config

type AuthValue struct {
	Header string `mapstructure:"header"`
	Prefix string `mapstructure:"prefix"`
	Value  string `mapstructure:"value"`
}

type AuthzConfig struct {
	Enabled      bool              `mapstructure:"enabled"`
	OPAURL       string            `mapstructure:"opaURL"`
	Timeout      time.Duration     `mapstructure:"timeout"`
	DecisionPath AuthzDecisionPath `mapstructure:"decisionPath"`
	Headers      AuthzHeaders      `mapstructure:"headers"`
	Input        AuthzInput        `mapstructure:"input"`
}

type AuthzDecisionPath struct {
	List    string `mapstructure:"list"`
	Call    string `mapstructure:"call"`
	Catalog string `mapstructure:"catalog"`
}

type AuthzHeaders struct {
	UserID     string `mapstructure:"userID"`
	UserGroups string `mapstructure:"userGroups"`
	Bypass     string `mapstructure:"bypass"`
}

type AuthzInput struct {
	User     string `mapstructure:"user"`
	Groups   string `mapstructure:"groups"`
	Server   string `mapstructure:"server"`
	Tool     string `mapstructure:"tool"`
	Tools    string `mapstructure:"tools"`
	ToolName string `mapstructure:"toolName"`

	// FromHeaders maps a decision-input field name to the inbound HTTP
	// header it is read from. Resolved values are added as top-level
	// fields to every decision input, typed per AuthzInputHeaderField.Type.
	// Empty (the default) adds nothing; a required header missing or empty
	// on a request denies (authz.ErrMissingInputHeader), while an optional
	// one is simply left out of the input.
	FromHeaders map[string]AuthzInputHeaderField `mapstructure:"fromHeaders"`
}

type AuthzInputHeaderField struct {
	Header   string `mapstructure:"header"`
	Required *bool  `mapstructure:"required"`
	Type     string `mapstructure:"type"`
}

type Config struct {
	Gateway   Gateway `mapstructure:"gateway"`
	MCPServer Servers `mapstructure:"mcpServers"`

	Redis  *RedisConfig  `mapstructure:"redis"`
	SQLite *SQLiteConfig `mapstructure:"sqlite"`
	Memory *MemoryConfig `mapstructure:"memory"`

	Telemetry telemetry.Config `mapstructure:"telemetry"`

	FileFetch FileFetchConfig `mapstructure:"fileFetch"`

	Storage Storage `mapstructure:"storage"`

	Identities map[string]*IdentityProfile `mapstructure:"identities"`

	Authz AuthzConfig `mapstructure:"authz"`
}

type EdgeAuth string

type EdgeConfig struct {
	Auth    EdgeAuth      `mapstructure:"auth"`
	Pairing PairingConfig `mapstructure:"pairing"`

	// TrustCloudflare, when true, additionally trusts Cloudflare's published
	// edge IP ranges as /edge/pair rate-limit forwarders. Only enable this
	// when Manifold is actually deployed behind Cloudflare — see
	// docs/design/webmcp-reverse-gateway-phase2.ja.md「Phase 1 からの持ち越し判断事項」.
	TrustCloudflare bool `mapstructure:"trustCloudflare"`

	// TrustedForwarders adds extra CIDR prefixes to trust as /edge/pair
	// rate-limit forwarders, alongside the RFC1918 default and (if enabled)
	// Cloudflare's ranges — e.g. an ALB/Ingress subnet outside RFC1918.
	TrustedForwarders []string `mapstructure:"trustedForwarders"`
}

type FileFetchConfig struct {
	// AllowLocal allows connecting to private/loopback/link-local IP addresses and
	// using the http:// scheme. Intended for local development/testing against a
	// local stack (e.g. ministack). Defaults to false.
	AllowLocal bool `mapstructure:"allowLocal"`

	// AllowedHosts, when non-empty, restricts URL downloads to these hosts only
	// (exact match against the URL host, with or without port). Empty means all
	// hosts are allowed, subject to the private-IP block unless AllowLocal is true.
	AllowedHosts []string `mapstructure:"allowedHosts"`

