server

type AdminAPI struct {
	// contains filtered or unexported fields
}

type ClientInfo struct {
	ID         string       `json:"id"`
	Subdomain  string       `json:"subdomain"`
	RemoteAddr string       `json:"remote_addr"`
	CreatedAt  time.Time    `json:"created_at"`
	LastSeen   time.Time    `json:"last_seen"`
	BytesIn    uint64       `json:"bytes_in"`
	BytesOut   uint64       `json:"bytes_out"`
	Tunnels    []TunnelJSON `json:"tunnels"`
}

type ClientSession struct {
	ID        string
	Subdomain string
	Mux       *tunnel.Mux
	Tunnels   []*TunnelInfo
	CreatedAt time.Time
	LastSeen  time.Time
	BytesIn   uint64
	BytesOut  uint64

	// Authentication info.
	TeamName string
	Role     auth.Role

	// P2P info.
	P2PPublicAddr string
	P2PNATType    string
	P2PLocalAddr  string
	P2PPublicKey  string // ECDH public key (base64-encoded) for E2E encryption.
	P2PTunnelID   string // Tunnel ID from the latest P2P offer.
	// contains filtered or unexported fields
}

type Config struct {
	// ListenAddr is the address to listen on for client connections.
	ListenAddr string

	// HTTPAddr is the address to listen on for HTTP traffic.
	HTTPAddr string

	// AdminAddr is the address to listen on for the admin API.
	AdminAddr string

	// Domain is the base domain for tunnel URLs.
	Domain string

	// TLSEnabled enables TLS for client connections.
	TLSEnabled bool

	// TLSCertFile is the path to the TLS certificate.
	TLSCertFile string

	// TLSKeyFile is the path to the TLS private key.
	TLSKeyFile string

	// AutoTLS enables automatic TLS certificate via Let's Encrypt.
	AutoTLS bool

	// AutoTLSEmail is the email for Let's Encrypt registration.
	AutoTLSEmail string

	// TunnelTLSEnabled enables TLS for the tunnel control listener.
	// When true, the tunnel listener is also wrapped with TLS.
	// Defaults to the value of TLSEnabled if not explicitly set.
	TunnelTLSEnabled bool

	// TCPPortRange is the range of ports for TCP tunnels.
	TCPPortRangeStart int
	TCPPortRangeEnd   int

	// MuxConfig is the multiplexer configuration.
	MuxConfig tunnel.MuxConfig

	// ReadTimeout is the read timeout for connections.
	ReadTimeout time.Duration

	// WriteTimeout is the write timeout for connections.
	WriteTimeout time.Duration

	// IdleTimeout is the idle timeout for connections.
	IdleTimeout time.Duration

	// MaxClients is the maximum number of concurrent clients.
	// 0 means unlimited.
	MaxClients int

	// MaxTunnelsPerClient is the maximum number of tunnels a single client can register.
	// 0 means unlimited.
	MaxTunnelsPerClient int

	// RequireAuth requires authentication for connections.
	RequireAuth bool

	// AuthTokens is a list of valid authentication tokens (simple mode).
	AuthTokens []string

	// AuthSecret is the HMAC secret for signed token mode.
	// Must be at least 16 bytes. If empty, only simple token mode is available.
	AuthSecret string

	// AuthTimeout is the timeout for the authentication handshake.
	AuthTimeout time.Duration

	// AdminToken is the token required to access the admin API.
	// If empty, the admin API requires no authentication.
	AdminToken string

	// RateLimitEnabled enables authentication failure rate limiting.
	RateLimitEnabled bool

	// RateLimitMaxFailures is the max failures before blocking an IP.
	RateLimitMaxFailures int

	// RateLimitWindow is the time window for counting failures.
	RateLimitWindow time.Duration

	// RateLimitBlockDuration is how long to block after exceeding failures.
	RateLimitBlockDuration time.Duration

	// Persistence configures the storage backend for auth data.
	// Options: "memory" (default), "sqlite"
	Persistence PersistenceType

	// PersistencePath is the path to the SQLite database file.
	// Only used when Persistence is "sqlite".
	// If empty, defaults to ~/.wormhole/wormhole.db
	PersistencePath string

	// EnableMetrics enables Prometheus metrics collection and the /metrics endpoint.
	EnableMetrics bool

