config

type AppLog struct {
	Enabled bool      `koanf:"enabled"`
	Level   string    `koanf:"level"   validate:"required,oneof=debug info warn error"`
	Format  string    `koanf:"format"  validate:"required,oneof=text json"`
	Output  string    `koanf:"output"  validate:"required"`
	Rotate  LogRotate `koanf:"rotate"  validate:"required"`
}

type AuthConfig struct {
	Mode              string        `koanf:"mode"                validate:"required,oneof=full trusted-network disabled"`
	TrustedNetworks   []string      `koanf:"trusted_networks"    validate:"dive,cidr"`
	TrustedRole       string        `koanf:"trusted_role"        validate:"required,oneof=admin member request_only"`
	SessionSecret     string        `koanf:"session_secret"      validate:"excluded_with=SessionSecretFile"`
	SessionSecretFile string        `koanf:"session_secret_file" validate:"omitempty,excluded_with=SessionSecret,filepath"`
	SessionTTL        string        `koanf:"session_ttl"         validate:"required"`
	RegistrationMode  string        `koanf:"registration_mode"   validate:"required,oneof=disabled open invite"`
	OIDCDefaultRole   string        `koanf:"oidc_default_role"   validate:"required,oneof=admin member request_only"`
	SeedAdmin         SeedAdminCfg  `koanf:"seed_admin"`
	OIDC              []OIDCConfig  `koanf:"oidc"                validate:"dive"`
	Lockout           LockoutConfig `koanf:"lockout"             validate:"required"`
}

type AuthPatch struct {
	RegistrationMode *string
	SessionTTL       *string
	OIDCDefaultRole  *string
}

type Config struct {
	Server  ServerConfig `koanf:"server"   validate:"required"`
	DataDir string       `koanf:"data_dir" validate:"required,dir"`
	// ReadOnly rejects every config.Update write-back with ErrReadOnly. For
	// declarative/GitOps deploys where config is mounted read-only and changes
	// flow through git, not the UI.
	ReadOnly    bool              `koanf:"read_only"`
	Auth        AuthConfig        `koanf:"auth"         validate:"required"`
	Library     LibraryConfig     `koanf:"library"      validate:"required"`
	Schedule    ScheduleConfig    `koanf:"schedules"    validate:"required"`
	Metadata    MetadataConfig    `koanf:"metadata"`
	Log         LogConfig         `koanf:"log"          validate:"required"`
	OTel        OTelConfig        `koanf:"otel"`
	MediaServer MediaServerConfig `koanf:"media_server"`
	Events      EventsConfig      `koanf:"events"       validate:"required"`

	DownloadClients       []DownloadClientEntry `koanf:"download_clients"        validate:"unique=Name,dive"`
	Indexers              []IndexerEntry        `koanf:"indexers"                validate:"unique=Name,dive"`
	QualityProfiles       []QualityProfileEntry `koanf:"quality_profiles"        validate:"unique=Name,dive"`
	QualityDefaultProfile string                `koanf:"quality_default_profile"`
}

type DownloadClientEntry struct {
	Name         string `koanf:"name"          validate:"required"`
	ClientType   string `koanf:"client_type"   validate:"required,oneof=qbittorrent transmission deluge"`
	Host         string `koanf:"host"          validate:"required"`
	Port         uint16 `koanf:"port"          validate:"required,port"`
	AuthMethod   string `koanf:"auth_method"   validate:"required,oneof=password api_key"`
	Username     string `koanf:"username"`
	Password     string `koanf:"password"      validate:"excluded_with=PasswordFile"`
	PasswordFile string `koanf:"password_file" validate:"omitempty,excluded_with=Password,filepath"`
	APIKey       string `koanf:"api_key"       validate:"excluded_with=APIKeyFile"`
	APIKeyFile   string `koanf:"api_key_file"  validate:"omitempty,excluded_with=APIKey,filepath"`
	UseSSL       bool   `koanf:"use_ssl"`
	Priority     uint8  `koanf:"priority"`
	Enabled      bool   `koanf:"enabled"`
}

type DownloadClientPatch struct {
	ClientType *string
	Host       *string
	Port       *uint16
	AuthMethod *string
	Username   *string
	Password   *string
	APIKey     *string
	UseSSL     *bool
	Priority   *uint8
	Enabled    *bool
}

type EventsConfig struct {
	Retention string `koanf:"retention" validate:"required"`
}

