled"  json:"deadlineReminderEnabled"`
	DeadlineReminderSchedule string `mapstructure:"deadline_reminder_schedule" yaml:"deadline_reminder_schedule" json:"deadlineReminderSchedule"`
	// ReminderWindowDays is the look-ahead window (in days) for the deadline reminder.
	// Items with deadline - now <= ReminderWindowDays are included. Default: 30.
	ReminderWindowDays int `mapstructure:"reminder_window_days" yaml:"reminder_window_days" json:"reminderWindowDays"`

	// OverdueTransitionEnabled enables the daily overdue transition scanner (0 0 9 * * *).
	OverdueTransitionEnabled  bool   `mapstructure:"overdue_transition_enabled"  yaml:"overdue_transition_enabled"  json:"overdueTransitionEnabled"`
	OverdueTransitionSchedule string `mapstructure:"overdue_transition_schedule" yaml:"overdue_transition_schedule" json:"overdueTransitionSchedule"`

	// MilestoneOverdueEnabled enables the weekly incomplete milestone scanner (0 0 10 * * 1).
	MilestoneOverdueEnabled  bool   `mapstructure:"milestone_overdue_enabled"  yaml:"milestone_overdue_enabled"  json:"milestoneOverdueEnabled"`
	MilestoneOverdueSchedule string `mapstructure:"milestone_overdue_schedule" yaml:"milestone_overdue_schedule" json:"milestoneOverdueSchedule"`

	// OpenDigestEnabled enables the daily POAM open digest job (0 0 7 * * *).
	OpenDigestEnabled  bool   `mapstructure:"open_digest_enabled"  yaml:"open_digest_enabled"  json:"openDigestEnabled"`
	OpenDigestSchedule string `mapstructure:"open_digest_schedule" yaml:"open_digest_schedule" json:"openDigestSchedule"`
	// OpenDigestWindow controls whether the digest covers a "daily" or "weekly" window.
	OpenDigestWindow string `mapstructure:"open_digest_window" yaml:"open_digest_window" json:"openDigestWindow"`
}

type RetryPolicyConfig struct {
	// MaxAttempts is the maximum number of attempts for a job
	MaxAttempts int `mapstructure:"max_attempts"`
}

type RiskConfig struct {
	ReviewDeadlineReminderEnabled  bool   `mapstructure:"review_deadline_reminder_enabled" yaml:"review_deadline_reminder_enabled" json:"reviewDeadlineReminderEnabled"`
	ReviewDeadlineReminderSchedule string `` /* 127-byte string literal not displayed */

	ReviewOverdueEscalationEnabled  bool   `` /* 127-byte string literal not displayed */
	ReviewOverdueEscalationSchedule string `` /* 130-byte string literal not displayed */

	StaleRiskScannerEnabled  bool   `mapstructure:"stale_risk_scanner_enabled" yaml:"stale_risk_scanner_enabled" json:"staleRiskScannerEnabled"`
	StaleRiskScannerSchedule string `mapstructure:"stale_risk_scanner_schedule" yaml:"stale_risk_scanner_schedule" json:"staleRiskScannerSchedule"`

	EvidenceReconciliationEnabled  bool   `mapstructure:"evidence_reconciliation_enabled" yaml:"evidence_reconciliation_enabled" json:"evidenceReconciliationEnabled"`
	EvidenceReconciliationSchedule string `mapstructure:"evidence_reconciliation_schedule" yaml:"evidence_reconciliation_schedule" json:"evidenceReconciliationSchedule"`

	OpenDigestEnabled  bool   `mapstructure:"open_digest_enabled" yaml:"open_digest_enabled" json:"openDigestEnabled"`
	OpenDigestSchedule string `mapstructure:"open_digest_schedule" yaml:"open_digest_schedule" json:"openDigestSchedule"`
	OpenDigestWindow   string `mapstructure:"open_digest_window" yaml:"open_digest_window" json:"openDigestWindow"`

