server

type RouterConfig struct {
	// Debug enables debug mode
	Debug bool

	// LoggingConfig is the configuration for the logging middleware
	LoggingConfig middleware.LoggingConfig

	// RateLimitConfig is the configuration for the rate limiting middleware
	RateLimitConfig middleware.RateLimitConfig

	// PerRouteRateLimitConfig is the configuration for stricter per-route
	// rate limits applied on top of the global RateLimitConfig. Closes
	// G35 (/account/recover) and G41 (/secrets/:id/reveal) — endpoints
	// that take credentials as direct input and therefore warrant a
	// tighter cap than the global 100/min/IP. Defaults to enabled with
	// sensible limits; operators can disable by setting Enabled=false.
	PerRouteRateLimitConfig middleware.PerRouteRateLimitConfig

	// SecurityConfig is the configuration for the security middleware
	SecurityConfig middleware.SecurityConfig

	// TracingConfig is the configuration for the tracing middleware
	TracingConfig middleware.TracingConfig

	// SettingsHandler is the optional settings handler for admin/user settings routes
	SettingsHandler *handlers.SettingsHandler

	// InstanceSettings provides access to instance settings for feature flags
	InstanceSettings *settings.InstanceService

	// SecretsHandler is the handler for secret management endpoints (optional)
	SecretsHandler *handlers.SecretsHandler

	// ModelsHandler handles model listing and selection (optional).
	// Extracted from SecretsHandler (US-29.5).
	ModelsHandler *handlers.ModelsHandler

	// WorkspaceEnvHandler is the handler for workspace env-var endpoints (optional).
	// Extracted from SecretsHandler (US-29.4).
	WorkspaceEnvHandler *handlers.WorkspaceEnvHandler

	// AdminProviderCredentialsHandler handles admin credential CRUD (optional)
	AdminProviderCredentialsHandler *handlers.AdminProviderCredentialsHandler

	// UserProviderCredentialsHandler handles user credential CRUD (optional)
	UserProviderCredentialsHandler *handlers.UserProviderCredentialsHandler

	// RotateKeyHandler is the handler for key rotation (optional)
	RotateKeyHandler *handlers.RotateKeyHandler

	// UnlockDEKHandler is the soft-unlock endpoint for re-deriving the
	// DEK without forcing logout (Epic 56). Optional — when nil the
	// /auth/unlock-dek route is not registered, which is appropriate
	// for tests that don't exercise key material.
	UnlockDEKHandler *handlers.UnlockDEKHandler

	// OrgsHandler handles org CRUD routes (optional)
	OrgsHandler *handlers.OrgsHandler

	// OrgCredentialsHandler handles org credential routes (optional)
	OrgCredentialsHandler *handlers.OrgCredentialsHandler

	// TerminalHandler is the handler for WebSocket terminal proxy (optional)
	TerminalHandler *handlers.TerminalHandler

	// AgentReloadHandler handles POST /api/v1/workspaces/:id/agent/reload (optional)
	AgentReloadHandler *handlers.AgentReloadHandler

	// BulkReloadHandler handles POST /api/v1/users/me/agents/reload (optional)
	BulkReloadHandler *handlers.BulkReloadHandler

	UsageHandler         *handlers.UsageHandler
	WebhookHandler       *handlers.StripeWebhookHandler
	InvitationsHandler   *handlers.InvitationsHandler
	EmailHandler         *handlers.EmailHandler
	EmailVerifyHandler   *handlers.EmailVerifyHandler
	PasswordResetHandler *handlers.PasswordResetHandler
	PolicyHandler        *handlers.PolicyHandler
	PromptHandler        *handlers.PromptHandler
	AgentRoleHandler     *handlers.AgentRoleHandler
	AuditHandler         *handlers.AuditHandler

	// RelayAdminHandler handles relay admin setup + status endpoints (optional)
	RelayAdminHandler *handlers.RelayAdminHandler

	// PlatformInfoHandler serves the admin "Versions" display — running
	// component versions read from deployed Deployment image tags. Optional.
	PlatformInfoHandler *handlers.PlatformInfoHandler

	// AdminSessionHandler handles admin-only session recovery endpoints (optional).
	// US-44.11: force-abort a workspace session stuck in activeSess after the
	// workspace pod was deleted/unreachable.
	AdminSessionHandler *handlers.AdminSessionHandler

	// PlatformAdminHandler handles platform-admin org/user suspension
	// endpoints (US-43.19, D19/D20). Mounted behind AuthMiddleware + AdminGuard.
	PlatformAdminHandler *handlers.PlatformAdminHandler

	// InternalOrgStatusHandler, when non-nil, registers the cluster-internal
	// GET /api/v1/internal/orgs/:orgID/status endpoint that the controller
	// polls to drive org-suspension of workspaces (D20). It is intentionally
	// NOT behind AuthMiddleware; access is gated by a mandatory X-Internal-Token
	// shared-secret header (see InternalOrgStatusHandler — the endpoint FAILS
	// CLOSED with 403 when LLMSAFESPACES_INTERNAL_TOKEN is unset). An optional
	// API NetworkPolicy (chart value networkPolicy.apiIngressRestricted) adds
	// L3/L4 defense-in-depth; the token is the load-bearing control.
	InternalOrgStatusHandler *handlers.InternalOrgStatusHandler

	// PodBootstrapHandler, when non-nil, registers POST /internal/v1/pod-bootstrap
	// — the secretless credential injection endpoint (Epic 35). The workspace
	// init container presents a projected SA token; the handler validates it via
	// TokenReview and returns decrypted secrets. NOT behind AuthMiddleware (the
	// init container has no user identity); auth is the TokenReview itself.
	PodBootstrapHandler *handlers.PodBootstrapHandler

	CookieName string

	// CookieDomain (Epic 54, US-54.3): when non-empty, set as the Domain
	// attribute on the lsp_session cookie so the session survives root→subdomain
	// redirects under wildcard subdomain routing. When empty (default), the
	// cookie is host-only — current behavior, single-host deploys.
	CookieDomain string

	// SSOHandler handles org-admin SSO config CRUD + the public OIDC login flow
	// (start/callback) and claimed-domain discovery (US-43.10, D17).
	SSOHandler *handlers.SSOHandler

	// LoginDiscoveryHandler handles POST /api/v1/auth/lookup — the email-led
	// login discovery endpoint (Epic 54, US-54.1). Returns a single redirectUrl
	// pointing the browser at the user's org subdomain (or direct SSO start URL
	// when subdomain routing is disabled). Enumeration-safe: uniform 200 +
	// uniform body shape across all non-validation branches; DB errors masked.
	LoginDiscoveryHandler *handlers.LoginDiscoveryHandler

	// Turnstile, when Enabled is true, gates POST /auth/register with a
	// Cloudflare Turnstile CAPTCHA middleware. The middleware fails
	// closed: any of {missing token, verify request fails, verify
	// response says not-success} → 401. When Enabled is false, the
	// route runs without the middleware.
	//
	// SecretKey must be non-empty when Enabled is true (config.Load
	// enforces this at startup, fail-closed). VerifyURL defaults to
	// Cloudflare's production siteverify endpoint if empty.
	Turnstile TurnstileRouterConfig
}

type TurnstileRouterConfig struct {
	Enabled   bool
	SecretKey string
	VerifyURL string
}