config

type Config struct {
	Server        ServerConfig        `mapstructure:"server"`
	Database      DatabaseConfig      `mapstructure:"database"`
	Secrets       SecretsConfig       `mapstructure:"secrets"`
	Issuer        IssuerConfig        `mapstructure:"issuer"`
	Session       SessionConfig       `mapstructure:"session"`
	Keystore      KeystoreConfig      `mapstructure:"keystore"`
	TokenExchange TokenExchangeConfig `mapstructure:"token_exchange"`
	Gateway       GatewayConfig       `mapstructure:"gateway"`
}

type DatabaseConfig struct {
	URL          string `mapstructure:"url"`
	MaxOpenConns int    `mapstructure:"max_open_conns"`
	MaxIdleConns int    `mapstructure:"max_idle_conns"`
	AutoMigrate  bool   `mapstructure:"auto_migrate"`
}

type GatewayConfig struct {
	Upstreams []UpstreamConfig `mapstructure:"upstreams"`
	// DownstreamTTL caps the lifetime of the fresh per-call token the gateway mints
	// for an upstream (still clamped to the inbound token's expiry). Default 60s.
	DownstreamTTL time.Duration `mapstructure:"downstream_ttl"`
	// RevocationRefresh selects the revocation-check mode. 0 (default) = check the
	// store per call (Tier A, instant). >0 = keep an in-memory set of revoked,
	// unexpired token ids refreshed on this interval (Tier B, avoids a per-call DB
	// read for high-QPS gateways; a revoke then takes effect within the interval).
	RevocationRefresh time.Duration `mapstructure:"revocation_refresh"`
}

type IssuerConfig struct {
	URL string `mapstructure:"url"`
}

type KeystoreConfig struct {
	// RotationOverlap is how long a rotated-out signing key remains published in
	// the JWKS (so tokens it signed keep verifying) before it can be pruned.
	RotationOverlap time.Duration `mapstructure:"rotation_overlap"`
}

type SecretsConfig struct {
	System string `mapstructure:"system"` // 32+ bytes, Fosite global HMAC secret
	Cookie string `mapstructure:"cookie"` // 32+ bytes, cookie signing
	// KeyEncryption is the master key used to envelope-encrypt signing keys at
	// rest. If empty it is derived from System via HKDF (domain-separated), so
	// dev works out of the box; production should set a distinct value so the
	// at-rest key is not the same material as the Fosite HMAC secret.
	KeyEncryption string `mapstructure:"key_encryption"`
}

type ServerConfig struct {
	Host string `mapstructure:"host"`
	Port int    `mapstructure:"port"`
	// LiveIngestToken, when set, enables POST /admin/live/ingest: a shared secret a
	// connected resource server (e.g. a `legant guard` hook) presents to stream its
	// allow/deny decisions into the /admin/live console. Empty disables the endpoint.
	LiveIngestToken string `mapstructure:"live_ingest_token"`
}

type SessionConfig struct {
	Lifetime    time.Duration `mapstructure:"lifetime"`
	IdleTimeout time.Duration `mapstructure:"idle_timeout"`
}

type TokenExchangeConfig struct {
	// AccessTokenLifespan caps the lifetime of a minted delegation token. Short
	// by default so a leaked token's blast radius is bounded despite offline use.
	AccessTokenLifespan time.Duration `mapstructure:"access_token_lifespan"`
}

type UpstreamConfig struct {
	Slug            string            `mapstructure:"slug"`
	InboundAudience string            `mapstructure:"inbound_audience"`
	URL             string            `mapstructure:"url"`
	ResourceID      string            `mapstructure:"resource_id"`
	ToolScopes      map[string]string `mapstructure:"tool_scopes"`
}