lighthouse

type AdminAPIOptions struct {
	Enabled      bool
	UsersEnabled bool
	// Port: 0 mounts on main server under /api/v1/admin; >0 starts a separate server on this port
	Port int
	// ActorHeader is the HTTP header name to extract the actor from for event history.
	// Default: "X-Actor"
	ActorHeader string
	// ActorSource is the preferred source for actor extraction ("basic_auth" or "header").
	// Default: "basic_auth" (tries basic auth username first, then falls back to header)
	ActorSource string
}

type AuthorityHintEntityChecker struct {
	EntityID string `yaml:"entity_id"`
}

type CheckerContext struct {
	Store         model.TrustMarkedEntitiesStorageBackend
	TrustMarkType string
}

type ContextualEntityChecker interface {
	EntityChecker
	// SetContext sets the runtime context for this checker
	SetContext(ctx CheckerContext)
}

type DBListEntityChecker struct {
	// contains filtered or unexported fields
}

type DBTrustMarkSpecProvider struct {
	// contains filtered or unexported fields
}

type EligibilityCache struct {
	// contains filtered or unexported fields
}

type EndpointConf struct {
	// Path is the internal path for the endpoint.
	// Env: LH_ENDPOINTS_<ENDPOINT>_PATH
	//
	// NOTE: We intentionally omit the envconfig tag here. Using envconfig:"PATH"
	// would cause the library to also check the bare "PATH" env var as a fallback,
	// which collides with the system PATH and corrupts endpoint URLs.
	// By omitting the tag, envconfig uses the field name "Path" directly,
	// resulting in the correct LH_ENDPOINTS_<ENDPOINT>_PATH without fallback issues.
	Path string `yaml:"path"`
	// URL is the external URL for the endpoint.
	// Env: LH_ENDPOINTS_<ENDPOINT>_URL
	URL string `yaml:"url"`
}

type EntityChecker interface {
	// Check checks if the entity with the passed oidfed.EntityStatement
	// satisfies the requirements of this EntityChecker or not
	// It returns a bool indicating this status,
	// and if not a http status code as well as a oidfed.Error as api response
	Check(
		entityConfiguration *oidfed.EntityStatement,
		entityTypes []string,
	) (bool, int, *oidfed.Error)
	// Unmarshaler is used to load the configuration
	yaml.Unmarshaler
}

type EntityCheckerConfig struct {
	Type   string    `yaml:"type"`
	Config yaml.Node `yaml:"config,omitempty" ignored:"true"`
}

type EntityCheckerNone struct{}

type EntityIDEntityChecker struct {
	AllowedIDs []string `yaml:"entity_ids"`
}

type HTTPListEntityChecker struct {
	URL      string            `yaml:"url" json:"url"`
	Method   string            `yaml:"method" json:"method"`       // GET or POST, default GET
	Headers  map[string]string `yaml:"headers" json:"headers"`     // Additional headers
	Timeout  int               `yaml:"timeout" json:"timeout"`     // seconds, default 30
	CacheTTL int               `yaml:"cache_ttl" json:"cache_ttl"` // seconds, default 60
	// contains filtered or unexported fields
}

type HTTPListJWTEntityChecker struct {
	URL          string            `yaml:"url" json:"url"`
	Method       string            `yaml:"method" json:"method"`
	Headers      map[string]string `yaml:"headers" json:"headers"`
	Timeout      int               `yaml:"timeout" json:"timeout"`
	CacheTTL     int               `yaml:"cache_ttl" json:"cache_ttl"`
	ListClaim    string            `yaml:"list_claim" json:"list_claim"` // default "entities"
	Verification JWTVerification   `yaml:"verification" json:"verification"`
	// contains filtered or unexported fields
}

type IssuedTrustMarkCache struct {
	// contains filtered or unexported fields
}

type JWTVerification struct {
	Mode         JWTVerificationMode `yaml:"mode" json:"mode"`
	JWKS         *jwx.JWKS           `yaml:"jwks" json:"jwks,omitempty"`
	TrustAnchors oidfed.TrustAnchors `yaml:"trust_anchors" json:"trust_anchors,omitempty"`
}

type JWTVerificationMode string

type LightHouse struct {
	oidfed.FederationEntity
	*oidfed.TrustMarkIssuer
	*jwx.GeneralJWTSigner

