proxy

type AuditConfig struct {
	// Enabled controls whether audit logging is active.
	Enabled bool `yaml:"enabled"`
	// LogRequestBody captures the upstream request payload (e.g. the ClickHouse
	// SQL or other POST body) in the audit entry. The full body is always
	// forwarded upstream; only the audited copy is truncated to MaxBodyBytes.
	// Defaults to true when unset.
	LogRequestBody *bool `yaml:"log_request_body"`
	// LogResponseBody captures the upstream response payload in the audit entry.
	// Response bodies can be large (full result sets), so this is off by default;
	// the audited copy is truncated to MaxBodyBytes.
	LogResponseBody bool `yaml:"log_response_body"`
	// MaxBodyBytes caps how many bytes of each captured body are stored in the
	// audit entry. Zero falls back to defaultMaxAuditBodyBytes.
	MaxBodyBytes int `yaml:"max_body_bytes"`
}

type Auditor struct {
	// contains filtered or unexported fields
}

type AuthConfig struct {
	// Mode is the authentication mode.
	Mode AuthMode `yaml:"mode"`

	// IssuerURL is the proxy's own issuer URL (mode 'oauth'), advertised to
	// clients for login discovery.
	IssuerURL string `yaml:"issuer_url,omitempty"`

	// ClientID is the client identifier advertised to clients (mode 'oauth').
	ClientID string `yaml:"client_id,omitempty"`

	// Issuers are the trusted external OIDC issuers (mode 'oidc'). A bearer token
	// is accepted if it verifies against ANY of them, letting the proxy trust
	// e.g. humans on one IdP and CI service accounts on another. The first issuer
	// is advertised to clients for interactive login.
	Issuers []OIDCIssuerConfig `yaml:"issuers,omitempty"`

	// GitHub configures the GitHub OAuth app used for user authentication.
	GitHub *auth.GitHubConfig `yaml:"github,omitempty"`

	// AllowedOrgs restricts access to members of these GitHub orgs.
	AllowedOrgs []string `yaml:"allowed_orgs,omitempty"`

	// Tokens configures proxy-issued bearer tokens.
	Tokens auth.TokensConfig `yaml:"tokens"`

	// AccessTokenTTL is the lifetime of proxy-issued access tokens.
	AccessTokenTTL time.Duration `yaml:"access_token_ttl,omitempty"`

	// RefreshTokenTTL is the lifetime of proxy-issued refresh tokens.
	RefreshTokenTTL time.Duration `yaml:"refresh_token_ttl,omitempty"`

	// SuccessPage customizes the OAuth callback success page shown in the browser.
	SuccessPage *auth.SuccessPageConfig `yaml:"success_page,omitempty"`
}

type AuthMetadataResponse struct {
	Enabled   bool   `json:"enabled"`
	Mode      string `json:"mode"`
	IssuerURL string `json:"issuer_url,omitempty"`
	ClientID  string `json:"client_id,omitempty"`
}

type AuthMode string

type AuthUser struct {
	Subject  string
	Username string
	Groups   []string
}

type Authenticator interface {
	// Middleware returns an HTTP middleware that authenticates requests.
	Middleware() func(http.Handler) http.Handler

	// Start starts any background processes.
	Start(ctx context.Context) error

	// Stop stops any background processes.
	Stop() error
}

type Authorizer struct {
	// contains filtered or unexported fields
}

type BaseDatasourceConfig struct {
	Name        string   `yaml:"name"`
	Description string   `yaml:"description,omitempty"`
	AllowedOrgs []string `yaml:"allowed_orgs,omitempty"`
}

type BenchmarkoorInstanceConfig struct {
	BaseDatasourceConfig `yaml:",inline"`
	URL                  string `yaml:"url"`
	APIKey               string `yaml:"api_key,omitempty"`
	// UIURL is the public benchmarkoor web UI, used to build deep links to
	// runs and suites. The UI host is not derivable from the API URL.
	UIURL string `yaml:"ui_url,omitempty"`
}

type ClickHouseClusterConfig struct {
	BaseDatasourceConfig `yaml:",inline"`
	Host                 string                           `yaml:"host"`
	Port                 int                              `yaml:"port"`
	Database             string                           `yaml:"database,omitempty"`
	Username             string                           `yaml:"username"`
	Password             string                           `yaml:"password"`
	Secure               bool                             `yaml:"secure"`
	SkipVerify           bool                             `yaml:"skip_verify,omitempty"`
	Timeout              int                              `yaml:"timeout,omitempty"`
	Autodiscover         bool                             `yaml:"autodiscover,omitempty"`
	AutodiscoverInterval time.Duration                    `yaml:"autodiscover_interval,omitempty"`
	Variants             []ClickHouseClusterVariantConfig `yaml:"variants,omitempty"`
	// Contains declares the datasets stored in this cluster. Passed through to
	// discovery verbatim; the proxy never interprets Params or Notes.
	Contains []DatasetBindingConfig `yaml:"contains,omitempty"`
}

