edgeauth

type CloudRuntimeCredits struct {
	ManagedServers ManagedServerCredit
}

type Config struct {
	// Enabled controls whether the middleware is active.
	// Defaults to false so self-hosted (StackKits, Simulate, SpeechKit) are safe.
	Enabled bool

	// RequireEdgeAuth forces a 401 when the X-Kombify-Edge-Auth header is
	// absent or has an unexpected value. Set to true for SaaS-only services.
	// When false, requests without the header proceed without identity context.
	RequireEdgeAuth bool

	// EdgeAuthSecret verifies HMAC-signed identity headers from the Cloudflare
	// Edge Router. When empty, EDGE_AUTH_SECRET is read from the environment.
	EdgeAuthSecret string

	// EdgeAuthNextSecret is accepted during dual-key rotation. When empty,
	// EDGE_AUTH_SECRET_NEXT is read from the environment.
	EdgeAuthNextSecret string

	// EdgeAuthKeyID identifies EdgeAuthSecret in the signed envelope. When
	// empty, EDGE_AUTH_KEY_ID is read from the environment, then "primary".
	EdgeAuthKeyID string

	// EdgeAuthNextKeyID identifies EdgeAuthNextSecret in the signed envelope.
	// When empty, EDGE_AUTH_KEY_ID_NEXT is read from the environment, then "next".
	EdgeAuthNextKeyID string

	// RequireSignature is retained for source compatibility. Edge-authenticated
	// requests and unsigned identity headers are always verified fail-closed.
	RequireSignature bool

	// SignatureWindow is the maximum allowed skew for X-Kombify-Edge-Timestamp.
	// Defaults to 5 minutes.
	SignatureWindow time.Duration
}

type DecisionBinding struct {
	Version      string
	KeyID        string
	SubjectID    string
	TenantID     string
	Audience     string
	PublicPrefix string
	Method       string
	SignedPath   string
	RequestID    string
	EdgeKeyID    string
	Nonce        string
	IssuedAt     time.Time
}

type DecisionSignInput struct {
	Secret        string
	KeyID         string
	Method        string
	SignedPath    string
	Audience      string
	PublicPrefix  string
	SubjectID     string
	TenantID      string
	RequestID     string
	EdgeKeyID     string
	EdgeTimestamp string
	EdgeNonce     string
	EdgeSignature string
	Flags         map[string]bool
	Budgets       map[string]any
}

type DecisionVerifyConfig struct {
	PrimarySecret        string
	NextSecret           string
	PrimaryKeyID         string
	NextKeyID            string
	ExpectedAudience     string
	ExpectedPublicPrefix string
	SignatureWindow      time.Duration
	Now                  func() time.Time
	// IdentityConfig verifies the exact Edge identity envelope whose
	// signature/timestamp/nonce are bound into the decision signature. It must
	// use the Edge identity keys, which may differ from the decision keys.
	IdentityConfig Config
}

type FlagSet struct {
	Flags   map[string]bool
	Budgets map[string]json.RawMessage
	// contains filtered or unexported fields
}

type ManagedServerCredit struct {
	Mode  ManagedServerCreditMode
	Limit int
}

type ManagedServerCreditMode string