	LogoBanner    bool
	VersionBanner bool
	// contains filtered or unexported fields
}

type MultipleEntityCheckerAnd struct {
	Checkers []EntityChecker
}

type MultipleEntityCheckerOr struct {
	Checkers []EntityChecker
}

type ServerConf struct {
	// IPListen is the IP address to listen on.
	// Env: LH_SERVER_IP_LISTEN
	IPListen string `yaml:"ip_listen" envconfig:"IP_LISTEN"`
	// Port is the HTTP server port.
	// Env: LH_SERVER_PORT
	Port int `yaml:"port" envconfig:"PORT"`
	// Prefork enables multiple processes listening on the same port.
	// When enabled, Fiber spawns child processes to distribute connections
	// across CPU cores for improved performance.
	// Note: When using prefork, it is strongly recommended to use Redis for
	// caching to ensure cache consistency across processes.
	// Env: LH_SERVER_PREFORK
	Prefork bool `yaml:"prefork" envconfig:"PREFORK"`
	// AdminAPIPort is set internally and not configurable via env.
	AdminAPIPort int `yaml:"-" envconfig:"-"`
	// TLS holds TLS configuration.
	// Env prefix: LH_SERVER_TLS_
	TLS tlsConf `yaml:"tls" envconfig:"TLS"`
	// TrustedProxies is a list of trusted proxy IPs.
	// Env: LH_SERVER_TRUSTED_PROXIES (comma-separated)
	TrustedProxies []string `yaml:"trusted_proxies" envconfig:"TRUSTED_PROXIES"`
	// ForwardedIPHeader is the header name for forwarded IP.
	// Env: LH_SERVER_FORWARDED_IP_HEADER
	ForwardedIPHeader string `yaml:"forwarded_ip_header" envconfig:"FORWARDED_IP_HEADER"`
}

type SigningConf struct {
	// KMS specifies the key management system to use.
	// Env: LH_SIGNING_KMS
	KMS string `yaml:"kms" envconfig:"KMS"`
	// PKBackend specifies the public key storage backend.
	// Env: LH_SIGNING_PK_BACKEND
	PKBackend string `yaml:"pk_backend" envconfig:"PK_BACKEND"`
	// AutoGenerateKeys enables automatic key generation if keys are missing.
	// Env: LH_SIGNING_AUTO_GENERATE_KEYS
	AutoGenerateKeys bool `yaml:"auto_generate_keys" envconfig:"AUTO_GENERATE_KEYS"`
	// FileSystemBackend holds filesystem-based key storage configuration.
	// Env prefix: LH_SIGNING_FILESYSTEM_
	FileSystemBackend struct {
		// KeyFile is the path to a single key file.
		// Env: LH_SIGNING_FILESYSTEM_KEY_FILE
		KeyFile string `yaml:"key_file" envconfig:"KEY_FILE"`
		// KeyDir is the directory for key files.
		// Env: LH_SIGNING_FILESYSTEM_KEY_DIR
		KeyDir string `yaml:"key_dir" envconfig:"KEY_DIR"`
	} `yaml:"filesystem" envconfig:"FILESYSTEM"`
	// PKCS11Backend holds PKCS#11 (HSM) configuration.
	// Env prefix: LH_SIGNING_PKCS11_
	PKCS11Backend struct {
		// StorageDir is the storage directory for PKCS#11.
		// Env: LH_SIGNING_PKCS11_STORAGE_DIR
		StorageDir string `yaml:"storage_dir" envconfig:"STORAGE_DIR"`

		// ModulePath is the path to the PKCS#11 module (crypto11.Config.Path)
		// Env: LH_SIGNING_PKCS11_MODULE_PATH
		ModulePath string `yaml:"module_path" envconfig:"MODULE_PATH"`
		// TokenLabel selects the token by label (crypto11.Config.TokenLabel)
		// Env: LH_SIGNING_PKCS11_TOKEN_LABEL
		TokenLabel string `yaml:"token_label" envconfig:"TOKEN_LABEL"`
		// TokenSerial selects the token by serial (crypto11.Config.TokenSerial)
		// Env: LH_SIGNING_PKCS11_TOKEN_SERIAL
		TokenSerial string `yaml:"token_serial" envconfig:"TOKEN_SERIAL"`
		// SlotNumber selects the token by slot number (crypto11.Config.SlotNumber)
		// Env: LH_SIGNING_PKCS11_TOKEN_SLOT
		SlotNumber *int `yaml:"token_slot" envconfig:"TOKEN_SLOT"`
		// Pin is the user PIN for the token (crypto11.Config.Pin)
		// Env: LH_SIGNING_PKCS11_PIN
		Pin string `yaml:"pin" envconfig:"PIN"`

		// MaxSessions is the maximum number of concurrent sessions to open.
		// If zero, DefaultMaxSessions is used. Otherwise, must be at least 2.
		// Env: LH_SIGNING_PKCS11_MAX_SESSIONS
		MaxSessions int `yaml:"max_sessions" envconfig:"MAX_SESSIONS"`

