middleware

type APIKeyConfig struct {
	// Prefix identifies API keys (e.g., "sk-"). Empty means no prefix check.
	Prefix string
	// Client is the OpenFGA checker for authorization checks.
	Client openfga.Checker
	// Relation is the required relation (e.g., "can_access", "can_write").
	Relation string
	// Object is the resource object (e.g., "webhook:stripe").
	Object string
	// Header is the header to look for the API key (default: "Authorization").
	Header string
	// AuthResolver resolves an API key into an AuthContext for role-based auth.
	// When nil and no FGA client, only presence + prefix are validated.
	AuthResolver func(ctx context.Context, key string) (*AuthContext, error)
}

type AuthContext struct {
	UserID      string
	OrgID       string
	Roles       []string
	Permissions []string
	RawToken    string
	Claims      jwt.MapClaims
}

type BasicConfig struct {
	// Validator resolves credentials. Required.
	Validator BasicValidator
	// Realm is advertised in the WWW-Authenticate challenge.
	Realm string
}

type BasicValidator func(ctx context.Context, user, pass string) (*AuthContext, error)

type BreakerConfig struct {
	// OnRejected is called when the circuit breaker rejects a request.
	// If nil, a default 503 response is returned.
	OnRejected func(fiber.Ctx) error
}

type CORSConfig struct {
	AllowedOrigins      string
	AllowedMethods      string
	AllowedHeaders      string
	AllowCredentials    bool
	MaxAge              int
	ExposeHeaders       string
	AllowPrivateNetwork bool
	AllowOriginsFunc    func(origin string) bool
	Next                func(fiber.Ctx) bool
}

type CSPConfig struct {
	Level              CSPLevel `json:"level" config:",default=basic"`
	DefaultSrc         []string `json:"default_src" config:",optional"`
	ScriptSrc          []string `json:"script_src" config:",optional"`
	StyleSrc           []string `json:"style_src" config:",optional"`
	ImgSrc             []string `json:"img_src" config:",optional"`
	ConnectSrc         []string `json:"connect_src" config:",optional"`
	FontSrc            []string `json:"font_src" config:",optional"`
	FrameSrc           []string `json:"frame_src" config:",optional"`
	FrameAncestors     []string `json:"frame_ancestors" config:",optional"`
	ObjectSrc          []string `json:"object_src" config:",optional"`
	BaseURI            []string `json:"base_uri" config:",optional"`
	FormAction         []string `json:"form_action" config:",optional"`
	UpgradeInsecureReq bool     `json:"upgrade_insecure_requests" config:",optional"`
}

type CSPLevel string

type CSRFConfig struct {
	Enabled      bool     `json:"enabled" config:",optional"`
	CookieName   string   `json:"cookie_name" config:",optional"`
	HeaderName   string   `json:"header_name" config:",optional"`
	SameSite     string   `json:"same_site" config:",optional"`
	Secure       bool     `json:"secure" config:",optional"`
	ExcludePaths []string `json:"exclude_paths" config:",optional"`
	JSONCheck    bool     `json:"json_check" config:",optional"`
}

type CorrelationConfig struct {
	RequestHeader  string
	ResponseHeader string
	ContextKey     string
	SkipPaths      []string
}

type DeprecationConfig struct {
	Status     string // "current", "deprecated", "removed"
	SunsetDate time.Time
	Message    string
}

type FallbackConfig struct {
	// Mode is "degraded" or "stale". Empty means fallback is disabled.
	Mode string
	// Message is the response body for degraded mode.
	Message string
}

type JWTConfig struct {
	Secret         string
	PrevSecret     string
	ContextKey     string
	TokenLookup    string
	Algorithm      string
	Issuer         string
	Audience       string
	TokenBlacklist func(rawToken string) bool
	// JWKSURL enables RS256/RS384/RS512 validation against a remote JWKS
	// endpoint with kid-based key rotation (e.g. an OAuth server's
	// /.well-known/jwks.json). When set, Secret is ignored for verification.
	JWKSURL string
}

type KratosSessionConfig struct {
	// Client is the Ory client (Kratos + Keto).
	Client *ory.Client
	// ContextKey is the Locals key for the raw session (default "session").
	ContextKey string
}

type LoggerConfig struct {
	SkipPaths  []string
	SampleRate float64 // 0=log all, 0.5=log 50%, 1=log none
}

type OAuthConfig struct {
	// IntrospectionURL is the RFC 7662 endpoint (https recommended).
	IntrospectionURL string
	// ClientID/Secret authenticate this service at the endpoint.
	ClientID     string
	ClientSecret string
	// CacheTTL caches active verdicts in memory (keyed by token hash).
	// Zero disables the cache. A cached token stays valid until TTL even
	// if revoked upstream — keep it short (default 60s).
	CacheTTL time.Duration
	// HTTPClient overrides the default client (5s timeout).
	HTTPClient *http.Client
}

type OpenFGAConfig struct {
	Client      openfga.Checker // interface (supports caching)
	Relation    string          // e.g., "can_read", "can_write", "can_delete"
	Object      string          // e.g., "product:123", "order:456"
	Roles       []string        // YAML-defined roles to check
	Permissions []string        // YAML-defined permissions to check
}

