middleware

type AuthConfig struct {
	Verifier *auth.Verifier

	// RequireScopes enforces that the authenticated principal has all listed scopes.
	RequireScopes []auth.Scope

	// Policy optionally performs an external policy check.
	// If Policy is set, Action and Resource must be non-empty stable strings.
	Policy   auth.PolicyChecker
	Action   string
	Resource string
}

type Metrics struct {
	RequestsTotal   *prometheus.CounterVec
	RequestDuration *prometheus.HistogramVec
	// contains filtered or unexported fields
}

type MetricsConfig struct {
	Namespace string
	Subsystem string
	Registry  prometheus.Registerer

	// If true, status will be grouped (2xx, 4xx, 5xx) instead of exact code.
	GroupStatus bool
}

type Middleware func(http.Handler) http.Handler

type OTelConfig struct {
	// Optional: customize span naming. If nil, otelhttp default is used.
	SpanNameFormatter func(operation string, r *http.Request) string
}

type TenantConfig struct {
	Mode     TenantMode
	Required bool
	Header   string

	// AllowHeaderWithoutAuth allows reading tenant_id from header even when subject_id is empty.
	// Default false. Keep this disabled for public edge handlers.
	AllowHeaderWithoutAuth bool
}

type TenantMode int