config

type AIConfig struct {
	// OpenAI API key
	APIKey string `koanf:"api_key"`
	// Model to use for AI SQL generation (default: gpt-4o)
	Model string `koanf:"model"`
	// MaxTokens is the maximum number of tokens to generate (default: 1024)
	MaxTokens int `koanf:"max_tokens"`
	// Temperature controls randomness in generation (0.0-1.0, default: 0.1)
	Temperature float32 `koanf:"temperature"`
	// Enabled indicates whether AI features are enabled
	Enabled bool `koanf:"enabled"`
	// BaseURL for OpenAI API (default: "", which uses the standard OpenAI API endpoint)
	BaseURL string `koanf:"base_url"`
}

type AlertsConfig struct {
	Enabled            bool          `koanf:"enabled"`
	EvaluationInterval time.Duration `koanf:"evaluation_interval"`
	DefaultLookback    time.Duration `koanf:"default_lookback"`
	HistoryLimit       int           `koanf:"history_limit"`
}

type AuthConfig struct {
	AdminEmails           []string      `koanf:"admin_emails"`
	SessionDuration       time.Duration `koanf:"session_duration"`
	MaxConcurrentSessions int           `koanf:"max_concurrent_sessions"`
	APITokenSecret        string        `koanf:"api_token_secret"`
	DefaultTokenExpiry    time.Duration `koanf:"default_token_expiry"`
}

type ClickhouseConfig struct {
	Host     string `koanf:"host"`
	Port     int    `koanf:"port"`
	Database string `koanf:"database"`
	Username string `koanf:"username"`
	Password string `koanf:"password"`
}

type Config struct {
	Server       ServerConfig       `koanf:"server"`
	SQLite       SQLiteConfig       `koanf:"sqlite"`
	Clickhouse   ClickhouseConfig   `koanf:"clickhouse"`
	OIDC         OIDCConfig         `koanf:"oidc"`
	Auth         AuthConfig         `koanf:"auth"`
	Logging      LoggingConfig      `koanf:"logging"`
	AI           AIConfig           `koanf:"ai"`
	Alerts       AlertsConfig       `koanf:"alerts"`
	Query        QueryConfig        `koanf:"query"`
	Provisioning ProvisioningConfig `koanf:"provisioning"`
}

type LoggingConfig struct {
	// Level sets the minimum log level (debug, info, warn, error)
	Level string `koanf:"level"`
}

type OIDCConfig struct {
	// Provider URL for OIDC discovery
	ProviderURL string `koanf:"provider_url"` // Base URL for OIDC provider discovery
	// Different endpoints for OIDC flow
	AuthURL  string `koanf:"auth_url"`  // URL for browser auth redirects
	TokenURL string `koanf:"token_url"` // URL for token exchange (server-to-server)

	ClientID     string   `koanf:"client_id"`
	ClientSecret string   `koanf:"client_secret"`
	RedirectURL  string   `koanf:"redirect_url"`
	Scopes       []string `koanf:"scopes"`

	CLIClientID string `koanf:"cli_client_id"`
}

type ProvisionMember struct {
	Email string `koanf:"email"`
	// Role is the team-level role: "admin", "editor", or "member".
	Role string `koanf:"role"`
}

type ProvisionSource struct {
	// Name is the unique identifier and display name for this source.
	Name string `koanf:"name"`

	// ClickHouse connection details.
	Host      string `koanf:"host"`
	Username  string `koanf:"username"`
	Password  string `koanf:"password"`
	Database  string `koanf:"database"`
	TableName string `koanf:"table_name"`

	// SecretRef stores the environment variable or file path that provided the password.
	// Used by the export command to generate round-trippable config (passwords are never exported).
	// If set and Password is empty, the value is resolved from the environment at startup.
	SecretRef string `koanf:"secret_ref"`

	Description       string `koanf:"description"`
	TTLDays           int    `koanf:"ttl_days"`
	MetaTSField       string `koanf:"meta_ts_field"`
	MetaSeverityField string `koanf:"meta_severity_field"`
}

type ProvisionTeam struct {
	// Name is the unique identifier and display name for this team.
	Name        string `koanf:"name"`
	Description string `koanf:"description"`

	// Sources lists source Names that this team should have access to.
	Sources []string `koanf:"sources"`

	// Members declares the team membership with roles.
	Members []ProvisionMember `koanf:"members"`
}

type ProvisioningConfig struct {
	// File is an optional path to a separate provisioning.toml file.
	// If relative, resolved against the main config.toml directory.
	// When set, the provisioning config is loaded from this file instead of inline.
	File string `koanf:"file"`

	// ManageSources enables declarative management of ClickHouse data sources.
	// When true, sources listed in Sources are created/updated/adopted and marked managed.
	ManageSources bool `koanf:"manage_sources"`

	// ManageTeams enables declarative management of teams, memberships, and source links.
	// When true, teams listed in Teams are created/updated/adopted and marked managed.
	ManageTeams bool `koanf:"manage_teams"`

	// Prune removes managed resources that are no longer declared in config.
	// WARNING: Pruning a team/source cascades to saved queries and alerts via FK constraints.
	// Default: false (safe mode — orphaned managed resources are logged but not deleted).
	Prune bool `koanf:"prune"`

	// DryRun logs all reconciliation actions without applying them.
	// The transaction is rolled back after computing the diff.
	DryRun bool `koanf:"dry_run"`

	// Sources declares ClickHouse data sources to manage.
	// Each source is identified by its Name (must be unique).
	Sources []ProvisionSource `koanf:"sources"`

	// Teams declares teams with their memberships and source access.
	// Each team is identified by its Name (must be unique).
	Teams []ProvisionTeam `koanf:"teams"`
}

type QueryConfig struct {
	// MaxLimit caps any LIMIT clause to prevent excessive result sets (default: 1000000)
	MaxLimit int `koanf:"max_limit"`
}

type SQLiteConfig struct {
	Path string `koanf:"path"`
}

type ServerConfig struct {
	Port              int           `koanf:"port"`
	Host              string        `koanf:"host"`
	FrontendURL       string        `koanf:"frontend_url"`
	HTTPServerTimeout time.Duration `koanf:"http_server_timeout"`
	// SecureCookie controls the Secure flag on auth cookies.
	// Set to false for local development over HTTP. Defaults to true.
	SecureCookie *bool `koanf:"secure_cookie"`
}

type SettingsStore interface {
	GetSettingWithDefault(ctx context.Context, key, defaultValue string) string
	GetBoolSetting(ctx context.Context, key string, defaultValue bool) bool
	GetIntSetting(ctx context.Context, key string, defaultValue int) int
	GetFloat64Setting(ctx context.Context, key string, defaultValue float64) float64
	GetDurationSetting(ctx context.Context, key string, defaultValue time.Duration) time.Duration
}