config

type ApprovalConfig struct {
	// Enabled turns the approval gate on. When false, approval patterns on
	// grants are inert: nothing is ever held.
	Enabled bool `koanf:"enabled"`
	// SlackDelay is how long a hold must remain pending before a Slack
	// notification fires. Zero disables Slack escalation entirely. There is
	// no presence detection: if an admin was watching, they had this long to
	// act, and resolving the hold cancels the pending notification.
	SlackDelay string `koanf:"slack_delay"`
	// SlackSQL includes the (truncated) SQL text in the Slack message.
	// Default on. Slack is a lower trust boundary than the dbbat UI and this
	// feature pipes production query text into it, so it is switchable off.
	SlackSQL bool `koanf:"slack_sql"`
}

type AuthCacheConfig struct {
	// Enabled enables/disables the authentication cache.
	Enabled bool `koanf:"enabled"`

	// TTLSeconds is the time-to-live for cache entries in seconds.
	TTLSeconds int `koanf:"ttl_seconds"`

	// MaxSize is the maximum number of cache entries.
	MaxSize int `koanf:"max_size"`
}

type Config struct {
	// Proxy listen address.
	ListenPG string `koanf:"listen_pg"`

	// Oracle proxy listen address (empty = disabled).
	ListenOracle string `koanf:"listen_ora"`

	// MySQL proxy listen address (empty = disabled).
	ListenMySQL string `koanf:"listen_mysql"`

	// MongoDB proxy listen address (empty = disabled).
	ListenMongo string `koanf:"listen_mongo"`

	// REST API listen address.
	ListenAPI string `koanf:"listen_api"`

	// PostgreSQL DSN for DBBat storage.
	DSN string `koanf:"dsn"`

	// Base64-encoded encryption key (alternative to KeyFile).
	Key string `koanf:"key"`

	// Path to file containing encryption key (alternative to Key).
	KeyFile string `koanf:"keyfile"`

	// ConfigFile path (not loaded from config, set via CLI).
	ConfigFile string `koanf:"-"`

	// Encryption key for database credentials (32 bytes).
	// Populated from Key or KeyFile after loading.
	EncryptionKey []byte `koanf:"-"`

	// RunMode controls whether test data is provisioned on startup.
	RunMode RunMode `koanf:"run_mode"`

	// InstanceID identifies this dbbat process among the replicas sharing the
	// same store. It is stamped on every connection row so the startup
	// reconcile of crash-orphaned connections only ever touches connections
	// this instance opened. Defaults to the hostname, which is the pod name
	// under Kubernetes. Empty is not a valid runtime value — Load fills it in.
	InstanceID string `koanf:"instance_id"`

	// DemoTargetDB specifies the only allowed database target in demo mode.
	// Format: "user:password@host/dbname" (e.g., "demo:demo@localhost/demo")
	// Only applies when RunMode is "demo". If empty, defaults to "demo:demo@localhost/demo".
	DemoTargetDB string `koanf:"demo_target_db"`

	// QueryStorage holds query result storage configuration.
	QueryStorage QueryStorageConfig `koanf:"query_storage"`

	// RateLimit holds rate limiting configuration.
	RateLimit RateLimitConfig `koanf:"rate_limit"`

	// Hash holds password hashing configuration.
	Hash HashConfig `koanf:"hash"`

	// AuthCache holds authentication cache configuration.
	AuthCache AuthCacheConfig `koanf:"auth_cache"`

	// BaseURL is the base URL path for the frontend app (default: "/app").
	BaseURL string `koanf:"base_url"`

	// Redirects contains dev redirect rules parsed from DBB_REDIRECTS env var.
	// Not loaded from config file, parsed from environment only.
	Redirects []RedirectRule `koanf:"-"`

	// LogLevel controls the logging verbosity (debug, info, warn, error).
	// Default is "info".
	LogLevel string `koanf:"log_level"`

	// SlackAuth holds Slack OAuth configuration.
	SlackAuth SlackAuthConfig `koanf:"slack_auth"`

	// SlackNotify holds outbound Slack notification configuration for
	// grant request events.
	SlackNotify SlackNotifyConfig `koanf:"slack_notify"`

	// PublicURL is the externally reachable base URL for this dbbat
	// instance. Used to build deep-links in Slack notifications. Required
	// only if SlackNotify is enabled.
	PublicURL string `koanf:"public_url"`

	// Dump holds session packet dump configuration.
	Dump DumpConfig `koanf:"dump"`

	// MySQL holds MySQL proxy specific configuration.
	MySQL MySQLConfig `koanf:"mysql"`

	// Mongo holds MongoDB proxy specific configuration.
	Mongo MongoConfig `koanf:"mongo"`

	// PG holds PostgreSQL proxy specific configuration.
	PG PGConfig `koanf:"pg"`

	// Approval holds pattern-triggered approval-hold configuration.
	Approval ApprovalConfig `koanf:"approval"`
}

type DemoTarget struct {
	Username string
	Password string
	Host     string
	Server   string
}

type DumpConfig struct {
	// Dir is the directory for dump files. Empty = disabled.
	Dir string `koanf:"dir"`

	// MaxSize is the maximum dump file size per session in bytes.
	MaxSize int64 `koanf:"max_size"`

