config

type ABACCondition struct {
	Attribute string `yaml:"attribute"` // e.g. "subject.role", "resource.name", "env.source_ip"
	Operator  string `yaml:"operator"`  // eq, neq, in, not_in, gt, lt, gte, lte, contains, regex, exists, not_exists
	Value     string `yaml:"value"`     // single value or comma-separated for "in"/"not_in"
}

type ABACObligation struct {
	Type   string `yaml:"type"`   // row_filter, mask_column, deny_column, query_limit
	Target string `yaml:"target"` // column name or table name
	Value  string `yaml:"value"`  // filter expression, mask function, limit value
}

type ABACPolicy struct {
	Name        string     `yaml:"name"`
	Description string     `yaml:"description"`
	Priority    int        `yaml:"priority"` // lower = evaluated first
	Enabled     *bool      `yaml:"enabled"`  // nil = true
	Rules       []ABACRule `yaml:"rules"`
}

type ABACRule struct {
	Effect      string           `yaml:"effect"` // "allow" or "deny"
	Conditions  []ABACCondition  `yaml:"conditions"`
	Obligations []ABACObligation `yaml:"obligations"` // only for "allow" rules
}

type Auth struct {
	Enabled      bool         `yaml:"enabled"`
	APIKeys      []AuthAPIKey `yaml:"api_keys"`
	JWT          AuthJWT      `yaml:"jwt"`
	MTLS         AuthMTLS     `yaml:"mtls"`
	Roles        []AuthRole   `yaml:"roles"`
	Policies     []AuthPolicy `yaml:"policies"`      // cell-level access policies (legacy)
	ABACPolicies []ABACPolicy `yaml:"abac_policies"` // ABAC access control policies
}

type AuthAPIKey struct {
	Key  string `yaml:"key"`
	Name string `yaml:"name"`
	Role string `yaml:"role"`
}

type AuthJWT struct {
	Enabled       bool   `yaml:"enabled"`
	Secret        string `yaml:"secret"`
	PublicKeyFile string `yaml:"public_key_file"`
	RoleClaim     string `yaml:"role_claim"`
	Issuer        string `yaml:"issuer"`
}

type AuthMTLS struct {
	Enabled     bool              `yaml:"enabled"`
	CAFile      string            `yaml:"ca_file"`
	CertFile    string            `yaml:"cert_file"` // server TLS cert
	KeyFile     string            `yaml:"key_file"`  // server TLS key
	RoleMap     map[string]string `yaml:"role_map"`  // CN/SAN -> role
	DefaultRole string            `yaml:"default_role"`
}

type AuthPolicy struct {
	Table     string            `yaml:"table"`
	Role      string            `yaml:"role"`
	Columns   map[string]string `yaml:"columns"`    // column -> "allow", "mask", "deny"
	RowFilter string            `yaml:"row_filter"` // SQL WHERE predicate
}

type AuthRole struct {
	Name        string       `yaml:"name"`
	Tables      []string     `yaml:"tables"`       // table names or "*" for all
	Allow       []string     `yaml:"allow"`        // "read", "write", "admin"
	QueryLimits *QueryLimits `yaml:"query_limits"` // per-role overrides (nil = use global)
}

type ChangeEvent struct {
	Old *Config
	New *Config
}

type Config struct {
	Mode        string      `yaml:"mode"` // standalone, coordinator, worker
	Storage     Storage     `yaml:"storage"`
	NATS        NATS        `yaml:"nats"`
	HTTP        HTTP        `yaml:"http"`
	GRPC        GRPC        `yaml:"grpc"`
	Worker      Worker      `yaml:"worker"`
	Parquet     Parquet     `yaml:"parquet"`
	Auth        Auth        `yaml:"auth"`
	GeoIP       GeoIP       `yaml:"geoip"`
	QueryLimits QueryLimits `yaml:"query_limits"` // global query cost limits
	Telemetry   Telemetry   `yaml:"telemetry"`    // OpenTelemetry tracing export
}

type GRPC struct {
	Addr string `yaml:"addr"`
}

type GeoIP struct {
	CityDB string `yaml:"city_db"` // path to GeoLite2-City.mmdb
	ASNDB  string `yaml:"asn_db"`  // path to GeoLite2-ASN.mmdb
}

type HTTP struct {
	Addr string `yaml:"addr"`
}

type Manager struct {
	// contains filtered or unexported fields
}

type NATS struct {
	Port        int      `yaml:"port"`
	URL         string   `yaml:"url"`          // for worker mode: coordinator's NATS URL
	StoreDir    string   `yaml:"store_dir"`    // JetStream storage directory
	ClusterID   string   `yaml:"cluster_id"`   // unique cluster identifier (e.g., "central", "afb-east")
	LeafRemotes []string `yaml:"leaf_remotes"` // remote NATS URLs for leaf node connections
	TLSCert     string   `yaml:"tls_cert"`     // TLS certificate file (server or client)
	TLSKey      string   `yaml:"tls_key"`      // TLS private key file
	TLSCA       string   `yaml:"tls_ca"`       // CA certificate for verifying peers (enables mTLS)
}

type Parquet struct {
	Compression    string `yaml:"compression"`      // snappy, zstd, gzip, lz4, none
	RowGroupSize   int    `yaml:"row_group_size"`   // rows per row group
	PageBufferSize int    `yaml:"page_buffer_size"` // page size in bytes
}

type QueryLimits struct {
	MaxScanBytes            int64 `yaml:"max_scan_bytes"`             // max estimated bytes across all scans
	MaxScanRows             int64 `yaml:"max_scan_rows"`              // max estimated rows across all scans
	MaxScanFiles            int   `yaml:"max_scan_files"`             // max files across all scans
	RequireFilterAboveBytes int64 `yaml:"require_filter_above_bytes"` // require WHERE on tables exceeding this size
	RequireLimitAboveRows   int64 `yaml:"require_limit_above_rows"`   // require LIMIT on scans exceeding this row count
}

type Storage struct {
	Type      string `yaml:"type"`     // "s3" (default) or "file"
	DataDir   string `yaml:"data_dir"` // local directory for type=file
	Endpoint  string `yaml:"endpoint"`
	AccessKey string `yaml:"access_key"`
	SecretKey string `yaml:"secret_key"`
	Bucket    string `yaml:"bucket"`
	UseSSL    bool   `yaml:"use_ssl"`
	Region    string `yaml:"region"`
}

type Subscriber func(event ChangeEvent)

type Telemetry struct {
	Endpoint   string  `yaml:"endpoint"`    // OTLP gRPC endpoint (e.g., "localhost:4317")
	Insecure   bool    `yaml:"insecure"`    // use plaintext gRPC (no TLS)
	SampleRate float64 `yaml:"sample_rate"` // 0.0-1.0 (default: 1.0 = always)
}

type Watcher struct {
	// contains filtered or unexported fields
}

type WatcherConfig struct {
	Path     string        // config file path
	Interval time.Duration // poll interval (default 2s)
	Debounce time.Duration // debounce window after change detected (default 500ms)
}

type Worker struct {
	MaxConcurrent    int    `yaml:"max_concurrent"`
	CacheBytes       int64  `yaml:"cache_bytes"`
	MemoryBudget     int64  `yaml:"memory_budget"`      // per-task memory budget in bytes (0 = unlimited, no spill)
	SpillDir         string `yaml:"spill_dir"`          // directory for spill files (default: os temp dir)
	ResultStoreBytes int64  `yaml:"result_store_bytes"` // in-memory result store capacity (0 = disabled)
}