registry

type Collection struct {
	Realm         string
	Database      string
	MongoDatabase string // <realm>__<database>
	Name          string
	SchemaPath    string             // path of schema.json, for error messages
	RawSchema     map[string]any     // decoded schema.json (numbers as json.Number)
	Schema        *jsonschema.Schema // compiled draft 2020-12 schema
	Fields        map[string]Field   // dot path → field info, for query checks
	Indexes       []Index            // declared in indexes.json
	IndexPath     string             // path of indexes.json, when present
	Rules         *rules.Set         // from rules.yaml; nil allows nothing
}

type Database struct {
	Realm       string
	Name        string
	MongoName   string // <realm>__<database>
	Collections map[string]*Collection
	Functions   *Functions // from _functions/; nil when the database has none
}

type Field struct {
	Types     []string // JSON Schema types; empty when the schema doesn't constrain it
	ItemTypes []string // for arrays: the types of the items, when declared
}

type Function struct {
	Realm, Database, Name string
	Dir                   string // the function's folder
	Entry                 string // index.js or index.ts, relative to the project (slash-separated)
	Mode                  string
	Timeout               time.Duration
	Memory                int64 // bytes
	MaxOutput             int64 // bytes
	Concurrency           int
	RateLimit             *RateLimit     // nil: none
	Idempotency           string         // optional or required
	Invoke                *rules.Rule    // nil: only API keys may invoke
	Admin                 bool           // ctx.admin.db with full access
	Schedule              *cron.Schedule // nil: not scheduled
	ScheduleExpr          string
	Secrets               []SecretRef
	Network               []string // hosts (host or host:port) the function may reach
	InputSchema           *jsonschema.Schema
	OutputSchema          *jsonschema.Schema
}

type Functions struct {
	Dir       string               // the _functions directory
	Functions map[string]*Function // by name
}

type Index struct {
	Keys   []IndexKey
	Unique bool
}

type IndexKey struct {
	Field string
	Desc  bool
}

type Manifest struct {
	Deno      string                    `json:"deno"`
	Source    string                    `json:"source"` // SourceHash of the project when built
	Functions map[string]ManifestBundle `json:"functions"`
}

type ManifestBundle struct {
	Bundle string `json:"bundle"` // file name in .build
	SHA256 string `json:"sha256"`
}

type Networks []netip.Prefix

type RateLimit struct {
	Per    string // user or ip
	Limit  int
	Window time.Duration
}

type Realm struct {
	Name      string
	Settings  RealmSettings // from realm.yaml
	Databases map[string]*Database
}

type RealmSettings struct {
	AuthEnabled       bool
	Signup            string
	IdleTimeout       time.Duration
	MaxLifetime       time.Duration
	PasswordMinLength int
	CORSOrigins       []string
	Roles             map[string]Role
	// AdminNetworks restricts every admin API request (admin.allowed_networks);
	// empty means unrestricted.
	AdminNetworks Networks
	// UserNetworks are the network restrictions realm.yaml sets per user
	// email (in a role's user entries).
	UserNetworks map[string]UserNetworks
	// AuditRetention is how long audit records are kept (audit.retention);
	// DefaultAuditRetention when not set.
	AuditRetention time.Duration
	// FunctionsMaxConcurrency caps how many function calls may run at once
	// on this backd instance (functions.max_concurrency); 0 means
	// unlimited. Applies whether or not auth is enabled.
	FunctionsMaxConcurrency int
	// FunctionsLogRetention is how long invocation records (roadmap F10)
	// are kept (functions.log_retention); DefaultLogRetention when not
	// set. Needs auth enabled, like the rest of functions.* except
	// max_concurrency: there's no system database to store them in
	// otherwise.
	FunctionsLogRetention time.Duration
	// FunctionsJobRetention is how long an async job's result (roadmap
	// F11) is kept once done (functions.job_retention); DefaultJobRetention
	// when not set. Needs auth enabled, like FunctionsLogRetention.
	FunctionsJobRetention time.Duration
}

type Registry struct {
	Realms map[string]*Realm
	Root   string // the CONFIG_DIR it was loaded from
}

type Role struct {
	Description string
	// Admin roles let the sessions of users holding them use the admin API.
	Admin bool
	// Users are seed assignments: normalized (trimmed, lowercased) emails.
	Users []string
}

type SecretRef struct {
	Realm bool
	Name  string
}

type UserNetworks struct {
	Admin Networks // the user's admin API requests; within AdminNetworks
	Login Networks // login and every request with the user's session
}