config

type ApprovalConfig struct {
	// Enabled turns the approval gate on. When false, approval patterns on
	// grants are inert: nothing is ever held.
	Enabled bool `koanf:"enabled"`
	// SlackDelay is how long a hold must remain pending before a Slack
	// notification fires. Zero disables Slack escalation entirely. There is
	// no presence detection: if an admin was watching, they had this long to
	// act, and resolving the hold cancels the pending notification.
	SlackDelay string `koanf:"slack_delay"`
	// SlackSQL includes the (truncated) SQL text in the Slack message.
	// Default on. Slack is a lower trust boundary than the dbbat UI and this
	// feature pipes production query text into it, so it is switchable off.
	SlackSQL bool `koanf:"slack_sql"`
}

type AuthCacheConfig struct {
	// Enabled enables/disables the authentication cache.
	Enabled bool `koanf:"enabled"`

	// TTLSeconds is the time-to-live for cache entries in seconds.
	TTLSeconds int `koanf:"ttl_seconds"`

	// MaxSize is the maximum number of cache entries.
	MaxSize int `koanf:"max_size"`
}

type Config struct {
	// Proxy listen address.
	ListenPG string `koanf:"listen_pg"`

	// Oracle proxy listen address (empty = disabled).
	ListenOracle string `koanf:"listen_ora"`

	// MySQL proxy listen address (empty = disabled).
	ListenMySQL string `koanf:"listen_mysql"`

	// MongoDB proxy listen address (empty = disabled).
	ListenMongo string `koanf:"listen_mongo"`

	// SQL Server (TDS) proxy listen address (empty = disabled).
	ListenMSSQL string `koanf:"listen_mssql"`

	// REST API listen address.
	ListenAPI string `koanf:"listen_api"`

	// PostgreSQL DSN for DBBat storage.
	DSN string `koanf:"dsn"`

	// Base64-encoded encryption key (alternative to KeyFile).
	Key string `koanf:"key"`

	// Path to file containing encryption key (alternative to Key).
	KeyFile string `koanf:"keyfile"`

	// ConfigFile path (not loaded from config, set via CLI).
	ConfigFile string `koanf:"-"`

	// Encryption key for database credentials (32 bytes).
	// Populated from Key or KeyFile after loading.
	EncryptionKey []byte `koanf:"-"`

	// RunMode controls whether test data is provisioned on startup.
	RunMode RunMode `koanf:"run_mode"`

	// InstanceID identifies this dbbat process among the replicas sharing the
	// same store. It is stamped on every connection row, alongside the run id
	// the store mints at startup, so the reconcile of crash-orphaned
	// connections can tell a dead run's rows from a live one's. Defaults to the
	// hostname, which is the pod name under Kubernetes. Empty is not a valid
	// runtime value — Load fills it in.
	InstanceID string `koanf:"instance_id"`

	// DemoTargetDB specifies the only allowed database target in demo mode.
	// Format: "user:password@host/dbname" (e.g., "demo:demo@localhost/demo")
	// Only applies when RunMode is "demo". If empty, defaults to "demo:demo@localhost/demo".
	DemoTargetDB string `koanf:"demo_target_db"`

	// QueryStorage holds query result storage configuration.
	QueryStorage QueryStorageConfig `koanf:"query_storage"`

	// RateLimit holds rate limiting configuration.
	RateLimit RateLimitConfig `koanf:"rate_limit"`

	// Hash holds password hashing configuration.
	Hash HashConfig `koanf:"hash"`

	// AuthCache holds authentication cache configuration.
	AuthCache AuthCacheConfig `koanf:"auth_cache"`

	// BaseURL is the base URL path for the frontend app (default: "/app").
	BaseURL string `koanf:"base_url"`

	// Redirects contains dev redirect rules parsed from DBB_REDIRECTS env var.
	// Not loaded from config file, parsed from environment only.
	Redirects []RedirectRule `koanf:"-"`

	// LogLevel controls the logging verbosity (debug, info, warn, error).
	// Default is "info".
	LogLevel string `koanf:"log_level"`