type HTTPLog struct {
	Enabled bool      `koanf:"enabled"`
	Output  string    `koanf:"output"  validate:"required"`
	Format  string    `koanf:"format"  validate:"required,oneof=json combined"`
	Rotate  LogRotate `koanf:"rotate"  validate:"required"`
}

type IndexerEntry struct {
	Name       string `koanf:"name"         validate:"required"`
	Host       string `koanf:"host"         validate:"required"`
	Port       uint16 `koanf:"port"         validate:"required,port"`
	Path       string `koanf:"path"`
	UseSSL     bool   `koanf:"use_ssl"`
	APIKey     string `koanf:"api_key"      validate:"required_without=APIKeyFile,excluded_with=APIKeyFile"`
	APIKeyFile string `koanf:"api_key_file" validate:"omitempty,excluded_with=APIKey,filepath"`
	Protocol   string `koanf:"protocol"     validate:"required,oneof=torznab prowlarr"`
	Priority   uint8  `koanf:"priority"`
	Enabled    bool   `koanf:"enabled"`
}

type IndexerPatch struct {
	Host     *string
	Port     *uint16
	Path     *string
	UseSSL   *bool
	APIKey   *string
	Protocol *string
	Priority *uint8
	Enabled  *bool
}

type LibraryConfig struct {
	MoviePath    string `koanf:"movie_path"    validate:"required"`
	MovieNaming  string `koanf:"movie_naming"  validate:"required"`
	SeriesPath   string `koanf:"series_path"   validate:"required"`
	SeriesNaming string `koanf:"series_naming" validate:"required"`
	// DownloadPath is the host-side directory where streamline reads
	// completed torrents from. qBittorrent (or any other client) decides
	// its own save location; this only tells the importer where to look,
	// per-torrent content lives at <DownloadPath>/<torrent.Name>. The
	// directory is not validated at boot — it may be a bind-mount that
	// comes up after streamline; the importer surfaces a clear stat error
	// if the path is wrong.
	DownloadPath         string   `koanf:"download_path"          validate:"required"`
	ImportMode           string   `koanf:"import_mode"            validate:"required,oneof=hardlink copy move"`
	NoMatchCooldown      string   `koanf:"no_match_cooldown"      validate:"required"`
	MaxGrabFailures      uint8    `koanf:"max_grab_failures"      validate:"required,min=1"`
	KeepTorrentSeeding   bool     `koanf:"keep_torrent_seeding"`
	ImportMaxAttempts    uint8    `koanf:"import_max_attempts"    validate:"required,min=1"`
	AllowedDownloadRoots []string `koanf:"allowed_download_roots"`
	// DriftGraceTicks is the number of consecutive drift_check ticks a
	// MediaFile may be absent from disk before its row is deleted and the
	// owning movie reverts to "wanted". Bounded to give operators a knob
	// for noisy mounts without unbounded patience.
	DriftGraceTicks uint8 `koanf:"drift_grace_ticks" validate:"required,min=1,max=20"`
}

type LockoutConfig struct {
	Threshold uint8  `koanf:"threshold" validate:"required,min=1,max=255"`
	Window    string `koanf:"window"    validate:"required"`
	Duration  string `koanf:"duration"  validate:"required"`
}

type LogConfig struct {
	App  AppLog  `koanf:"app"  validate:"required"`
	HTTP HTTPLog `koanf:"http" validate:"required"`
}

type LogRotate struct {
	MaxSizeMB  int  `koanf:"max_size_mb"  validate:"min=0"`
	MaxBackups int  `koanf:"max_backups"  validate:"min=0"`
	MaxAgeDays int  `koanf:"max_age_days" validate:"min=0"`
	Compress   bool `koanf:"compress"`
}

type MediaServerConfig struct {
	PlexClientID string             `koanf:"plex_client_id"`
	Servers      []MediaServerEntry `koanf:"servers"        validate:"unique=Name,dive"`
}

type MediaServerEntry struct {
	Name       string `koanf:"name"         validate:"required"`
	ServerType string `koanf:"server_type"  validate:"required,oneof=plex jellyfin emby"`
	Host       string `koanf:"host"         validate:"required"`
	APIKey     string `koanf:"api_key"      validate:"excluded_with=APIKeyFile"`
	APIKeyFile string `koanf:"api_key_file" validate:"omitempty,excluded_with=APIKey,filepath"`
	Enabled    bool   `koanf:"enabled"`
	// LibrarySection is the Plex movie-library section key (play-on hint).
	LibrarySection *string `koanf:"library_section"`
	// LibrarySectionTV is the Plex TV-library section key (play-on hint).
	LibrarySectionTV *string `koanf:"library_section_tv"`
}