		// UserType identifies the user type logging in. If zero, DefaultUserType is used.
		// Env: LH_SIGNING_PKCS11_USER_TYPE
		UserType int `yaml:"user_type" envconfig:"USER_TYPE"`

		// LoginNotSupported should be set to true for tokens that do not support logging in.
		// Env: LH_SIGNING_PKCS11_NO_LOGIN
		LoginNotSupported bool `yaml:"no_login" envconfig:"NO_LOGIN"`

		// LabelPrefix is an optional prefix for object labels inside HSM.
		// Env: LH_SIGNING_PKCS11_LABEL_PREFIX
		LabelPrefix string `yaml:"label_prefix" envconfig:"LABEL_PREFIX"`

		// ExtraLabels are HSM object labels to load into this KMS even if
		// they are not present yet in the PublicKeyStorage.
		// Env: LH_SIGNING_PKCS11_LOAD_LABELS (comma-separated)
		ExtraLabels []string `yaml:"load_labels" envconfig:"LOAD_LABELS"`
	} `yaml:"pkcs11" envconfig:"PKCS11"`
}

type StatsOptions struct {
	// Enabled controls whether statistics collection is active.
	Enabled bool

	// BufferSize is the maximum number of entries in the ring buffer.
	BufferSize int

	// FlushInterval is how often the buffer is flushed to the database.
	FlushInterval time.Duration

	// FlushThreshold triggers a flush when the buffer is this percentage full.
	FlushThreshold float64

	// CaptureClientIP enables recording client IP addresses.
	CaptureClientIP bool

	// CaptureUserAgent enables recording User-Agent headers.
	CaptureUserAgent bool

	// CaptureQueryParams enables recording URL query parameters.
	CaptureQueryParams bool

	// GeoIPEnabled enables country lookup from IP addresses.
	GeoIPEnabled bool

	// GeoIPDBPath is the path to a MaxMind GeoLite2-Country.mmdb file.
	GeoIPDBPath string

	// DetailedRetention is how long to keep individual request logs.
	DetailedRetention time.Duration

	// AggregatedRetention is how long to keep daily aggregated statistics.
	AggregatedRetention time.Duration

	// Endpoints is a list of endpoint paths to track. Empty means all federation endpoints.
	Endpoints []string
}

type SubordinateListingRequest struct {
	EntityType    []string `json:"entity_type" query:"entity_type"`
	Intermediate  bool     `json:"intermediate" query:"intermediate"`
	TrustMarked   bool     `json:"trust_marked" query:"trust_marked"`
	TrustMarkType string   `json:"trust_mark_type" query:"trust_mark_type"`
}

type TrustMarkEndpointConfig struct {
	// Store for subject status (backward compatibility)
	Store model.TrustMarkedEntitiesStorageBackend
	// SpecStore for loading TrustMarkSpec from DB (new)
	SpecStore model.TrustMarkSpecStore
	// InstanceStore for tracking issued trust mark instances
	InstanceStore model.IssuedTrustMarkInstanceStore
	// Checkers map for backward compatibility (config-based checkers).
	//
	// Deprecated: This field is no longer used. Checkers should be configured
	// per TrustMarkSpec via EligibilityConfig in the database using the Admin API.
	// This field will be removed in a future version.
	Checkers map[string]EntityChecker
	// Cache for eligibility results
	Cache *EligibilityCache
	// IssuedTrustMarkCache caches issued trust mark JWTs to avoid repeated signing.
	// The TTL is configured per trust mark type via the TrustMarkSpec.CacheTTL field.
	IssuedTrustMarkCache *IssuedTrustMarkCache
}

type TrustMarkEntityChecker struct {
	TrustMarkType       string                    `yaml:"trust_mark_type"`
	TrustAnchors        oidfed.TrustAnchors       `yaml:"trust_anchors"`
	TrustMarkIssuerJWKS jwx.JWKS                  `yaml:"trust_mark_issuer_jwks"`
	TrustMarkOwnerSpec  oidfed.TrustMarkOwnerSpec `yaml:"trust_mark_owner"`
}

type TrustMarkStatusConfig struct {
	// InstanceStore for checking issued trust mark instances
	InstanceStore model.IssuedTrustMarkInstanceStore
}

type TrustMarkStatusResponse struct {
	Issuer    string `json:"iss"`
	IssuedAt  int64  `json:"iat"`
	TrustMark string `json:"trust_mark"`
	Status    string `json:"status"`
}

type TrustPathEntityChecker struct {
	TrustAnchors oidfed.TrustAnchors `yaml:"trust_anchors"`
	// contains filtered or unexported fields
}