config

type APIKeyConfig struct {
	ID                string   `yaml:"id"`                  // Unique identifier for the API key
	Name              string   `yaml:"name"`                // Human-readable name
	PublicKey         string   `yaml:"public_key"`          // Ed25519 public key (hex or base64, auto-detected)
	PublicKeyEnv      string   `yaml:"public_key_env"`      // Environment variable containing public key
	AllowedChainTypes []string `yaml:"allowed_chain_types"` // Empty = all chains allowed
	AllowedSigners    []string `yaml:"allowed_signers"`     // Empty = all signers allowed
	AllowedHDWallets  []string `yaml:"allowed_hd_wallets"`  // HD wallet primary addresses (empty = none)
	RateLimit         int      `yaml:"rate_limit"`          // Requests per minute (default: 100)
	Enabled           bool     `yaml:"enabled"`             // Whether the key is active
	Admin             bool     `yaml:"admin"`               // Admin keys can approve requests and manage rules
}

type APIKeyInitializer struct {
	// contains filtered or unexported fields
}

type ApprovalGuardConfig struct {
	Enabled     bool          `yaml:"enabled"`
	Window      time.Duration `yaml:"window"`       // time window for counting (e.g. 5m); 0 = no window check
	Threshold   int           `yaml:"threshold"`    // consecutive rejections (blocked or manual-approval) that trigger pause (e.g. 10)
	ResumeAfter time.Duration `yaml:"resume_after"` // pause duration after which to auto-resume (e.g. 2h)
}

type ChainsConfig struct {
	EVM *EVMConfig `yaml:"evm,omitempty"`
}

type Config struct {
	Server        ServerConfig        `yaml:"server"`
	Database      storage.Config      `yaml:"database"`
	Chains        ChainsConfig        `yaml:"chains"`
	Notify        notify.Config       `yaml:"notify"`
	NotifyChannel notify.Channel      `yaml:"notify_channels"`
	AuditMonitor  audit.MonitorConfig `yaml:"audit_monitor"`
	Security      SecurityConfig      `yaml:"security"`
	Logger        LoggerConfig        `yaml:"logger"`
	APIKeys       []APIKeyConfig      `yaml:"api_keys"`
	Templates     []TemplateConfig    `yaml:"templates"`
	Rules         []RuleConfig        `yaml:"rules"`
}

type EVMConfig struct {
	Enabled     bool             `yaml:"enabled"`
	Signers     evm.SignerConfig `yaml:"signers"`
	KeystoreDir string           `yaml:"keystore_dir"`  // Directory for storing dynamically created keystores
	HDWalletDir string           `yaml:"hd_wallet_dir"` // Directory for storing HD wallets
	Foundry     FoundryConfig    `yaml:"foundry"`
}

type FoundryConfig struct {
	Enabled   bool          `yaml:"enabled"`
	ForgePath string        `yaml:"forge_path"` // path to forge binary, empty = auto-detect from PATH
	CacheDir  string        `yaml:"cache_dir"`  // cache directory for compiled scripts
	TempDir   string        `yaml:"temp_dir"`   // workspace dir for rule scripts and lib/forge-std; empty = os.TempDir()/remote-signer-rules. For Docker, set to /app/data/forge-workspace and mount repo data/forge-workspace.
	Timeout   time.Duration `yaml:"timeout"`    // max execution time per rule (default: 30s)
}

type IPWhitelistConfig struct {
	// Enabled controls whether IP whitelist is enforced
	Enabled bool `yaml:"enabled"`
	// AllowedIPs is a list of allowed IP addresses or CIDR ranges
	// Examples: "192.168.1.1", "10.0.0.0/8", "::1"
	AllowedIPs []string `yaml:"allowed_ips"`
	// TrustProxy enables parsing X-Forwarded-For and X-Real-IP headers
	// WARNING: Only enable this if running behind a trusted reverse proxy
	TrustProxy bool `yaml:"trust_proxy"`
	// TrustedProxies is a list of IP addresses or CIDR ranges of trusted reverse proxies
	// When TrustProxy is true, X-Forwarded-For/X-Real-IP headers are only honored
	// if the request's direct RemoteAddr matches one of these entries.
	// If TrustProxy is true but TrustedProxies is empty, proxy headers are ignored
	// (fail-closed: no trusted proxies means no header trust).
	TrustedProxies []string `yaml:"trusted_proxies"`
}

type LoggerConfig struct {
	Level  string `yaml:"level"` // debug, info, warn, error
	Pretty bool   `yaml:"pretty"`
}

type RuleConfig struct {
	// Id is an optional stable rule ID. If set, it is used as the rule's ID (for delegate_to etc.);
	// must be unique across all rules. If empty, a deterministic ID is generated from config order.
	Id            string                 `yaml:"id,omitempty" json:"id,omitempty"`
	Name          string                 `yaml:"name" json:"name"`
	Description   string                 `yaml:"description,omitempty" json:"description,omitempty"`
	Type          string                 `yaml:"type" json:"type"`
	Mode          string                 `yaml:"mode" json:"mode"`
	ChainType     string                 `yaml:"chain_type,omitempty" json:"chain_type,omitempty"`
	ChainID       string                 `yaml:"chain_id,omitempty" json:"chain_id,omitempty"`
	APIKeyID      string                 `yaml:"api_key_id,omitempty" json:"api_key_id,omitempty"`
	SignerAddress string                 `yaml:"signer_address,omitempty" json:"signer_address,omitempty"`
	Config        map[string]interface{} `yaml:"config" json:"config"`
	Variables     map[string]interface{} `yaml:"variables,omitempty" json:"variables,omitempty"`   // instance/template variable values (e.g. for evm_js config)
	TestCases     []TestCaseConfig       `yaml:"test_cases,omitempty" json:"test_cases,omitempty"` // test cases for validation (evm_js, solidity, etc.)
	Enabled       bool                   `yaml:"enabled" json:"enabled"`
}