	// OIDCIssuer enables OIDC JWT token validation.
	// When set, JWT tokens signed by the given issuer are accepted in addition to
	// the HMAC tokens.  Example: "https://accounts.google.com"
	OIDCIssuer string

	// OIDCClientID is the OAuth2 client ID to validate the audience claim.
	OIDCClientID string

	// OIDCTeamClaim is the JWT claim used as the Wormhole team name (default: "email").
	OIDCTeamClaim string

	// OIDCRoleClaim is an optional JWT claim for the Wormhole role.
	OIDCRoleClaim string

	// AuditEnabled enables structured audit logging.
	// When false, no audit events are recorded.
	AuditEnabled bool

	// AuditPersistence controls the storage backend for audit logs.
	// Options: "memory" (default ring buffer) or "sqlite".
	AuditPersistence PersistenceType

	// AuditPath is the path to the SQLite audit database file.
	// Only used when AuditPersistence is "sqlite".
	// If empty, defaults to ~/.wormhole/audit.db.
	AuditPath string

	// AuditBufferSize is the number of events to keep in memory.
	// Only used when AuditPersistence is "memory". Defaults to 10 000.
	AuditBufferSize int

	// ClusterNodeID is a unique identifier for this node in the cluster.
	// Defaults to the hostname when empty and clustering is enabled.
	ClusterNodeID string

	// ClusterNodeAddr is the address (host:port) other nodes use to reach this
	// node's HTTP listener for cross-node tunnel proxying.
	// Example: "10.0.0.1:7002"
	ClusterNodeAddr string

	// ClusterStateBackend selects the shared-state backend.
	// Options: "memory" (default, single-node) or "redis".
	ClusterStateBackend string

	// ClusterRedisAddr is the Redis server address for the Redis state backend.
	// Required when ClusterStateBackend is "redis".
	ClusterRedisAddr string

	// ClusterRedisPassword is the optional Redis AUTH password.
	ClusterRedisPassword string

	// ClusterRedisDB is the Redis database number (default 0).
	ClusterRedisDB int
}

type CreateTeamRequest struct {
	Name string `json:"name"`
}

type ErrorResponse struct {
	Error string `json:"error"`
}

type GenerateTokenRequest struct {
	Team string `json:"team"`
	Role string `json:"role"`
}

type GenerateTokenResponse struct {
	Token   string `json:"token"`
	Team    string `json:"team"`
	Role    string `json:"role"`
	Expires string `json:"expires,omitempty"`
}

type HTTPHandler struct {
	// contains filtered or unexported fields
}

type HealthResponse struct {
	Status  string `json:"status"`
	Version string `json:"version,omitempty"`
	Uptime  string `json:"uptime"`
}

type MemoryStateStore struct {
	// contains filtered or unexported fields
}

type Metrics struct {
	// ActiveClients is the number of currently connected clients.
	ActiveClients prometheus.Gauge

	// ActiveTunnels is the number of currently active tunnels.
	ActiveTunnels prometheus.Gauge

	// ConnectionsTotal is the total number of client connections accepted.
	ConnectionsTotal prometheus.Counter

	// BytesTransferredTotal is the total bytes transferred, labeled by direction (in/out).
	BytesTransferredTotal *prometheus.CounterVec

	// RequestsTotal is the total number of requests, labeled by protocol and status.
	RequestsTotal *prometheus.CounterVec

	// RequestDurationSeconds is the histogram of request durations in seconds.
	RequestDurationSeconds prometheus.Histogram

	// AuthAttemptsTotal is the total number of authentication attempts, labeled by result (success/failure).
	AuthAttemptsTotal *prometheus.CounterVec

	// P2PConnectionsTotal is the total number of P2P connection attempts, labeled by result (success/fallback).
	P2PConnectionsTotal *prometheus.CounterVec

	// TunnelDurationSeconds is the histogram of tunnel lifetimes in seconds.
	TunnelDurationSeconds prometheus.Histogram
	// contains filtered or unexported fields
}

type NodeInfo struct {
	// NodeID is the unique identifier for this node.
	NodeID string

	// NodeAddr is the HTTP address other nodes should proxy to for tunnels
	// owned by this node (e.g. "10.0.0.1:7000").
	NodeAddr string

