config

type AppConfigValues map[string]any

type AppKey struct {
	// Name is the key name (e.g., "session_name", "mongo_uri").
	// This is used as-is for config files and CLI flags.
	// For env vars, it's uppercased and prefixed (e.g., STRATAHUB_SESSION_NAME).
	Name string

	// Default is the default value if not set elsewhere.
	// Supported types: string, int, int64, bool, []string.
	Default any

	// Desc is a short description for --help output.
	Desc string
}

type CORSConfig struct {
	EnableCORS           bool     `mapstructure:"enable_cors"`
	CORSAllowedOrigins   []string `mapstructure:"cors_allowed_origins"`
	CORSAllowedMethods   []string `mapstructure:"cors_allowed_methods"`
	CORSAllowedHeaders   []string `mapstructure:"cors_allowed_headers"`
	CORSExposedHeaders   []string `mapstructure:"cors_exposed_headers"`
	CORSAllowCredentials bool     `mapstructure:"cors_allow_credentials"`
	CORSMaxAge           int      `mapstructure:"cors_max_age"`
}

type CoreConfig struct {
	// runtime
	Env      string `mapstructure:"env"`       // "dev" | "prod"
	LogLevel string `mapstructure:"log_level"` // debug, info, warn, error …

	// grouped config
	HTTP     HTTPConfig     `mapstructure:",squash"`
	TLS      TLSConfig      `mapstructure:",squash"`
	CORS     CORSConfig     `mapstructure:",squash"`
	Security SecurityConfig `mapstructure:",squash"`

	// DB-related timeouts (no URIs/DB names here)
	DBConnectTimeout time.Duration `mapstructure:"db_connect_timeout"`
	IndexBootTimeout time.Duration `mapstructure:"index_boot_timeout"`

	// HTTP behavior
	MaxRequestBodyBytes int64 `mapstructure:"max_request_body_bytes"`

	// misc
	EnableCompression bool `mapstructure:"enable_compression"`
	CompressionLevel  int  `mapstructure:"compression_level"` // 1-9, default 5
}

type HTTPConfig struct {
	HTTPPort  int  `mapstructure:"http_port"`
	HTTPSPort int  `mapstructure:"https_port"`
	UseHTTPS  bool `mapstructure:"use_https"`

	// Server timeouts
	ReadTimeout       time.Duration `mapstructure:"read_timeout"`
	ReadHeaderTimeout time.Duration `mapstructure:"read_header_timeout"`
	WriteTimeout      time.Duration `mapstructure:"write_timeout"`
	IdleTimeout       time.Duration `mapstructure:"idle_timeout"`
	ShutdownTimeout   time.Duration `mapstructure:"shutdown_timeout"`
}

type SecurityConfig struct {
	// EnableSecurityHeaders enables the security headers middleware.
	// Default: true (security headers are enabled by default)
	EnableSecurityHeaders bool `mapstructure:"enable_security_headers"`

	// XFrameOptions controls iframe embedding. Values: "DENY", "SAMEORIGIN"
	// Default: "SAMEORIGIN"
	XFrameOptions string `mapstructure:"x_frame_options"`

	// XContentTypeOptions prevents MIME sniffing. Should be "nosniff".
	// Default: "nosniff"
	XContentTypeOptions string `mapstructure:"x_content_type_options"`

	// ReferrerPolicy controls referrer information sent with requests.
	// Default: "strict-origin-when-cross-origin"
	ReferrerPolicy string `mapstructure:"referrer_policy"`

	// XSSProtection enables browser XSS filter. Values: "0", "1", "1; mode=block"
	// Default: "1; mode=block"
	XSSProtection string `mapstructure:"x_xss_protection"`

	// HSTSMaxAge sets Strict-Transport-Security max-age in seconds.
	// Only sent for HTTPS requests. Set to 0 to disable.
	// Default: 31536000 (1 year)
	HSTSMaxAge int `mapstructure:"hsts_max_age"`

	// HSTSIncludeSubDomains adds includeSubDomains to HSTS header.
	// Default: true
	HSTSIncludeSubDomains bool `mapstructure:"hsts_include_subdomains"`

	// HSTSPreload adds preload directive. Only enable if submitted to preload list.
	// Default: false
	HSTSPreload bool `mapstructure:"hsts_preload"`

	// ContentSecurityPolicy sets the CSP header. Leave empty to not set.
	// Example: "default-src 'self'; script-src 'self' 'unsafe-inline'"
	// Default: "" (not set - requires application-specific configuration)
	ContentSecurityPolicy string `mapstructure:"content_security_policy"`

	// PermissionsPolicy controls browser feature access. Leave empty to not set.
	// Example: "geolocation=(), microphone=(), camera=()"
	// Default: "" (not set)
	PermissionsPolicy string `mapstructure:"permissions_policy"`
}

type TLSConfig struct {
	CertFile            string `mapstructure:"cert_file"`
	KeyFile             string `mapstructure:"key_file"`
	UseLetsEncrypt      bool   `mapstructure:"use_lets_encrypt"`
	LetsEncryptEmail    string `mapstructure:"lets_encrypt_email"`
	LetsEncryptCacheDir string `mapstructure:"lets_encrypt_cache_dir"`

	// Domain is the single domain for TLS/ACME (backward compatible).
	// Use Domains for multiple domains on a single certificate.
	// Cannot specify both Domain and Domains.
	Domain string `mapstructure:"domain"`

	// Domains is a list of domains for a single certificate (e.g., ["example.com", "*.example.com"]).
	// Use this for wildcard + apex domain certificates.
	// Cannot specify both Domain and Domains.
	Domains []string `mapstructure:"domains"`

	// LetsEncryptChallenge selects which ACME challenge type to use when
	// UseLetsEncrypt is true. Supported values:
	//   - "http-01" (default; uses an HTTP challenge endpoint)
	//   - "dns-01"  (for use with Route 53 DNS TXT records; required for wildcards)
	LetsEncryptChallenge string `mapstructure:"lets_encrypt_challenge"`

	// Route53HostedZoneID is required when using DNS-01 with Route 53 so the
	// ACME client knows which hosted zone to update.
	Route53HostedZoneID string `mapstructure:"route53_hosted_zone_id"`

	// ACMEDirectoryURL is the ACME directory URL to use. Defaults to Let's Encrypt
	// production for prod env, staging for other environments. Common values:
	//   - Production: https://acme-v02.api.letsencrypt.org/directory
	//   - Staging:    https://acme-staging-v02.api.letsencrypt.org/directory
	ACMEDirectoryURL string `mapstructure:"acme_directory_url"`
}