	// SlackAuth holds Slack OAuth configuration.
	SlackAuth SlackAuthConfig `koanf:"slack_auth"`

	// Auth holds the auto-provisioning settings shared by every OAuth/OIDC
	// login provider.
	Auth OAuthUsersConfig `koanf:"auth"`

	// OIDCAuth holds the generic OpenID Connect login provider.
	OIDCAuth OIDCAuthConfig `koanf:"oidc"`

	// SlackNotify holds outbound Slack notification configuration for
	// grant request events.
	SlackNotify SlackNotifyConfig `koanf:"slack_notify"`

	// PublicURL is the externally reachable base URL for this dbbat
	// instance. Used to build deep-links in Slack notifications. Required
	// only if SlackNotify is enabled.
	PublicURL string `koanf:"public_url"`

	// Dump holds session packet dump configuration.
	Dump DumpConfig `koanf:"dump"`

	// MySQL holds MySQL proxy specific configuration.
	MySQL MySQLConfig `koanf:"mysql"`

	// Mongo holds MongoDB proxy specific configuration.
	Mongo MongoConfig `koanf:"mongo"`

	// MSSQL holds SQL Server proxy specific configuration.
	MSSQL MSSQLConfig `koanf:"mssql"`

	// PG holds PostgreSQL proxy specific configuration.
	PG PGConfig `koanf:"pg"`

	// Approval holds pattern-triggered approval-hold configuration.
	Approval ApprovalConfig `koanf:"approval"`

	// MCP holds the Model Context Protocol endpoint configuration.
	MCP MCPConfig `koanf:"mcp"`
}

type DemoTarget struct {
	Username string
	Password string
	Host     string
	Server   string
}

type DumpConfig struct {
	// Dir is the directory for dump files. Empty = disabled.
	Dir string `koanf:"dir"`

	// MaxSize is the maximum dump file size per session in bytes.
	MaxSize int64 `koanf:"max_size"`

	// Retention is the auto-delete duration for old dumps (e.g., "24h").
	//
	// It applies to the local spool only. When UploadURL is set, remote
	// retention is the bucket's own lifecycle policy — dbbat never expires
	// objects it uploaded, and never LISTs the bucket to look for them.
	Retention string `koanf:"retention"`

	// UploadURL is the blob-storage bucket finished captures are uploaded to
	// on session close, e.g. "s3://my-bucket/dbbat-captures". Empty — the
	// default — keeps captures on local disk only, which is the historical
	// behavior.
	//
	// The scheme selects the driver (gocloud.dev/blob): "s3://" for S3 and
	// S3-compatible stores, "file://" for a local directory (useful in tests
	// and for a mounted volume). Any path after the bucket is used as a key
	// prefix. Requires Dir: captures are always spooled locally first and
	// uploaded once complete.
	UploadURL string `koanf:"upload_url"`
}

type HashConfig struct {
	// Preset is a named configuration preset (default, low, minimal).
	Preset string `koanf:"preset"`

	// MemoryMB is the memory parameter in megabytes (1-1024).
	MemoryMB int `koanf:"memory_mb"`

	// Time is the time/iterations parameter (1-10).
	Time int `koanf:"time"`

	// Threads is the parallelism parameter (1-16).
	Threads int `koanf:"threads"`
}

type LoadOptions struct {
	// ConfigFile is the path to a config file (YAML, JSON, or TOML).
	ConfigFile string
}

type MCPConfig struct {
	// Enabled registers POST/GET/DELETE /api/v1/mcp. When false the routes do
	// not exist at all — a disabled feature should not answer, not even 403.
	Enabled bool `koanf:"enabled"`
}

type MSSQLConfig struct {
	// TLS holds TLS server-termination settings for the proxy. TDS is the odd
	// one out: the handshake is encapsulated inside PRELOGIN-typed TDS packets
	// rather than starting on a clean byte boundary, and a client connecting
	// with Encrypt=no still runs one — TLS then covers the LOGIN7 packet only.
	// When Disable is true the proxy answers ENCRYPT_NOT_SUP and the listener
	// stays plaintext, which also refuses clients that require encryption.
	TLS TLSConfig `koanf:"tls"`