	AutoReopenEnabled       bool `mapstructure:"auto_reopen_enabled" yaml:"auto_reopen_enabled" json:"autoReopenEnabled"`
	AutoReopenThresholdDays int  `mapstructure:"auto_reopen_threshold_days" yaml:"auto_reopen_threshold_days" json:"autoReopenThresholdDays"`
}

type SESConfig struct {
	Name            string `yaml:"name" json:"name" mapstructure:"name"`
	Enabled         bool   `yaml:"enabled" json:"enabled" mapstructure:"enabled"`
	Region          string `yaml:"region" json:"region" mapstructure:"region"`
	AccessKeyID     string `yaml:"access_key_id" json:"accessKeyId" mapstructure:"access_key_id"`
	SecretAccessKey string `yaml:"secret_access_key" json:"secretAccessKey" mapstructure:"secret_access_key"`
	SessionToken    string `yaml:"session_token" json:"sessionToken" mapstructure:"session_token"`
	From            string `yaml:"from" json:"from" mapstructure:"from"`
	FromName        string `yaml:"from_name" json:"fromName" mapstructure:"from_name"`
}

type SMTPConfig struct {
	Name     string `yaml:"name" json:"name" mapstructure:"name"`
	Enabled  bool   `yaml:"enabled" json:"enabled" mapstructure:"enabled"`
	Host     string `yaml:"host" json:"host" mapstructure:"host"`
	Port     int    `yaml:"port" json:"port" mapstructure:"port"`
	Username string `yaml:"username" json:"username" mapstructure:"username"`
	Password string `yaml:"password" json:"password" mapstructure:"password"`
	From     string `yaml:"from" json:"from" mapstructure:"from"`
	FromName string `yaml:"from_name" json:"fromName" mapstructure:"from_name"`
	UseTLS   bool   `yaml:"use_tls" json:"useTls" mapstructure:"use_tls"`
	UseSSL   bool   `yaml:"use_ssl" json:"useSsl" mapstructure:"use_ssl"`
}

type SSOConfig struct {
	Enabled     bool                         `yaml:"enabled" json:"enabled" mapstructure:"enabled"`
	BaseURL     string                       `yaml:"base_url" json:"base_url" mapstructure:"base_url"`
	CallbackURL string                       `yaml:"callback_url" json:"callback_url" mapstructure:"callback_url"`
	Providers   map[string]SSOProviderConfig `yaml:"providers" json:"providers" mapstructure:"providers"`
}

type SSOProviderConfig struct {
	Name                string              `yaml:"name" json:"name" mapstructure:"name"`
	DisplayName         string              `yaml:"display_name" json:"displayName" mapstructure:"display_name"`
	Provider            string              `yaml:"provider" json:"provider" mapstructure:"provider"` // google, github, generic
	Protocol            string              `yaml:"protocol" json:"protocol" mapstructure:"protocol"` // oidc or oauth
	IconURL             string              `yaml:"icon_url" json:"iconUrl" mapstructure:"icon_url"`
	RequiredLoginGroups []string            `yaml:"required_login_groups" json:"requiredLoginGroups" mapstructure:"required_login_groups"`
	RequiredAdminGroups []string            `yaml:"required_admin_groups" json:"requiredAdminGroups" mapstructure:"required_admin_groups"`
	ClientID            string              `yaml:"client_id" json:"clientId" mapstructure:"client_id"`
	ClientSecret        string              `yaml:"client_secret" json:"clientSecret" mapstructure:"client_secret"`
	IssuerURL           string              `yaml:"issuer_url" json:"issuerUrl" mapstructure:"issuer_url"`
	WellKnownURL        string              `yaml:"well_known_url" json:"wellKnownUrl" mapstructure:"well_known_url"`
	AuthURL             string              `yaml:"auth_url" json:"authUrl" mapstructure:"auth_url"`
	TokenURL            string              `yaml:"token_url" json:"tokenUrl" mapstructure:"token_url"`
	UserInfoURL         string              `yaml:"user_info_url" json:"userInfoUrl" mapstructure:"user_info_url"`
	EmailURL            string              `yaml:"email_url" json:"emailUrl" mapstructure:"email_url"`
	Scopes              []string            `yaml:"scopes" json:"scopes" mapstructure:"scopes"`
	Enabled             bool                `yaml:"enabled" json:"enabled" mapstructure:"enabled"`
	GroupMapping        map[string][]string `yaml:"group_mapping" json:"groupMapping" mapstructure:"group_mapping"`
}

