config

const (
	// DirName is the name of the configuration directory.
	DirName = "google-readonly"
	// CredentialsFile is the legacy OAuth client JSON filename (deployment
	// material). Superseded by OAuthClientFile; retained so the one-time
	// migration can find and relocate it.
	CredentialsFile = "credentials.json"
	// OAuthClientFile is the post-migration OAuth client JSON filename
	// (deployment material per §1.2 — not a secret, not in the keyring).
	OAuthClientFile = "oauth_client.json"
	// TokenFile is the legacy OAuth token fallback filename. Superseded by
	// the keyring; retained so the one-time migration can find it.
	TokenFile = "token.json"
	// ConfigFile is the legacy JSON config filename, read once for
	// transparent upgrade to ConfigFileYAML.
	ConfigFile = "config.json"
	// ConfigFileYAML is the authoritative config filename.
	ConfigFileYAML = "config.yml"

	// DefaultCredentialRef applies when config.yml is absent or omits
	// credential_ref. Callers still resolve it via credstore.ParseRef — the
	// service/profile are never assumed structurally (§1.3).
	DefaultCredentialRef = "google-readonly/default"

	// DefaultCacheTTLHours is the default cache TTL in hours.
	DefaultCacheTTLHours = 24
)

const (
	// DirPerm is the permission for config directories (owner rwx only).
	DirPerm = 0700
	// TokenPerm is the permission for the config file (owner rw only). The
	// config holds no secret, but there is no reason for it to be world
	// readable.
	TokenPerm = 0600
	// OutputDirPerm is the permission for output directories.
	OutputDirPerm = 0755
	// OutputFilePerm is the permission for output files, and for the OAuth
	// client JSON (deployment material — non-secret, org-internal).
	OutputFilePerm = 0644
)