config

type AppRoleConfig struct {
	// RoleID is the AppRole role ID.
	RoleID string `mapstructure:"role_id"`
	// SecretID is the AppRole secret ID.
	SecretID string `mapstructure:"secret_id"`
	// Mount is the AppRole auth method mount path. Defaults to "approle".
	Mount string `mapstructure:"mount"`
}

type AuthConfig struct {
	// PartnerKey is the pre-shared bearer token required on Tenant API requests.
	// CSV of keys is supported, e.g. "key1,key2".
	PartnerKey string `mapstructure:"partner_key"`
}

type Config struct {
	Identity IdentityConfig `mapstructure:"identity"`
	Server   ServerConfig   `mapstructure:"server"`
	Log      LogConfig      `mapstructure:"log"`
	Storage  StorageConfig  `mapstructure:"storage"`
	Vault    VaultConfig    `mapstructure:"vault"`
	PLC      PLCConfig      `mapstructure:"plc"`
	Auth     AuthConfig     `mapstructure:"auth"`
	Upload   UploadConfig   `mapstructure:"upload"`
}

type HashicorpConfig struct {
	// Address is the Vault server address, e.g. "http://127.0.0.1:8200".
	Address string `mapstructure:"address"`
	// Mount is the KV v2 secrets engine mount path. Defaults to "secret".
	Mount string `mapstructure:"mount"`
	// AuthMethod selects how to authenticate: "token" or "approle". Defaults to
	// "approle".
	AuthMethod string `mapstructure:"auth_method"`
	// Token is the Vault auth token (used when AuthMethod is "token").
	Token string `mapstructure:"token"`
	// AppRole holds the AppRole credentials (used when AuthMethod is "approle").
	AppRole AppRoleConfig `mapstructure:"approle"`
}

type IdentityConfig struct {
	// KeyFile is the path to a PEM-encoded Ed25519 private key. When empty, an
	// ephemeral key is generated at startup (its DID changes each restart).
	KeyFile string `mapstructure:"key_file"`
	// ServiceID is an optional did:web identity to wrap the key with, allowing
	// the service to accept UCANs addressed to the did:web (e.g.
	// "did:web:hilt.example.com"). When empty, the key's did:key is used.
	ServiceID string `mapstructure:"service_id"`
}

type LoadOption func(*viper.Viper) error

type LogConfig struct {
	Level string `mapstructure:"level"`
}

type PLCConfig struct {
	// Directory is the did:plc directory endpoint used to resolve and publish
	// PLC operations, e.g. "https://plc.directory".
	Directory string `mapstructure:"directory"`
}

type PostgresConfig struct {
	// DSN is a libpq-style connection string, e.g.
	// "postgres://user:pass@host:5432/db?sslmode=disable".
	DSN string `mapstructure:"dsn"`
	// MaxConns is the maximum number of connections the pool will hold.
	MaxConns int32 `mapstructure:"max_conns"`
	// MinConns is the minimum number of idle connections the pool maintains.
	MinConns int32 `mapstructure:"min_conns"`
	// SkipMigrations disables automatic goose migrations on startup.
	SkipMigrations bool `mapstructure:"skip_migrations"`
}

type ServerConfig struct {
	Host string `mapstructure:"host"`
	Port int    `mapstructure:"port"`
	// InsecureDIDResolution resolves did:web DIDs over HTTP instead of HTTPS on
	// the UCAN RPC server. This is insecure and intended only for local
	// development against services that serve their DID document over plain
	// HTTP; it must never be enabled in production.
	InsecureDIDResolution bool `mapstructure:"insecure_did_resolution"`
}

type StorageConfig struct {
	// Type selects the backend: "memory" or "postgres". Defaults to "postgres".
	Type     string         `mapstructure:"type"`
	Postgres PostgresConfig `mapstructure:"postgres"`
}

type UploadConfig struct {
	// ServiceID is the Sprue service's DID (e.g. "did:web:sprue.example.com").
	ServiceID string `mapstructure:"service_id"`
	// ServiceURL is the Sprue service's HTTP endpoint.
	ServiceURL string `mapstructure:"service_url"`
	// ProductID is the Sprue product/plan DID that tenants are registered under
	// when Hilt provisions them (the /customer/add product argument).
	ProductID string `mapstructure:"product_id"`
	// Proofs is the UCAN delegation container the upload client presents to Sprue
	// — either an inline (codec-prefixed) encoded container or a path to a file
	// containing one. Empty means no proofs (only self-issued calls will work).
	Proofs string `mapstructure:"proofs"`
}

type VaultConfig struct {
	// Type selects the backend: "hashicorp" or "memory". Defaults to "hashicorp".
	Type      string          `mapstructure:"type"`
	Hashicorp HashicorpConfig `mapstructure:"hashicorp"`
}