type SlackConfig struct {
	Enabled bool   `mapstructure:"enabled" yaml:"enabled" json:"enabled"`
	Token   string `mapstructure:"token" yaml:"token" json:"token"`
	// DigestChannel is kept for one-time migration into ccf_system_notification_destinations.
	DigestChannel string `mapstructure:"digest_channel" yaml:"digest_channel" json:"digest_channel"`
	ClientID      string `mapstructure:"client_id" yaml:"client_id" json:"client_id"`
	ClientSecret  string `mapstructure:"client_secret" yaml:"client_secret" json:"client_secret"`
	RedirectURL   string `mapstructure:"redirect_url" yaml:"redirect_url" json:"redirect_url"`
}

type SupportedEmailProviders struct {
	SMTP *SMTPConfig `yaml:"smtp" json:"smtp" mapstructure:"smtp"`
	SES  *SESConfig  `yaml:"ses" json:"ses" mapstructure:"ses"`
}

type WorkerConfig struct {
	// Enabled determines if workers should be started
	Enabled bool `mapstructure:"enabled"`

	// Number of worker goroutines to run
	Workers int `mapstructure:"workers"`

	// Queue is the name of the queue to work on
	Queue string `mapstructure:"queue"`

	// UsePolling makes River poll for jobs instead of using PostgreSQL LISTEN/NOTIFY.
	UsePolling bool `mapstructure:"use_polling"`

	// RetryPolicy defines how jobs should be retried
	RetryPolicy RetryPolicyConfig `mapstructure:"retry_policy"`
}

type WorkflowConfig struct {
	// SchedulerEnabled determines if the workflow scheduler is enabled
	SchedulerEnabled bool `mapstructure:"scheduler_enabled" yaml:"scheduler_enabled" json:"schedulerEnabled"`

	// Schedule is the cron schedule for the workflow scheduler
	Schedule string `mapstructure:"scheduler_schedule" yaml:"scheduler_schedule" json:"schedulerSchedule"`

	// GracePeriodDays is the number of days before a workflow step is considered overdue
	GracePeriodDays int `mapstructure:"grace_period_days" yaml:"grace_period_days" json:"gracePeriodDays"`

	// OverdueCheckEnabled determines if we should check for overdue workflows
	OverdueCheckEnabled bool `mapstructure:"overdue_check_enabled" yaml:"overdue_check_enabled" json:"overdueCheckEnabled"`

	// DueSoonEnabled determines if the daily due-soon reminder emails are enabled
	DueSoonEnabled bool `mapstructure:"due_soon_enabled" yaml:"due_soon_enabled" json:"dueSoonEnabled"`

	// DueSoonSchedule is the cron schedule for the due-soon checker (default: daily at 08:00 UTC)
	DueSoonSchedule string `mapstructure:"due_soon_schedule" yaml:"due_soon_schedule" json:"dueSoonSchedule"`

	// TaskDigestEnabled determines if the daily workflow task digest emails are enabled
	TaskDigestEnabled bool `mapstructure:"task_digest_enabled" yaml:"task_digest_enabled" json:"taskDigestEnabled"`

	// TaskDigestSchedule is the cron schedule for the workflow task digest (default: daily at 08:00 UTC)
	TaskDigestSchedule string `mapstructure:"task_digest_schedule" yaml:"task_digest_schedule" json:"taskDigestSchedule"`
}