type ClickHouseClusterVariantConfig struct {
	AllowedOrgs []string `yaml:"allowed_orgs,omitempty"`
	Host        string   `yaml:"host"`
	Port        int      `yaml:"port"`
	Database    string   `yaml:"database,omitempty"`
	Username    string   `yaml:"username"`
	Password    string   `yaml:"password"`
	Secure      bool     `yaml:"secure"`
	SkipVerify  bool     `yaml:"skip_verify,omitempty"`
	Timeout     int      `yaml:"timeout,omitempty"`
}

type Client interface {
	Service

	// Discover fetches datasource information from the proxy.
	Discover(ctx context.Context) error

	// EnsureAuthenticated checks if the user has valid credentials.
	EnsureAuthenticated(ctx context.Context) error
}

type ClientConfig struct {
	// Name is the configured proxy identifier used to tag datasource ownership.
	Name string

	// URL is the base URL of the proxy server (e.g., http://localhost:18081).
	URL string

	// IssuerURL is the OAuth issuer URL for proxy authentication.
	// If empty, URL is used and the client will only work against auth.mode=none proxies.
	IssuerURL string

	// ClientID is the OAuth client ID for authentication.
	ClientID string

	// AuthMode selects the proxy auth flow. Empty/"oauth"/"oidc" use the
	// interactive flows backed by the on-disk credential store;
	// "client_credentials" mints access tokens on demand with Username and
	// Password (Authentik service-account form) and keeps them in memory only.
	AuthMode string

	// Username is the service-account username for AuthMode "client_credentials".
	Username string

	// Password is the service-account app password for AuthMode "client_credentials".
	Password string

	// Resource is the OAuth protected resource to request tokens for.
	// Leave empty for standard OIDC providers that do not use RFC 8707 resource parameters.
	Resource string

	// RefreshTokenTTL is the expected lifetime of the refresh token.
	// When set, the credential store will refresh at 50% of this duration
	// to keep the refresh token alive via provider rotation.
	RefreshTokenTTL time.Duration

	// DiscoveryInterval is how often to refresh datasource info (default: 60 seconds).
	// Set to 0 to disable background refresh.
	DiscoveryInterval time.Duration

	// HTTPTimeout is the timeout for HTTP requests (default: 30 seconds).
	HTTPTimeout time.Duration

	// OnDiscover is invoked after every successful Discover (initial and background).
	// It runs synchronously on the discovery goroutine — keep work short and panic-free.
	// Typical use: re-initialize ProxyDiscoverable modules so newly added datasources
	// surface without a server restart.
	OnDiscover func()
}

type ClientRoute struct {
	// Name is the configured proxy identifier.
	Name string
	// Client is the underlying proxy client.
	Client Client
	// Local marks an in-process/local proxy. Local routes are never primary.
	Local bool
}

type DatasetBindingConfig struct {
	Dataset string            `yaml:"dataset"`
	Params  map[string]string `yaml:"params,omitempty"`
	Notes   string            `yaml:"notes,omitempty"`
}

type DatasourceConfig interface {
	DatasourceName() string
	DatasourceDescription() string
	DatasourceAllowedOrgs() []string
}

type DatasourceOwner struct {
	ProxyName string
	URL       string
}

type DatasourcesResponse struct {
	ClickHouseInfo     []types.DatasourceInfo `json:"clickhouse_info,omitempty"`
	PrometheusInfo     []types.DatasourceInfo `json:"prometheus_info,omitempty"`
	LokiInfo           []types.DatasourceInfo `json:"loki_info,omitempty"`
	BenchmarkoorInfo   []types.DatasourceInfo `json:"benchmarkoor_info,omitempty"`
	EthNodeAvailable   bool                   `json:"ethnode_available,omitempty"`
	EmbeddingAvailable bool                   `json:"embedding_available,omitempty"`
	EmbeddingModel     string                 `json:"embedding_model,omitempty"`
}

type EmbedCheckRequest struct {
	Model  string   `json:"model"`
	Hashes []string `json:"hashes"`
}

type EmbedCheckResponse struct {
	Cached []EmbedResult `json:"cached"`
}

type EmbedItem struct {
	Hash string `json:"hash"`
	Text string `json:"text"`
}

type EmbedRequest struct {
	Items []EmbedItem `json:"items"`
}

type EmbedResponse struct {
	Results []EmbedResult `json:"results"`
	Model   string        `json:"model"`
}

type EmbedResult struct {
	Hash   string    `json:"hash"`
	Vector []float32 `json:"vector"`
}

type EmbeddingCacheConfig struct {
	// Backend is the cache backend: "memory" (default) or "redis".
	Backend string `yaml:"backend,omitempty"`