type OryConfig struct {
	Client      *ory.Client
	Roles       []string // YAML-defined roles to check
	Permissions []string // YAML-defined permissions to check
}

type RateLimitConfig struct {
	Enabled                bool                  `json:"enabled" config:",optional"`
	Global                 *RateLimitEntry       `json:"global" config:",optional"`
	PerIP                  *RateLimitEntry       `json:"per_ip" config:",optional"`
	Algorithm              string                `json:"algorithm" config:",default=sliding_window"`
	TTL                    time.Duration         `json:"ttl" config:",optional"`
	SkipFailedRequests     bool                  `json:"skip_failed_requests" config:",optional"`
	SkipSuccessfulRequests bool                  `json:"skip_successful_requests" config:",optional"`
	MaxFunc                func(c fiber.Ctx) int `json:"-" config:"-"`
	RedisConn              *redis.Redis          `json:"-" config:"-"`
}

type RateLimitEntry struct {
	RequestsPerSecond int           `json:"requests_per_second"`
	Burst             int           `json:"burst"`
	TTL               time.Duration `json:"ttl" config:",optional"`
}

type RateLimitPostConfig struct {
	ServerPerUser *RateLimitEntry
	ServerPerKey  *RateLimitEntry
	EntryPerUser  *RateLimitEntry
	EntryPerKey   *RateLimitEntry
	PerRoleLimits map[string]*RateLimitEntry
	MaxFunc       func(c fiber.Ctx) int
	Algorithm     string
	TTL           time.Duration
	RedisConn     *redis.Redis
}

type RetryConfig struct {
	MaxRetries      int
	InitialInterval time.Duration
	MaxBackoff      time.Duration
	Multiplier      float64
}

type SSRFConfig struct {
	Enabled       bool     `json:"enabled"`
	BlockPrivate  bool     `json:"block_private" config:",optional"`
	BlockLoopback bool     `json:"block_loopback" config:",optional"`
	BlockMetadata bool     `json:"block_metadata" config:",optional"`
	AllowedHosts  []string `json:"allowed_hosts" config:",optional"`
	AllowAll      bool     `json:"allow_all" config:",optional"`
}

type SafeHTTPClient struct {
	// contains filtered or unexported fields
}

type SecurityHeadersConfig struct {
	FrameOptions      string `json:"frame_options" config:",optional"`
	ReferrerPolicy    string `json:"referrer_policy" config:",optional"`
	PermissionsPolicy string `json:"permissions_policy" config:",optional"`
	HSTS              bool   `json:"hsts" config:",optional"`
	HSTSMaxAge        int    `json:"hsts_max_age" config:",optional"`
	HSTSIncludeSubs   bool   `json:"hsts_include_subdomains" config:",optional"`
	CSP               string `json:"csp" config:",optional"`
	COOP              string `json:"coop" config:",optional"`
	COEP              string `json:"coep" config:",optional"`
	CORP              string `json:"corp" config:",optional"`
	CacheControl      string `json:"cache_control" config:",optional"`
	CSPReportPath     string `json:"csp_report_path" config:",optional"`
	// Next skips this middleware (returns control to next handler) when it
	// returns true. Used to let a per-route csp_group override the global CSP.
	Next func(fiber.Ctx) bool
}

type SessionConfig struct {
	// Cookie is the session cookie name (default "sid").
	Cookie string
	// Store holds sessions as sess:<id> JSON with TTL expiry. Required:
	// without shared storage, sessions break under prefork/clustering.
	Store *redis.Redis
	// TTL is the session lifetime from creation (no sliding refresh).
	TTL time.Duration
}

type SheddingConfig struct {
	// Allow is a function that returns nil if the request is allowed.
	// If it returns an error, the request is rejected with 503.
	// If nil, the default adaptive CPU-based shedder is used.
	Allow func() error
}

type TokenRefreshConfig struct {
	// RefreshTokenTTL is how long the refresh token is valid (manual mode).
	RefreshTokenTTL time.Duration
	// JWTSecret used to sign new tokens (manual mode).
	JWTSecret string
	// ZitadelTokenURL is the Zitadel token endpoint URL (openfga-zitadel mode).
	ZitadelTokenURL string
	// ZitadelClientID is the Zitadel OAuth2 client ID.
	ZitadelClientID string
	// KratosRefreshURL is the Kratos session refresh URL (ory mode).
	KratosRefreshURL string
}

type TraceConfig struct {
	Name     string
	Endpoint string
	Sampler  float64
	Batcher  string

	OtlpHeaders    map[string]string
	OtlpHttpPath   string
	OtlpHttpSecure bool

	TraceResponseHeader string
	CustomAttributes    func(fiber.Ctx) []attribute.KeyValue
	SkipPaths           []string
}

type WebSocketConfig struct {
	Origins          []string
	HandshakeTimeout time.Duration
	ReadBufferSize   int
	WriteBufferSize  int
}