config

type ApplyPersistenceError struct {
	// contains filtered or unexported fields
}

type ApplyResult struct {
	Config              *Config
	RestartRequired     bool
	RestartRequiredKeys []string
}

type ApplyValidationError struct {
	// contains filtered or unexported fields
}

type Config struct {
	// Server settings (restart required)
	ListenerAddress string
	ListenerPort    int

	// Logging settings (restart required)
	LogDirectory      string
	LogLevel          string // "debug", "info", "warn", "error"
	LogRollover       string // "daily", "weekly", "monthly"
	LogRetentionCount int

	// Application settings (runtime)
	SiteName       string
	Themes         []string
	CurrentTheme   string
	ImageDirectory string

	// ETag version for cache busting (runtime changeable)
	ETagVersion string

	// SessionMaxAge is the session lifetime in seconds.
	// Defines how long a session remains valid before requiring re-authentication.
	// Security implications: Shorter sessions (e.g., 1-7 days) reduce the window for
	// session hijacking attacks. Defaults to 7 days (604800 seconds).
	// Recommended: 1-7 days depending on use case.
	SessionMaxAge int

	// SessionHttpOnly prevents JavaScript access to session cookies.
	// When true, the HttpOnly flag is set on the session cookie, protecting against
	// Cross-Site Scripting (XSS) attacks by preventing malicious scripts from reading
	// or stealing the session token.
	// Defaults to true (recommended for production).
	// Security note: Always keep true unless specifically required for XSS-vulnerable
	// legacy applications.
	SessionHttpOnly bool

	// SessionSecure restricts session cookies to HTTPS connections only.
	// When true, the Secure flag is set on the session cookie, ensuring that
	// the cookie is only transmitted over encrypted HTTPS connections.
	// Prevents session hijacking via man-in-the-middle (MITM) attacks on unencrypted HTTP.
	// Defaults to true (required for production).
	// Security note: Must be true in production with HTTPS. Can be false only for
	// development over HTTP, but is dangerous in production.
	SessionSecure bool

	// SessionSameSite controls the SameSite cookie attribute for CSRF protection.
	// Valid values: "Lax", "Strict", or "None".
	//
	// - "Lax" (default, recommended): Cookies are sent with same-site requests and
	//   top-level navigations (safe for most applications). Provides strong CSRF
	//   protection while maintaining reasonable user experience.
	//
	// - "Strict": Cookies are sent only with same-site requests. Most restrictive,
	//   blocking cookies even on top-level navigations from external sites.
	//   Best for highly sensitive applications (e.g., banking), but may inconvenience
	//   users following external links to your site.
	//
	// - "None": Cookies are sent with all requests (cross-site included).
	//   Only use with Secure=true if cross-site requests require authentication.
	//   Essentially disables SameSite CSRF protection; use only with careful consideration.
	//
	// Security implications: SameSite is a modern defense against CSRF attacks.
	// Lax provides excellent protection without sacrificing usability. Combined with
	// http.CrossOriginProtection on unsafe methods, provides defense-in-depth.
	SessionSameSite string

	// Performance settings (restart required)
	EnableHTTPCache       bool
	CacheMaxSize          int64         // in bytes
	CacheMaxTime          time.Duration // TTL
	CacheMaxEntrySize     int64         // in bytes
	CacheCleanupInterval  time.Duration
	DBMaxPoolSize         int
	DBMinIdleConnections  int
	DBOptimizeInterval    time.Duration
	WorkerPoolMax         int // 0 means auto-calculate
	WorkerPoolMinIdle     int // 0 means no idle workers
	WorkerPoolMaxIdleTime time.Duration
	DBPoolMonitorInterval time.Duration
	QueueSize             int
	EnableCachePreload    bool // Pre-load HTTP cache when folders are opened (runtime, no restart)
	// MaxHTTPCacheEntryInsertPerTransaction is the max number of cache entries to insert in one transaction (batch size). Default: 10.
	MaxHTTPCacheEntryInsertPerTransaction int