	// Retention is the auto-delete duration for old dumps (e.g., "24h").
	Retention string `koanf:"retention"`
}

type HashConfig struct {
	// Preset is a named configuration preset (default, low, minimal).
	Preset string `koanf:"preset"`

	// MemoryMB is the memory parameter in megabytes (1-1024).
	MemoryMB int `koanf:"memory_mb"`

	// Time is the time/iterations parameter (1-10).
	Time int `koanf:"time"`

	// Threads is the parallelism parameter (1-16).
	Threads int `koanf:"threads"`
}

type LoadOptions struct {
	// ConfigFile is the path to a config file (YAML, JSON, or TOML).
	ConfigFile string
}

type MongoConfig struct {
	// TLS holds TLS server-termination settings for the proxy. Mongo TLS is
	// implicit-from-byte-0 (no STARTTLS dance): when certs are configured (or
	// auto-generated) the proxy terminates TLS, and SASL PLAIN auth is only
	// accepted over TLS. When Disable is true the listener stays plaintext.
	TLS TLSConfig `koanf:"tls"`
}

type MySQLConfig struct {
	// TLS holds TLS server-termination settings for the proxy. When enabled,
	// the proxy advertises CLIENT_SSL and accepts SSL Request packets from
	// clients, terminating the TLS session at the proxy. Required for clean
	// caching_sha2_password full-auth (cleartext password over TLS).
	TLS TLSConfig `koanf:"tls"`
}

type PGConfig struct {
	// TLS holds TLS server-termination settings for the proxy. When enabled,
	// the proxy responds 'S' to SSLRequest and terminates TLS at the proxy.
	// Without this, clients with sslmode=prefer silently fall back to
	// plaintext and credentials travel over the wire in the clear.
	TLS TLSConfig `koanf:"tls"`
}

type QueryStorageConfig struct {
	// MaxResultRows is the maximum number of rows to store per query.
	MaxResultRows int `koanf:"max_result_rows"`

	// MaxResultBytes is the maximum total bytes to store per query.
	MaxResultBytes int64 `koanf:"max_result_bytes"`

	// StoreResults enables/disables result storage globally.
	StoreResults bool `koanf:"store_results"`

	// Retention is how long query history (and the captured result rows
	// hanging off it) is kept, as a Go duration (e.g. "720h").
	//
	// Empty or "0" means keep forever, and that is the default: dbbat is an
	// audit tool, so an upgrade must never silently start deleting history.
	// Operators opt in — "720h" (30 days) is a reasonable starting point.
	Retention string `koanf:"retention"`
}

type RateLimitConfig struct {
	// Enabled enables/disables rate limiting.
	Enabled bool `koanf:"enabled"`

	// RequestsPerMinute is the rate limit for authenticated users.
	RequestsPerMinute int `koanf:"requests_per_minute"`

	// RequestsPerMinuteAnon is the rate limit for unauthenticated requests (by IP).
	RequestsPerMinuteAnon int `koanf:"requests_per_minute_anon"`

	// Burst allows short bursts above the rate limit.
	Burst int `koanf:"burst"`
}

type RedirectRule struct {
	// PathPrefix is the path prefix to match (e.g., "/app").
	PathPrefix string
	// TargetHost is the target host to proxy to (e.g., "localhost:5173").
	TargetHost string
	// TargetPath is the path on the target (e.g., "/").
	TargetPath string
}

type ResolvedHashParams struct {
	MemoryKB uint32
	Time     uint32
	Threads  uint8
}

type RunMode string

type SlackAuthConfig struct {
	ClientID        string `koanf:"client_id"`
	ClientSecret    string `koanf:"client_secret"`
	TeamID          string `koanf:"team_id"`
	AutoCreateUsers bool   `koanf:"auto_create_users"`
	DefaultRole     string `koanf:"default_role"`
}

type SlackNotifyConfig struct {
	// BotToken is the Slack bot user OAuth token (xoxb-...). Empty
	// disables notifications.
	BotToken string `koanf:"bot_token"`
	// Channel is the Slack channel id or name (e.g. "#dbbat") where
	// notifications are posted. Defaults to "#dbbat".
	Channel string `koanf:"channel"`
	// SigningSecret is the Slack app signing secret used to verify inbound
	// interaction callbacks (Approve/Deny button clicks). Empty disables
	// interactivity: messages carry no buttons and the inbound endpoint is
	// not registered — outbound notifications still work.
	SigningSecret string `koanf:"signing_secret"`
	// AppToken is the Slack app-level token (xapp-...) with the
	// connections:write scope. When set together with a bot token, dbbat
	// opens an outbound Socket Mode connection and receives Approve/Deny
	// interactions over it instead of the inbound HTTP endpoint — for
	// deployments that can't accept inbound Slack traffic. Empty = no Socket
	// Mode.
	AppToken string `koanf:"app_token"`
}

type TLSConfig struct {
	// CertFile is the path to a PEM-encoded server certificate.
	CertFile string `koanf:"cert_file"`

	// KeyFile is the path to a PEM-encoded server private key.
	KeyFile string `koanf:"key_file"`

	// Disable turns off TLS termination entirely. When true, SSL Request
	// packets from clients are refused and connections stay plaintext.
	Disable bool `koanf:"disable"`
}