	// RedisURL is the Redis connection URL (required when backend is "redis").
	RedisURL string `yaml:"redis_url,omitempty"`
}

type EmbeddingConfig struct {
	// APIKey is the API key for the embedding provider (e.g., OpenRouter).
	APIKey string `yaml:"api_key"`

	// Model is the embedding model name (default: "openai/text-embedding-3-small").
	Model string `yaml:"model,omitempty"`

	// APIURL is the base URL of the embedding API (default: "https://openrouter.ai/api/v1").
	APIURL string `yaml:"api_url,omitempty"`

	// Cache holds embedding cache configuration.
	Cache EmbeddingCacheConfig `yaml:"cache"`
}

type EmbeddingService struct {
	// contains filtered or unexported fields
}

type EthNodeInstanceConfig struct {
	BaseDatasourceConfig `yaml:",inline"`
	Username             string `yaml:"username"`
	Password             string `yaml:"password"`
}

type GitHubAPIConfig struct {
	// Token is a GitHub personal access token or app token with actions:write permission.
	Token string `yaml:"token"`
}

type HTTPServerConfig struct {
	// ListenAddr is the address to listen on (default: ":18081").
	ListenAddr string `yaml:"listen_addr,omitempty"`

	// ReadTimeout is the maximum duration for reading the entire request.
	ReadTimeout time.Duration `yaml:"read_timeout,omitempty"`

	// WriteTimeout is the maximum duration before timing out writes of the response.
	WriteTimeout time.Duration `yaml:"write_timeout,omitempty"`

	// IdleTimeout is the maximum amount of time to wait for the next request.
	IdleTimeout time.Duration `yaml:"idle_timeout,omitempty"`
}

type LokiInstanceConfig struct {
	BaseDatasourceConfig `yaml:",inline"`
	URL                  string                      `yaml:"url"`
	Username             string                      `yaml:"username,omitempty"`
	Password             string                      `yaml:"password,omitempty"`
	Variants             []LokiInstanceVariantConfig `yaml:"variants,omitempty"`
}

type LokiInstanceVariantConfig struct {
	AllowedOrgs []string `yaml:"allowed_orgs,omitempty"`
	URL         string   `yaml:"url"`
	Username    string   `yaml:"username,omitempty"`
	Password    string   `yaml:"password,omitempty"`
}

type MetricsConfig struct {
	// Enabled controls whether the Prometheus metrics server is active.
	Enabled bool `yaml:"enabled"`

	// ListenAddr is the address to serve the /metrics endpoint on.
	ListenAddr string `yaml:"listen_addr,omitempty"`

	// Port is the port to serve the /metrics endpoint on (default: 9090).
	Port int `yaml:"port,omitempty"`
}

type OIDCAuthenticatorConfig struct {
	Issuers []OIDCIssuerConfig
}

type OIDCIssuerConfig struct {
	IssuerURL string `yaml:"issuer_url"`
	ClientID  string `yaml:"client_id"`
}

type PrometheusInstanceConfig struct {
	BaseDatasourceConfig `yaml:",inline"`
	URL                  string                            `yaml:"url"`
	Username             string                            `yaml:"username,omitempty"`
	Password             string                            `yaml:"password,omitempty"`
	Variants             []PrometheusInstanceVariantConfig `yaml:"variants,omitempty"`
}

type PrometheusInstanceVariantConfig struct {
	AllowedOrgs []string `yaml:"allowed_orgs,omitempty"`
	URL         string   `yaml:"url"`
	Username    string   `yaml:"username,omitempty"`
	Password    string   `yaml:"password,omitempty"`
}

type RateLimitConfig struct {
	// Enabled controls whether rate limiting is active.
	Enabled bool `yaml:"enabled"`

	// RequestsPerMinute is the maximum requests per minute per user.
	RequestsPerMinute int `yaml:"requests_per_minute,omitempty"`

	// BurstSize is the maximum burst size.
	BurstSize int `yaml:"burst_size,omitempty"`
}

type RateLimiter struct {
	// contains filtered or unexported fields
}

type RateLimiterConfig struct {
	// RequestsPerMinute is the maximum requests per minute per user.
	RequestsPerMinute int