type MediaServerPatch struct {
	ServerType     *string
	Host           *string
	APIKey         *string
	Enabled        *bool
	LibrarySection *string
}

type MetadataConfig struct {
	TMDBAPIKey     string `koanf:"tmdb_api_key"      validate:"excluded_with=TMDBAPIKeyFile"`
	TMDBAPIKeyFile string `koanf:"tmdb_api_key_file" validate:"omitempty,excluded_with=TMDBAPIKey,filepath"`
	TVDBAPIKey     string `koanf:"tvdb_api_key"      validate:"excluded_with=TVDBAPIKeyFile"`
	TVDBAPIKeyFile string `koanf:"tvdb_api_key_file" validate:"omitempty,excluded_with=TVDBAPIKey,filepath"`
	Language       string `koanf:"language"          validate:"omitempty,bcp47_language_tag"`
	TMDBRegion     string `koanf:"tmdb_region"       validate:"omitempty,len=2,uppercase"`
}

type OIDCConfig struct {
	Name         string `koanf:"name"          validate:"required"`
	Issuer       string `koanf:"issuer"        validate:"required,url"`
	ClientID     string `koanf:"client_id"     validate:"required"`
	ClientSecret string `koanf:"client_secret" validate:"required_without=ClientSecretFile,excluded_with=ClientSecretFile"`
	// ClientSecretFile, when set, is read into ClientSecret after validation.
	// Mutually exclusive with ClientSecret (set exactly one). Lets a GitOps
	// deploy mount the secret from a k8s Secret instead of inlining it.
	ClientSecretFile string `koanf:"client_secret_file" validate:"omitempty,excluded_with=ClientSecret,filepath"`
	// RoleClaim is the ID-token claim (e.g. "groups", "roles") consulted for
	// claim-based role mapping; RoleMapping maps a claim value to a Streamline
	// role. When both are set and a value matches, the mapped role is
	// authoritative — applied at signup and re-synced on every login (the
	// highest-privilege role wins if several values map). Leave empty to give
	// OIDC users auth.oidc_default_role.
	RoleClaim   string            `koanf:"role_claim"`
	RoleMapping map[string]string `koanf:"role_mapping" validate:"omitempty,dive,oneof=admin member request_only"`
}

type OIDCProviderPatch struct {
	Issuer       *string
	ClientID     *string
	ClientSecret *string
}

type OTelConfig struct {
	Endpoint string `koanf:"endpoint"`
}

type QualityProfileEntry struct {
	Name                string `koanf:"name"                 validate:"required"`
	PreferredResolution string `koanf:"preferred_resolution" validate:"required,oneof=720p 1080p 2160p"`
	MinResolution       string `koanf:"min_resolution"       validate:"required,oneof=720p 1080p 2160p"`
	UpgradeAllowed      bool   `koanf:"upgrade_allowed"`
}

type QualityProfilePatch struct {
	PreferredResolution *string
	MinResolution       *string
	UpgradeAllowed      *bool
}

type ScheduleConfig struct {
	RSSSync         string `koanf:"rss_sync"         validate:"required"`
	MetadataRefresh string `koanf:"metadata_refresh" validate:"required"`
	DownloadMonitor string `koanf:"download_monitor" validate:"required"`
	MissingSearch   string `koanf:"missing_search"   validate:"required"`
	Cleanup         string `koanf:"cleanup"          validate:"required"`
	ImportScan      string `koanf:"import_scan"      validate:"required"`
	OrphanScan      string `koanf:"orphan_scan"      validate:"required"`
	DriftCheck      string `koanf:"drift_check"      validate:"required"`
}

type SeedAdminCfg struct {
	Email        string `koanf:"email"         validate:"omitempty,email"`
	Password     string `koanf:"password"      validate:"excluded_with=PasswordFile"`
	PasswordFile string `koanf:"password_file" validate:"omitempty,excluded_with=Password,filepath"`
}

type ServerConfig struct {
	Host string `koanf:"host" validate:"required,ip|hostname"`
	Port uint16 `koanf:"port" validate:"required,port"`
}