dex

type Config struct {
	Issuer  string
	Port    int
	DataDir string
	DevMode bool

	// GRPCAddr is the address for the gRPC API (e.g., ":5557"). Empty disables gRPC.
	GRPCAddr string
}

type Connector struct {
	Type   string                 `yaml:"type" json:"type"`
	Name   string                 `yaml:"name" json:"name"`
	ID     string                 `yaml:"id" json:"id"`
	Config map[string]interface{} `yaml:"config" json:"config"`
}

type ConnectorConfig struct {
	// ID is the unique identifier for the connector
	ID string
	// Name is a human-readable name for the connector
	Name string
	// Type is the connector type (oidc, google, microsoft)
	Type string
	// Issuer is the OIDC issuer URL (for OIDC-based connectors)
	Issuer string
	// ClientID is the OAuth2 client ID
	ClientID string
	// ClientSecret is the OAuth2 client secret
	ClientSecret string
	// RedirectURI is the OAuth2 redirect URI
	RedirectURI string
}

type Expiry struct {
	SigningKeys    string              `yaml:"signingKeys" json:"signingKeys"`
	IDTokens       string              `yaml:"idTokens" json:"idTokens"`
	AuthRequests   string              `yaml:"authRequests" json:"authRequests"`
	DeviceRequests string              `yaml:"deviceRequests" json:"deviceRequests"`
	RefreshTokens  RefreshTokensExpiry `yaml:"refreshTokens" json:"refreshTokens"`
}

type Frontend struct {
	Dir     string            `yaml:"dir" json:"dir"`
	Theme   string            `yaml:"theme" json:"theme"`
	Issuer  string            `yaml:"issuer" json:"issuer"`
	LogoURL string            `yaml:"logoURL" json:"logoURL"`
	Extra   map[string]string `yaml:"extra" json:"extra"`
}

type GRPC struct {
	Addr        string `yaml:"addr" json:"addr"`
	TLSCert     string `yaml:"tlsCert" json:"tlsCert"`
	TLSKey      string `yaml:"tlsKey" json:"tlsKey"`
	TLSClientCA string `yaml:"tlsClientCA" json:"tlsClientCA"`
}

type Logger struct {
	Level  string `yaml:"level" json:"level"`
	Format string `yaml:"format" json:"format"`
}

type LogrusHandler struct {
	// contains filtered or unexported fields
}

type MFAAuthenticator struct {
	ID     string                 `yaml:"id" json:"id"`
	Type   string                 `yaml:"type" json:"type"`
	Config map[string]interface{} `yaml:"config" json:"config"`

	ConnectorTypes []string `yaml:"connectorTypes" json:"connectorTypes"`
}

type MFAConfig struct {
	Authenticators []MFAAuthenticator `yaml:"authenticators" json:"authenticators"`
}

type OAuth2 struct {
	SkipApprovalScreen    bool     `yaml:"skipApprovalScreen" json:"skipApprovalScreen"`
	AlwaysShowLoginScreen bool     `yaml:"alwaysShowLoginScreen" json:"alwaysShowLoginScreen"`
	PasswordConnector     string   `yaml:"passwordConnector" json:"passwordConnector"`
	ResponseTypes         []string `yaml:"responseTypes" json:"responseTypes"`
	GrantTypes            []string `yaml:"grantTypes" json:"grantTypes"`
}

type Password storage.Password

type Provider struct {
	// contains filtered or unexported fields
}

type RefreshTokensExpiry struct {
	ReuseInterval     string `yaml:"reuseInterval" json:"reuseInterval"`
	ValidIfNotUsedFor string `yaml:"validIfNotUsedFor" json:"validIfNotUsedFor"`
	AbsoluteLifetime  string `yaml:"absoluteLifetime" json:"absoluteLifetime"`
	DisableRotation   bool   `yaml:"disableRotation" json:"disableRotation"`
}

