config

type ClientConfig struct {
	Server ServerConfig `yaml:"server"`
	Proxy  ProxyConfig  `yaml:"proxy"`
	// contains filtered or unexported fields
}

type Config struct {
	Server        ServerConfig        `yaml:"server"`
	Sandbox       SandboxConfig       `yaml:"sandbox"`
	Proxy         ProxyConfig         `yaml:"proxy"`
	Storage       StorageConfig       `yaml:"storage"`
	Observability ObservabilityConfig `yaml:"observability"`
	// contains filtered or unexported fields
}

type ObservabilityConfig struct {
	MetricsEnabled bool `yaml:"metrics_enabled"`
	MetricsPort    int  `yaml:"metrics_port"`
}

type ProxyAuthConfig struct {
	// Mode describes the proxy auth flow. "oauth" is the legacy embedded proxy issuer,
	// "oidc" is an external OpenID Connect issuer such as Dex.
	Mode string `yaml:"mode,omitempty"`

	// IssuerURL is the OAuth issuer URL for proxy authentication.
	IssuerURL string `yaml:"issuer_url"`

	// ClientID is the OAuth client ID for authentication.
	ClientID string `yaml:"client_id"`

	// Resource is the optional OAuth resource indicator to request.
	// Leave empty for standard OIDC providers that do not use RFC 8707 resource parameters.
	Resource string `yaml:"resource,omitempty"`

	// RefreshTokenTTL is the expected lifetime of the refresh token issued by the
	// OIDC provider. When set, the client will proactively refresh at 50% of this
	// duration to keep the refresh token alive via provider rotation.
	RefreshTokenTTL time.Duration `yaml:"refresh_token_ttl,omitempty"`
}

type ProxyConfig struct {
	// URL is the base URL of the proxy server (e.g., http://localhost:18081).
	URL string `yaml:"url"`

	// Auth configures authentication for the proxy.
	// Optional - if not set, the proxy must allow unauthenticated access.
	Auth *ProxyAuthConfig `yaml:"auth,omitempty"`
}

type SandboxConfig struct {
	Backend        string  `yaml:"backend"`
	Image          string  `yaml:"image"`
	Timeout        int     `yaml:"timeout"`
	MemoryLimit    string  `yaml:"memory_limit"`
	CPULimit       float64 `yaml:"cpu_limit"`
	Network        string  `yaml:"network"`
	HostSharedPath string  `yaml:"host_shared_path,omitempty"`

	// Instance identifies this server's sandbox containers with a custom label.
	// Used to distinguish containers from different server instances (e.g., probe runner vs production).
	// When set, containers are labeled with "io.ethpandaops-panda.instance=<value>".
	Instance string `yaml:"instance,omitempty"`

	// Session configuration for persistent execution environments.
	Sessions SessionConfig `yaml:"sessions"`

	// Logging configuration for sandbox executions.
	Logging SandboxLoggingConfig `yaml:"logging"`
}

type SandboxLoggingConfig struct {
	// LogCode logs the full Python code submitted to execute_python.
	// Disabled by default as code may contain sensitive data.
	LogCode bool `yaml:"log_code"`

	// LogOutput logs stdout and stderr from execution.
	// Disabled by default as output may be large or contain sensitive data.
	LogOutput bool `yaml:"log_output"`
}

type ServerConfig struct {
	Host       string `yaml:"host"`
	Port       int    `yaml:"port"`
	BaseURL    string `yaml:"base_url"`
	SandboxURL string `yaml:"sandbox_url,omitempty"`
	URL        string `yaml:"url,omitempty"`

	// Deprecated: Transport is accepted for backwards compatibility but ignored.
	// The server always runs HTTP with both SSE and streamable-http transports.
	Transport string `yaml:"transport,omitempty"`
}

type SessionConfig struct {
	// Enabled controls whether session support is available. Defaults to true.
	Enabled *bool `yaml:"enabled,omitempty"`
	// TTL is the duration after which an idle session is destroyed (since last use).
	TTL time.Duration `yaml:"ttl"`
	// MaxDuration is the maximum lifetime of a session regardless of activity.
	MaxDuration time.Duration `yaml:"max_duration"`
	// MaxSessions is the maximum number of concurrent sessions allowed.
	MaxSessions int `yaml:"max_sessions"`
}

type StorageConfig struct {
	// BaseDir is the directory where uploaded files are stored.
	// Defaults to ~/.panda/data/storage.
	BaseDir string `yaml:"base_dir,omitempty"`

	// CacheDir is the directory for the local embedding vector cache.
	// Defaults to a "cache" sibling of BaseDir.
	CacheDir string `yaml:"cache_dir,omitempty"`
}