	// TLSMaxVersion caps the client-leg handshake. Empty (the default) means
	// TLS 1.2 — see MSSQLDefaultTLSMaxVersion for why that is not simply "the
	// newest thing crypto/tls supports". "1.3" opts in.
	//
	// It lives here rather than on the shared TLSConfig because it is a TDS
	// encapsulation concern: the other four proxies upgrade on a clean byte
	// boundary and have nothing to decide.
	TLSMaxVersion string `koanf:"tls_max_version"`
}

type MongoConfig struct {
	// TLS holds TLS server-termination settings for the proxy. Mongo TLS is
	// implicit-from-byte-0 (no STARTTLS dance): when certs are configured (or
	// auto-generated) the proxy terminates TLS, and SASL PLAIN auth is only
	// accepted over TLS. When Disable is true the listener stays plaintext.
	TLS TLSConfig `koanf:"tls"`
}

type MySQLConfig struct {
	// TLS holds TLS server-termination settings for the proxy. When enabled,
	// the proxy advertises CLIENT_SSL and accepts SSL Request packets from
	// clients, terminating the TLS session at the proxy. Required for clean
	// caching_sha2_password full-auth (cleartext password over TLS).
	TLS TLSConfig `koanf:"tls"`
}

type OAuthProviderUsersConfig struct {
	// AutoCreateUsers is a pointer because "unset" and "false" must be
	// different answers. Auto-provisioning defaults to *on*, so a plain bool
	// would make an unset override indistinguishable from an explicit
	// "false" — and the whole point of the override is letting one provider
	// say false while the instance says true.
	AutoCreateUsers *bool `koanf:"auto_create_users"`
	// DefaultRole overrides the role this provider's auto-provisioned accounts
	// start with. Empty means "no override", so a provider cannot opt back
	// into the built-in default against an instance-wide setting — spelling the
	// instance-wide role out is the way to say that, and it is unambiguous.
	DefaultRole string `koanf:"default_role"`
}

type OAuthUsersConfig struct {
	// AutoCreateUsers lets an unknown but verified identity provision itself a
	// local account on first login. Defaults to true.
	AutoCreateUsers bool `koanf:"auto_create_users"`
	// DefaultRole is the role such an account starts with, and the floor a
	// group role mapping can never dig below. Empty means DefaultOAuthRole.
	DefaultRole string `koanf:"default_role"`
	// Providers overrides both settings for one login provider, keyed by the
	// provider's registered name ("slack", "oidc"). Written as
	// DBB_AUTH_AUTO_CREATE_USERS_<PROVIDER> / DBB_AUTH_DEFAULT_ROLE_<PROVIDER>,
	// or as auth.providers.<name>.* in a config file. A key nobody registered
	// is a startup failure (see Validate).
	Providers map[string]OAuthProviderUsersConfig `koanf:"providers"`
}

type OIDCAuthConfig struct {
	// Issuer is the OIDC issuer URL (e.g. "https://accounts.google.com").
	// Setting it is what enables the provider.
	Issuer string `koanf:"issuer"`
	// ClientID and ClientSecret identify this dbbat instance to the issuer.
	ClientID     string `koanf:"client_id"`
	ClientSecret string `koanf:"client_secret"`
	// Scopes is the space- or comma-separated scope list requested at
	// authorization time. "openid" is always added.
	Scopes string `koanf:"scopes"`
	// DisplayName is the login-button label (e.g. "Acme SSO").
	DisplayName string `koanf:"display_name"`
	// EmailDomains is an optional comma-separated allowlist. When set, a
	// login is rejected unless the *verified* email claim's domain is
	// listed — the generic equivalent of Slack's workspace gating.
	EmailDomains string `koanf:"email_domains"`
	// GroupsClaim names the ID-token claim carrying the user's directory
	// group membership. Empty means "groups", which is what Okta, Keycloak
	// and Entra all use by default.
	GroupsClaim string `koanf:"groups_claim"`
	// RoleMapping binds dbbat roles to directory groups, e.g.
	// "admin=db-admins,viewer=analysts". Empty disables the mapping
	// entirely, leaving role assignment manual.
	RoleMapping string `koanf:"role_mapping"`
}