type Sessions struct {
	// CookieName is the name of the session cookie. Defaults to "dex_session".
	CookieName string `yaml:"cookieName" json:"cookieName"`
	// AbsoluteLifetime is the maximum session lifetime from creation. Defaults to "24h".
	AbsoluteLifetime string `yaml:"absoluteLifetime" json:"absoluteLifetime"`
	// ValidIfNotUsedFor is the idle timeout. Defaults to "1h".
	ValidIfNotUsedFor string `yaml:"validIfNotUsedFor" json:"validIfNotUsedFor"`
	// RememberMeCheckedByDefault controls the default state of the "remember me" checkbox.
	RememberMeCheckedByDefault *bool `yaml:"rememberMeCheckedByDefault" json:"rememberMeCheckedByDefault"`
	// CookieEncryptionKey is the AES key for encrypting session cookies.
	// Must be 16, 24, or 32 bytes for AES-128, AES-192, or AES-256.
	// If empty, cookies are not encrypted.
	CookieEncryptionKey string `yaml:"cookieEncryptionKey" json:"cookieEncryptionKey"`
	// SSOSharedWithDefault is the default SSO sharing policy for clients without explicit ssoSharedWith.
	// "all" = share with all clients, "none" = share with no one (default: "none").
	SSOSharedWithDefault string `yaml:"ssoSharedWithDefault" json:"ssoSharedWithDefault"`
}

type Storage struct {
	Type   string                 `yaml:"type" json:"type"`
	Config map[string]interface{} `yaml:"config" json:"config"`
}

type StorageConfig interface {
	Open(logger *slog.Logger) (storage.Storage, error)
}

type TOTPConfig struct {
	Issuer string `yaml:"issuer" json:"issuer"`
}

type Web struct {
	HTTP           string   `yaml:"http" json:"http"`
	HTTPS          string   `yaml:"https" json:"https"`
	AllowedOrigins []string `yaml:"allowedOrigins" json:"allowedOrigins"`
	AllowedHeaders []string `yaml:"allowedHeaders" json:"allowedHeaders"`
}

type WebAuthnConfig struct {
	// RPDisplayName is the human-readable relying party name shown in the browser
	// dialog during key registration and authentication (e.g., "My Company SSO").
	RPDisplayName string `yaml:"rpDisplayName" json:"rpDisplayName"`
	// RPID is the relying party identifier — must match the domain in the browser
	// address bar. If empty, derived from the issuer URL hostname.
	// Example: "auth.example.com"
	RPID string `yaml:"rpID" json:"rpID"`
	// RPOrigins is the list of allowed origins for WebAuthn ceremonies.
	// If empty, derived from the issuer URL (scheme + host).
	// Example: ["https://auth.example.com"]
	RPOrigins []string `yaml:"rpOrigins" json:"rpOrigins"`
	// AttestationPreference controls what attestation data the authenticator should provide:
	//   "none"     — don't request attestation (simpler, more private)
	//   "indirect" — authenticator may anonymize attestation (default)
	//   "direct"   — request full attestation (for enterprise key model verification)
	AttestationPreference string `yaml:"attestationPreference" json:"attestationPreference"`
	// Timeout is the duration allowed for the browser WebAuthn ceremony
	// (registration or login). Defaults to "60s".
	Timeout string `yaml:"timeout" json:"timeout"`
}

type YAMLConfig struct {
	Issuer   string   `yaml:"issuer" json:"issuer"`
	Storage  Storage  `yaml:"storage" json:"storage"`
	Web      Web      `yaml:"web" json:"web"`
	GRPC     GRPC     `yaml:"grpc" json:"grpc"`
	OAuth2   OAuth2   `yaml:"oauth2" json:"oauth2"`
	Expiry   Expiry   `yaml:"expiry" json:"expiry"`
	Logger   Logger   `yaml:"logger" json:"logger"`
	Frontend Frontend `yaml:"frontend" json:"frontend"`

	// StaticConnectors are user defined connectors specified in the config file
	StaticConnectors []Connector `yaml:"connectors" json:"connectors"`

	// StaticClients cause the server to use this list of clients rather than
	// querying the storage. Write operations, like creating a client, will fail.
	StaticClients []storage.Client `yaml:"staticClients" json:"staticClients"`

	// If enabled, the server will maintain a list of passwords which can be used
	// to identify a user.
	EnablePasswordDB bool `yaml:"enablePasswordDB" json:"enablePasswordDB"`

	// StaticPasswords cause the server use this list of passwords rather than
	// querying the storage.
	StaticPasswords []Password `yaml:"staticPasswords" json:"staticPasswords"`

	// Sessions holds authentication session configuration.
	// Requires DEX_SESSIONS_ENABLED=true feature flag.
	Sessions *Sessions `yaml:"sessions" json:"sessions"`

	// MFA holds multi-factor authentication configuration.
	MFA MFAConfig `yaml:"mfa" json:"mfa"`
}