	// MaxSize is the maximum number of bytes accepted for a single file value,
	// whether downloaded from a URL or provided as base64/text content.
	// 0 (or unset) falls back to DefaultFileFetchMaxSize.
	MaxSize int64 `mapstructure:"maxSize"`
}

type Gateway struct {
	Port int `mapstructure:"port"`

	Key  string `mapstructure:"key"`
	Cert string `mapstructure:"cert"`

	EncryptKey string `mapstructure:"encryptKey"`

	Edge EdgeConfig `mapstructure:"edge"`

	SpecRefresh SpecRefreshConfig `mapstructure:"specRefresh"`
}

type IdentityProfile struct {
	Source IdentitySource `mapstructure:"source"`

	// source: jwt. Claim defaults to DefaultIdentityClaim; Audience is optional.
	Claim    string `mapstructure:"claim"`
	Issuer   string `mapstructure:"issuer"`
	JWKSURL  string `mapstructure:"jwksURL"`
	Audience string `mapstructure:"audience"`

	// source: header
	Header string `mapstructure:"header"`
	Hash   bool   `mapstructure:"hash"`

	// source: introspection. CacheTTL defaults to DefaultIntrospectionCacheTTL.
	URL              string        `mapstructure:"url"`
	CredentialHeader string        `mapstructure:"credentialHeader"`
	CacheTTL         time.Duration `mapstructure:"cacheTTL"`
}

type IdentitySource string

type MCPTransport string

type MemoryConfig struct {
	// Enabled が true の場合、インメモリストレージを使用する。
	Enabled bool `mapstructure:"enabled"`
}

type OAuth2 struct {
	ClientID     string   `mapstructure:"clientID"`
	ClientSecret string   `mapstructure:"clientSecret"`
	AuthURL      string   `mapstructure:"authURL"`
	TokenURL     string   `mapstructure:"tokenURL"`
	Scopes       []string `mapstructure:"scopes"`
}

type PairingConfig struct {
	Type PairingType `mapstructure:"type"`
}

type PairingType string

type RedisConfig struct {
	URL         string   `mapstructure:"url"`
	Addrs       []string `mapstructure:"addrs"`
	User        string   `mapstructure:"user"`
	Password    string   `mapstructure:"password"`
	DB          int      `mapstructure:"db"`
	MasterName  string   `mapstructure:"master_name"`
	TLS         bool     `mapstructure:"tls"`
	ClusterMode bool     `mapstructure:"cluster_mode"`
}

type S3 struct {
	Bucket    string `mapstructure:"bucket"`
	KeyPrefix string `mapstructure:"keyPrefix"`
}

type SQLiteConfig struct {
	// Path はSQLiteデータベースファイルのパス。
	// ":memory:" を指定するとインメモリDBとして動作する。
	Path string `mapstructure:"path"`
}

type Server struct {
	Name         string
	Description  string            `mapstructure:"description"`
	BaseURL      string            `mapstructure:"baseURL"`
	Spec         string            `mapstructure:"spec"` // ファイル or http(s)（OpenAPI モード）
	ExtraHeaders map[string]string `mapstructure:"headers"`

	// nil は gateway.specRefresh.interval を使う、0 はこのサーバーのみリフレッシュ無効。
	SpecRefreshInterval *time.Duration `mapstructure:"specRefreshInterval"`

	// Tools は静的ツールカタログ（生成物）関連の設定。File が指定されると、
	// 起動・リフレッシュで spec を取得せず生成物ファイルからツールを読み込む。
	Tools *ToolsConfig `mapstructure:"tools"`

	AuthValue     *AuthValue     `mapstructure:"authValue"`
	OAuth2        *OAuth2        `mapstructure:"oauth2"`
	TokenExchange *TokenExchange `mapstructure:"tokenExchange"`

	// MCP バックエンドモード用（Spec が空のとき有効）
	Transport MCPTransport      `mapstructure:"transport"`
	URL       string            `mapstructure:"url"`     // streamable_http 用
	Command   string            `mapstructure:"command"` // stdio 用
	Args      []string          `mapstructure:"args"`
	Env       map[string]string `mapstructure:"env"`

	// reverse トランスポート用（WebMCP reverse connection gateway）
	Origin      string        `mapstructure:"origin"`      // ブリッジ対象タブの許可 origin
	Identity    string        `mapstructure:"identity"`    // identities プロファイル名の参照
	CallTimeout time.Duration `mapstructure:"callTimeout"` // 未設定/0以下は DefaultCallTimeout
}

type Servers map[string]*Server

type SpecRefreshConfig struct {
	Interval time.Duration `mapstructure:"interval"`
}

type Storage struct {
	Type    string `mapstructure:"type"`
	HostURL string `mapstructure:"hostURL"`
	S3      *S3    `mapstructure:"s3"`
}

type TokenExchange struct {
	URL string `mapstructure:"url"`
}

type ToolsConfig struct {
	File string `mapstructure:"file"`
}