type PGConfig struct {
	// TLS holds TLS server-termination settings for the proxy. When enabled,
	// the proxy responds 'S' to SSLRequest and terminates TLS at the proxy.
	// Without this, clients with sslmode=prefer silently fall back to
	// plaintext and credentials travel over the wire in the clear.
	TLS TLSConfig `koanf:"tls"`
}

type QueryStorageConfig struct {
	// MaxResultRows is the maximum number of rows to store per query.
	MaxResultRows int `koanf:"max_result_rows"`

	// MaxResultBytes is the maximum total bytes to store per query.
	MaxResultBytes int64 `koanf:"max_result_bytes"`

	// StoreResults enables/disables result storage globally.
	StoreResults bool `koanf:"store_results"`

	// Retention is how long query history (and the captured result rows
	// hanging off it) is kept, as a Go duration (e.g. "720h").
	//
	// Empty or "0" means keep forever, and that is the default: dbbat is an
	// audit tool, so an upgrade must never silently start deleting history.
	// Operators opt in — "720h" (30 days) is a reasonable starting point.
	Retention string `koanf:"retention"`
}

type RateLimitConfig struct {
	// Enabled enables/disables rate limiting.
	Enabled bool `koanf:"enabled"`

	// RequestsPerMinute is the rate limit for authenticated users.
	RequestsPerMinute int `koanf:"requests_per_minute"`

	// RequestsPerMinuteAnon is the rate limit for unauthenticated requests (by IP).
	RequestsPerMinuteAnon int `koanf:"requests_per_minute_anon"`

	// Burst allows short bursts above the rate limit.
	Burst int `koanf:"burst"`
}

type RedirectRule struct {
	// PathPrefix is the path prefix to match (e.g., "/app").
	PathPrefix string
	// TargetHost is the target host to proxy to (e.g., "localhost:5173").
	TargetHost string
	// TargetPath is the path on the target (e.g., "/").
	TargetPath string
}

type ResolvedHashParams struct {
	MemoryKB uint32
	Time     uint32
	Threads  uint8
}

type RunMode string

type SlackAuthConfig struct {
	ClientID     string `koanf:"client_id"`
	ClientSecret string `koanf:"client_secret"`
	TeamID       string `koanf:"team_id"`
}

type SlackNotifyConfig struct {
	// BotToken is the Slack bot user OAuth token (xoxb-...). Empty
	// disables notifications.
	BotToken string `koanf:"bot_token"`
	// Channel is the Slack channel id or name (e.g. "#dbbat") where
	// notifications are posted. Defaults to "#dbbat".
	Channel string `koanf:"channel"`
	// SigningSecret is the Slack app signing secret used to verify inbound
	// interaction callbacks (Approve/Deny button clicks). Empty disables
	// interactivity: messages carry no buttons and the inbound endpoint is
	// not registered — outbound notifications still work.
	SigningSecret string `koanf:"signing_secret"`
	// AppToken is the Slack app-level token (xapp-...) with the
	// connections:write scope. When set together with a bot token, dbbat
	// opens an outbound Socket Mode connection and receives Approve/Deny
	// interactions over it instead of the inbound HTTP endpoint — for
	// deployments that can't accept inbound Slack traffic. Empty = no Socket
	// Mode.
	AppToken string `koanf:"app_token"`
}

type TLSConfig struct {
	// CertFile is the path to a PEM-encoded server certificate.
	CertFile string `koanf:"cert_file"`

	// KeyFile is the path to a PEM-encoded server private key.
	KeyFile string `koanf:"key_file"`

	// Disable turns off TLS termination entirely. When true, SSL Request
	// packets from clients are refused and connections stay plaintext.
	Disable bool `koanf:"disable"`
}