	// LastHeartbeat is when the node last reported it was alive.
	LastHeartbeat time.Time
}

type PersistenceType string

type RateLimitResponse struct {
	Enabled    bool     `json:"enabled"`
	TrackedIPs int      `json:"tracked_ips"`
	BlockedIPs []string `json:"blocked_ips"`
}

type RedisStateStore struct {
	// contains filtered or unexported fields
}

type RedisStateStoreConfig struct {
	// Addr is the Redis server address (host:port).
	Addr string

	// Password is the Redis AUTH password (optional).
	Password string

	// DB is the Redis database number (default 0).
	DB int
}

type RefreshTokenRequest struct {
	Token     string `json:"token"`
	RevokeOld bool   `json:"revoke_old"`
	ExtendBy  string `json:"extend_by,omitempty"`
}

type RevokeTeamTokensRequest struct {
	Team string `json:"team"`
}

type RevokeTokenRequest struct {
	Token   string `json:"token,omitempty"`
	TokenID string `json:"token_id,omitempty"`
}

type RouteEntry struct {
	// ClientID is the unique identifier of the client session.
	ClientID string

	// Subdomain is the subdomain assigned to this client.
	Subdomain string

	// NodeID is the cluster node that owns this client connection.
	NodeID string

	// NodeAddr is the reachable HTTP address of the owning node
	// (used for cross-node proxying).
	NodeAddr string

	// RegisteredAt is when the route was registered.
	RegisteredAt time.Time
}

type Router struct {
	// contains filtered or unexported fields
}

type Server struct {
	// contains filtered or unexported fields
}

type StateStore interface {
	// RegisterRoute stores a client's route entry on this node.
	RegisterRoute(entry RouteEntry) error

	// UnregisterRoute removes all routes for a given client.
	UnregisterRoute(clientID string) error

	// LookupBySubdomain returns the route entry for the given subdomain.
	// Returns (nil, nil) when no entry is found (not an error condition).
	LookupBySubdomain(subdomain string) (*RouteEntry, error)

	// ListRoutes returns all active route entries across the cluster.
	ListRoutes() ([]RouteEntry, error)

	// NodeHeartbeat records that a node is alive.
	NodeHeartbeat(info NodeInfo) error

	// GetNodes returns the list of known cluster nodes and their last heartbeat.
	GetNodes() ([]NodeInfo, error)

	// EvictDeadNodes removes nodes whose heartbeat is older than the given
	// threshold and cleans up their routes.
	EvictDeadNodes(olderThan time.Duration) error

	// Close releases any resources held by the store.
	Close() error
}

type Stats struct {
	ActiveClients uint64
	TotalClients  uint64
	ActiveTunnels uint64
	BytesIn       uint64
	BytesOut      uint64
	Requests      uint64
	StartTime     time.Time
}

type StatsResponse struct {
	ActiveClients       uint64 `json:"active_clients"`
	TotalClients        uint64 `json:"total_clients"`
	ActiveTunnels       uint64 `json:"active_tunnels"`
	ActiveRoutes        int    `json:"active_routes"`
	Requests            uint64 `json:"requests"`
	BytesIn             uint64 `json:"bytes_in"`
	BytesOut            uint64 `json:"bytes_out"`
	UptimeSeconds       int64  `json:"uptime_seconds"`
	AllocatedPorts      int    `json:"allocated_ports"`
	MaxClients          int    `json:"max_clients"`
	MaxTunnelsPerClient int    `json:"max_tunnels_per_client"`
}

type TCPPortAllocator struct {
	// contains filtered or unexported fields
}

type TLSManager struct {
	// contains filtered or unexported fields
}

type TeamResponse struct {
	Name           string `json:"name"`
	CreatedAt      string `json:"created_at"`
	Tokens         int    `json:"tokens"`
	RevokedVersion int64  `json:"revoked_version"`
}

type TunnelInfo struct {
	ID        string
	LocalPort uint32
	Protocol  proto.Protocol
	PublicURL string
	TCPPort   uint32
	CreatedAt time.Time
}

type TunnelJSON struct {
	ID        string `json:"id"`
	LocalPort uint32 `json:"local_port"`
	Protocol  string `json:"protocol"`
	PublicURL string `json:"public_url"`
	TCPPort   uint32 `json:"tcp_port,omitempty"`
	CreatedAt string `json:"created_at"`
}

type UnblockRequest struct {
	IP string `json:"ip"`
}