	// HTTPCacheBodyCodec selects the write codec for new http_cache rows.
	// Valid: "zstd-1", "gzip-6", "identity". Hot-reloadable.
	HTTPCacheBodyCodec string

	// DQueMaxDiskBytes is the maximum disk usage in bytes for the write
	// batcher's dque overflow queue. When the dque directory reaches this
	// threshold, Submit returns ErrQuotaExceeded instead of overflowing to
	// disk. 0 means unlimited at runtime. The default is non-zero
	// (DefaultDQueMaxDiskBytes, 50 GiB). Hot-reloadable without restart.
	DQueMaxDiskBytes int64

	// Discovery settings (runtime)
	RunFileDiscovery bool

	// RestartAfterDiscovery, when true, requests a process restart after the
	// startup TriggerDiscovery returns (walk, drain, and file_folder_index
	// rebuild). Default false. Hot-reloadable; read after that return.
	// Does not apply to POST /server/discovery.
	RestartAfterDiscovery bool

	// DiscoveryQueueMax is currently a no-op: the discovery work queue is a
	// dedicated disk-backed dque (wipe-on-start), so SubsystemManager.Start
	// ignores this field. It is retained for later removal and no longer bounds
	// the production discovery queue.
	DiscoveryQueueMax int

	// Security settings
	// LockoutDuration is the account lockout period in seconds after
	// LockoutThreshold failed login attempts.
	LockoutDuration int

	// LockoutThreshold is the number of failed login attempts before
	// account lockout is triggered. Default: 3.
	LockoutThreshold int

	// LoginRateLimitPerIP is the maximum number of login POST requests
	// allowed per IP address per 60-second window. 0 disables IP rate limiting.
	LoginRateLimitPerIP int

	// HelpText and ExampleValues are populated by LoadFromDatabase from the
	// metadata columns stored alongside each config row. Nil when loaded
	// through other paths (DefaultConfig, YAML, CLI). Used by the config UI
	// to render inline tooltips; not serialised into exports or saved to DB.
	HelpText      map[string]string
	ExampleValues map[string]string
}

type ConfigAdmin interface {
	// Export exports the configuration as a YAML string.
	Export(ctx context.Context) (string, error)

	// Import imports configuration from a YAML string and saves it to the database.
	Import(yamlContent string, ctx context.Context) error

	// RestoreLastKnownGood restores the last known good configuration from the database.
	RestoreLastKnownGood(ctx context.Context) (*Config, error)

	// EnsureDefaults ensures default config (admin creds, default keys) exists in the database.
	// rootDir is used for default paths (e.g. log_directory).
	EnsureDefaults(ctx context.Context, rootDir string) error

	// GetConfigValue returns the value for key from the config table, or error if not found.
	GetConfigValue(ctx context.Context, key string) (string, error)

	// IncrementETag increments the ETag version in the database and returns the new value.
	IncrementETag(ctx context.Context) (string, error)
}

type ConfigDiff struct {
	CurrentYAML string
	NewYAML     string
	Changes     []string // List of changed keys
}

type ConfigManager struct {
	ConfigMu      sync.RWMutex
	Config        *Config
	ConfigService ConfigService
}

type ConfigQueries interface {
	GetConfigs(ctx context.Context) ([]gallerydb.Config, error)
}

type ConfigSaver interface {
	UpsertConfigValueOnly(ctx context.Context, arg gallerydb.UpsertConfigValueOnlyParams) error
}

type ConfigService interface {
	ConfigStore
	ConfigAdmin
}

type ConfigStore interface {
	// Load loads the current configuration from the database.
	Load(ctx context.Context) (*Config, error)

	// Save saves the configuration to the database.
	Save(ctx context.Context, cfg *Config) error

	// Validate validates the configuration and returns an error if invalid.
	Validate(cfg *Config) error
}

type FieldInfo struct {
	DBKey      string
	Set        func(c *Config, v string) error
	IsCheckbox bool // render as HTML checkbox
}

type GuardrailWarning struct {
	Check      string
	Configured string
	Effective  string
	Hint       string
}