type RuleFileConfig struct {
	Path string `yaml:"path"` // Path to the YAML file containing rules
}

type RuleInitializer struct {
	// contains filtered or unexported fields
}

type SecurityConfig struct {
	MaxRequestAge    time.Duration `yaml:"max_request_age"`
	RateLimitDefault int           `yaml:"rate_limit_default"`
	// IPRateLimit is the maximum requests per minute from a single IP address (pre-auth).
	// Protects against unauthenticated flood attacks. Default: 200.
	IPRateLimit int               `yaml:"ip_rate_limit"`
	IPWhitelist IPWhitelistConfig `yaml:"ip_whitelist"`
	// ManualApprovalEnabled: when true, requests with no whitelist match go to manual approval;
	// when false (default), they are rejected immediately. Default false for stricter security.
	ManualApprovalEnabled bool `yaml:"manual_approval_enabled"`
	// ApprovalGuard pauses all sign requests when too many consecutive manual-approval outcomes occur
	ApprovalGuard ApprovalGuardConfig `yaml:"approval_guard"`
	// NonceRequired enforces nonce for all requests (recommended for production)
	// When true, requests without X-Nonce header will be rejected
	NonceRequired *bool `yaml:"nonce_required"`

	// RulesAPIReadonly disables rule/template mutations via API.
	// Default (nil) = true. Covers: rule CRUD, template CRUD/instantiate/revoke,
	// approval auto-rule creation. Rules managed through config files only.
	RulesAPIReadonly *bool `yaml:"rules_api_readonly"`

	// SignersAPIReadonly disables signer/HD-wallet creation via API.
	// Default (nil) = false. Covers: signer creation, HD wallet create/import/derive.
	// Unlock/lock remain allowed. Signers managed through config or TUI.
	SignersAPIReadonly *bool `yaml:"signers_api_readonly"`

	// AllowSIGHUPRulesReload enables reloading rules from config when receiving SIGHUP.
	// Default (nil) = false (secure by default). When disabled, SIGHUP is ignored (process stays alive).
	AllowSIGHUPRulesReload *bool `yaml:"allow_sighup_rules_reload"`
}

type ServerConfig struct {
	Host         string        `yaml:"host"`
	Port         int           `yaml:"port"`
	ReadTimeout  time.Duration `yaml:"read_timeout"`
	WriteTimeout time.Duration `yaml:"write_timeout"`
	TLS          TLSConfig     `yaml:"tls"`
}

type TLSConfig struct {
	// Enabled enables TLS (HTTPS) for the server
	Enabled bool `yaml:"enabled"`
	// CertFile is the path to the server TLS certificate
	CertFile string `yaml:"cert_file"`
	// KeyFile is the path to the server TLS private key
	KeyFile string `yaml:"key_file"`
	// CAFile is the path to the CA certificate for verifying client certificates (mTLS)
	CAFile string `yaml:"ca_file"`
	// ClientAuth enables mutual TLS (mTLS) — requires clients to present a valid certificate
	ClientAuth bool `yaml:"client_auth"`
}

type TemplateConfig struct {
	Name           string                 `yaml:"name" json:"name"`
	Description    string                 `yaml:"description,omitempty" json:"description,omitempty"`
	Type           string                 `yaml:"type" json:"type"` // actual rule type or "file" for external file
	Mode           string                 `yaml:"mode,omitempty" json:"mode,omitempty"`
	Variables      []TemplateVarConfig    `yaml:"variables,omitempty" json:"variables,omitempty"`
	Config         map[string]interface{} `yaml:"config,omitempty" json:"config,omitempty"`
	BudgetMetering map[string]interface{} `yaml:"budget_metering,omitempty" json:"budget_metering,omitempty"`
	TestVariables  map[string]string      `yaml:"test_variables,omitempty" json:"test_variables,omitempty"` // default variable values for validation
	Enabled        bool                   `yaml:"enabled" json:"enabled"`
}

type TemplateInitializer struct {
	// contains filtered or unexported fields
}

type TemplateVarConfig struct {
	Name        string `yaml:"name"`
	Type        string `yaml:"type"`
	Description string `yaml:"description,omitempty"`
	Required    bool   `yaml:"required"`
	Default     string `yaml:"default,omitempty"`
}

type TestCaseConfig struct {
	Name         string                 `yaml:"name" json:"name"`
	Input        map[string]interface{} `yaml:"input" json:"input"`
	ExpectPass   bool                   `yaml:"expect_pass" json:"expect_pass"`
	ExpectReason string                 `yaml:"expect_reason,omitempty" json:"expect_reason,omitempty"`
}