server

type Actor struct {
	// ID is the API key identifier, or "bootstrap" for --auth-token, or
	// "anonymous" for --insecure mode.
	ID string
	// Name is a human-readable label for log lines and audit entries.
	Name string
	// Role is one of store.RoleAdmin, store.RoleOperator, store.RoleViewer.
	Role string
	// ClusterScope is the list of cluster names (or "group:<n>" entries) this
	// actor may act upon. The single element "*" grants unrestricted access.
	ClusterScope []string
}

type Config struct {
	// Addr is the listen address for the public API and UI. Empty means ":8080".
	Addr string
	// AdminAddr is the listen address for pprof and metrics. Empty disables the admin server.
	AdminAddr string
	// Store is the database backend.
	Store store.Store
	// Registry is the scanner registry.
	Registry *scanner.Registry
	// Log is the zap logger.
	Log *zap.Logger
	// KubeconfigPath is the kubeconfig file path for scans.
	KubeconfigPath string
	// Workers is the max concurrent operations for scans.
	Workers int
	// AuthToken is the bearer token required for mutating endpoints. When
	// empty and Insecure is false, mutating endpoints return 403.
	AuthToken string
	// Insecure disables authentication entirely when true. Demo implies it.
	Insecure bool
	// CORSOrigins is the explicit allowlist of permitted cross-origin Origins.
	// Wildcard is intentionally not supported.
	CORSOrigins []string
	// Demo, when true, causes /api/geo to return synthetic fleet data so the
	// globe can be previewed without any real clusters or scans, and a
	// triggered scan scans the synthetic fleet instead of the kubeconfig. Demo
	// turns authentication off, since nothing in the demo reaches a real cluster.
	Demo bool
	// SlackWebhookURL, when non-empty, is the incoming-webhook URL that
	// receives new critical findings.
	SlackWebhookURL string
	// FleetDriftOutputDir, when non-empty, is a local directory the server
	// writes FleetDriftReport YAMLs into after every scan. One file per
	// cluster, overwritten in place so the directory tracks the latest scan.
	FleetDriftOutputDir string
	// PolicyReportOutputDir, when non-empty, is a local directory the server
	// writes wgpolicyk8s.io PolicyReport YAMLs to after every scan.
	PolicyReportOutputDir string
	// PolicyReportNamespace is the namespace placed on emitted PolicyReports.
	// Defaults to "fleetsweeper" when empty.
	PolicyReportNamespace string
	// CostCSVPath, when non-empty, points at a CSV mapping clusters to costs.
	// Loaded once at startup and refreshed on a periodic ticker so dashboard
	// cost correlation reflects current billing without a restart.
	CostCSVPath string
	// WebhookConfigPath, when non-empty, points at a YAML file of outbound
	// HTTP subscribers. See internal/webhooks for the schema.
	WebhookConfigPath string
	// WebhookSecret, when non-empty, is the HMAC-SHA256 shared secret an
	// inbound webhook caller must use to authenticate scan-trigger calls.
	WebhookSecret string
	// SealKey, when non-empty, is the HMAC-SHA256 secret used to sign every
	// saved scan report. Sealed scans can be verified later with
	// `fleetsweeper verify`.
	SealKey string
	// OIDC configures browser SSO. When zero-valued the server runs in
	// bearer-only mode.
	OIDC OIDCConfig
	// ReadRPM is the per-client budget for GET/HEAD/OPTIONS requests,
	// keyed by client address. Zero disables read limiting; 600 (10 per
	// second per client) is a sensible start.
	ReadRPM int
	// WriteRPM is the per-client budget for mutating requests, keyed by
	// client address. Zero disables write limiting; 60 (one per second
	// per client) is a sensible start.
	WriteRPM int
	// TrustedProxyHeader, when set, names the header (for example X-Forwarded-For) a trusted
	// reverse proxy uses to carry the client address. The rate limiter keys on its last entry.
	// Leave it empty unless every request arrives through that proxy, since clients can set
	// the header themselves.
	TrustedProxyHeader string
	// AdmissionMetrics, when non-nil, has its counters written on /metrics.
	AdmissionMetrics *admission.Metrics
}

type Event struct {
	// Type categorizes the event (for example "scan.complete").
	Type string `json:"type"`
	// At is when the event was emitted.
	At time.Time `json:"at"`
	// Payload is the event-specific data.
	Payload any `json:"payload,omitempty"`
}

type OIDCConfig struct {
	// IssuerURL is the OIDC discovery URL (e.g. https://accounts.google.com).
	IssuerURL string
	// ClientID identifies the fleetsweeper application at the IdP.
	ClientID string
	// ClientSecret is the matching client secret.
	ClientSecret string
	// RedirectURL is fleetsweeper's callback URL, e.g.
	// https://fleetsweeper.example.com/oidc/callback. Must be registered
	// with the IdP exactly.
	RedirectURL string
	// Scopes requested. Defaults to openid + email + profile.
	Scopes []string
	// SessionSecret is the HMAC-SHA256 key used to sign session cookies.
	// Treat as a long-term server secret.
	SessionSecret string
	// SessionLifetime is the cookie validity window. Defaults to 8 hours.
	SessionLifetime time.Duration
	// AdminClaim is the JWT claim consulted to assign the admin role.
	// Format: "<claim_name>:<value>" — e.g. "groups:fleetsweeper-admins"
	// or "email:ops@example.com". Empty disables admin promotion via OIDC.
	AdminClaim string
	// OperatorClaim is the JWT claim for the operator role. Empty disables.
	OperatorClaim string
	// DefaultRole is the role granted to authenticated users who match no
	// claim mapping. Defaults to viewer.
	DefaultRole string
}

type Server struct {
	// contains filtered or unexported fields
}