	// BurstSize is the maximum burst size.
	BurstSize int
}

type Router interface {
	Client

	// Primary returns the first external proxy client. It is nil when only
	// local clients are configured.
	Primary() Client

	// OwnerForDatasource returns the proxy that owns a datasource by type/name.
	OwnerForDatasource(datasourceType, datasourceName string) (DatasourceOwner, bool)

	// ClientForDatasource returns the proxy client that owns a datasource by type/name.
	ClientForDatasource(datasourceType, datasourceName string) (Client, bool)
}

type Server interface {
	// Start starts the proxy server.
	Start(ctx context.Context) error

	// Stop stops the proxy server.
	Stop(ctx context.Context) error

	// URL returns the proxy URL.
	URL() string

	// ClickHouseDatasources returns the list of ClickHouse datasource names.
	ClickHouseDatasources() []string

	// PrometheusDatasources returns the list of Prometheus datasource names.
	PrometheusDatasources() []string

	// LokiDatasources returns the list of Loki datasource names.
	LokiDatasources() []string
}

type ServerConfig struct {
	// Server holds HTTP server configuration.
	Server HTTPServerConfig `yaml:"server"`

	// Auth holds authentication configuration.
	Auth AuthConfig `yaml:"auth"`

	// ClickHouse holds ClickHouse cluster configurations.
	ClickHouse []ClickHouseClusterConfig `yaml:"clickhouse,omitempty"`

	// Prometheus holds Prometheus instance configurations.
	Prometheus []PrometheusInstanceConfig `yaml:"prometheus,omitempty"`

	// Loki holds Loki instance configurations.
	Loki []LokiInstanceConfig `yaml:"loki,omitempty"`

	// EthNode holds Ethereum node API access configuration.
	EthNode *EthNodeInstanceConfig `yaml:"ethnode,omitempty"`

	// Benchmarkoor holds benchmarkoor API instance configurations.
	Benchmarkoor []BenchmarkoorInstanceConfig `yaml:"benchmarkoor,omitempty"`

	// RateLimiting holds rate limiting configuration.
	RateLimiting RateLimitConfig `yaml:"rate_limiting"`

	// Audit holds audit logging configuration.
	Audit AuditConfig `yaml:"audit"`

	// Metrics holds Prometheus metrics configuration.
	Metrics MetricsConfig `yaml:"metrics"`

	// Embedding holds optional embedding API configuration.
	Embedding *EmbeddingConfig `yaml:"embedding,omitempty"`

	// GitHub holds optional GitHub API configuration for triggering workflows.
	GitHub *GitHubAPIConfig `yaml:"github,omitempty"`
}

type Service interface {
	// Start starts the service.
	Start(ctx context.Context) error

	// Stop stops the service.
	Stop(ctx context.Context) error

	// URL returns the proxy URL.
	URL() string

	// RegisterToken returns the current access token for server-to-proxy
	// requests, or NoAuthToken when no bearer token is required.
	RegisterToken() string

	// RevokeToken is a no-op for client-managed bearer tokens.
	RevokeToken()

	// ClickHouseDatasources returns the list of ClickHouse datasource names.
	ClickHouseDatasources() []string
	// ClickHouseDatasourceInfo returns detailed ClickHouse datasource info.
	ClickHouseDatasourceInfo() []types.DatasourceInfo
	// ClickHouseQuery runs a ClickHouse SQL query against the named datasource
	// through the proxy and returns the raw response body. The params are
	// appended to the query string (e.g. default_format, param_* bindings).
	// A non-2xx response from the proxy is returned as an error containing the
	// status code and the response body.
	ClickHouseQuery(ctx context.Context, datasource, sql string, params url.Values) ([]byte, error)

	// PrometheusDatasourceInfo returns detailed Prometheus datasource info.
	PrometheusDatasourceInfo() []types.DatasourceInfo

	// LokiDatasourceInfo returns detailed Loki datasource info.
	LokiDatasourceInfo() []types.DatasourceInfo

	// BenchmarkoorDatasourceInfo returns detailed benchmarkoor datasource info.
	BenchmarkoorDatasourceInfo() []types.DatasourceInfo

	// EthNodeAvailable returns true if ethnode proxy access is configured.
	EthNodeAvailable() bool
	// EthNodeDatasourceInfo returns the ethnode datasource info when ethnode
	// access is configured, or nil otherwise. Ethnode is exposed as a single
	// type-level datasource rather than a discoverable list.
	EthNodeDatasourceInfo() []types.DatasourceInfo

	// EmbeddingAvailable returns true if the proxy has embedding configured.
	EmbeddingAvailable() bool
	// EmbeddingModel returns the configured embedding model name.
	EmbeddingModel() string
}