config

type AuthenticationConfig struct {
	// JWT defines JWT authentication settings.
	JWT JWTConfig `koanf:"jwt"`
}

type AuthorizationConfig struct {
	// Enabled enables authorization enforcement.
	Enabled bool `koanf:"enabled"`
	// Cache defines caching settings for authorization decisions.
	Cache AuthzCacheConfig `koanf:"cache"`
	// ResyncInterval is the interval for informer cache resync.
	// This triggers re-listing of CRDs and OnUpdate callbacks for reconciliation.
	// Set to 0 to disable periodic resync (watch events still work).
	ResyncInterval time.Duration `koanf:"resync_interval"`
}

type AuthzCacheConfig struct {
	// Enabled enables the Casbin enforcer cache.
	Enabled bool `koanf:"enabled"`
	// TTL is the cache time-to-live duration.
	TTL time.Duration `koanf:"ttl"`
}

type ClientConfig struct {
	// ClientID is the OAuth client identifier.
	ClientID string `koanf:"client_id"`
	// Scopes is the list of OAuth scopes to request.
	Scopes []string `koanf:"scopes"`
}

type ClusterGatewayConfig struct {
	// Enabled controls whether cluster gateway integration is enabled.
	Enabled bool `koanf:"enabled"`
	// URL is the cluster gateway service URL.
	URL string `koanf:"url"`
	// TLS defines TLS settings for the connection.
	TLS ClusterGatewayTLSConfig `koanf:"tls"`
}

type ClusterGatewayTLSConfig struct {
	// CACertPath is the path to the CA certificate file for verifying the cluster gateway server.
	CACertPath string `koanf:"ca_cert_path"`
	// ClientCertPath is the path to the client certificate file for mTLS authentication.
	ClientCertPath string `koanf:"client_cert_path"`
	// ClientKeyPath is the path to the client private key file for mTLS authentication.
	ClientKeyPath string `koanf:"client_key_path"`
	// Insecure disables TLS verification for the cluster gateway connection.
	// For local development only.
	Insecure bool `koanf:"insecure"`
}

type Config struct {
	// Server defines HTTP server settings.
	Server ServerConfig `koanf:"server"`
	// Security defines authentication and authorization settings.
	Security SecurityConfig `koanf:"security"`
	// Identity defines identity provider settings.
	Identity IdentityConfig `koanf:"identity"`
	// MCP defines Model Context Protocol server settings.
	MCP MCPConfig `koanf:"mcp"`
	// SecretManagement toggles the Secret management API endpoints.
	SecretManagement SecretManagementConfig `koanf:"secret_management"`
	// Logging defines logging settings.
	Logging LoggingConfig `koanf:"logging"`
	// ClusterGateway defines cluster gateway connection settings.
	ClusterGateway ClusterGatewayConfig `koanf:"cluster_gateway"`
}

type EntitlementConfig struct {
	// Claim is the claim name for entitlement extraction.
	Claim string `koanf:"claim"`
	// DisplayName is the human-readable name for the claim.
	DisplayName string `koanf:"display_name"`
}

type IdentityConfig struct {
	// OIDC defines OpenID Connect provider settings.
	OIDC OIDCConfig `koanf:"oidc"`
	// Clients defines OAuth client configurations for external integrations.
	// Keys are client identifiers (e.g., "cli", "ci").
	Clients map[string]ClientConfig `koanf:"clients"`
}

type JWKSConfig struct {
	// RefreshInterval is how often to refresh keys from the JWKS URL.
	RefreshInterval time.Duration `koanf:"refresh_interval"`
	// SkipTLSVerify skips TLS certificate verification for JWKS URL.
	// WARNING: Only use for development/testing.
	SkipTLSVerify bool `koanf:"skip_tls_verify"`
}

type JWTConfig struct {
	// Audiences is the list of acceptable token audiences (aud claim).
	// Token must contain at least one of these audiences. Optional.
	Audiences []string `koanf:"audiences"`
	// ClockSkew is the allowed clock skew for token validation.
	ClockSkew time.Duration `koanf:"clock_skew"`
	// JWKS defines JSON Web Key Set operational settings.
	JWKS JWKSConfig `koanf:"jwks"`
}

type LoggingConfig struct {
	// Level is the minimum log level (debug, info, warn, error).
	Level string `koanf:"level"`
	// Format is the log output format (json, text).
	Format string `koanf:"format"`
	// AddSource includes source file and line number in log entries.
	AddSource bool `koanf:"add_source"`
}

type MCPConfig struct {
	// Enabled enables the MCP server endpoint.
	Enabled bool `koanf:"enabled"`
	// Toolsets is the list of enabled MCP toolsets.
	Toolsets []string `koanf:"toolsets"`
}

type MechanismConfig struct {
	// Entitlement defines how to extract entitlement claims.
	Entitlement EntitlementConfig `koanf:"entitlement"`
}

type MiddlewareConfig struct {
}

type OIDCConfig struct {
	// Issuer is the OIDC provider issuer URL.
	// Used for token validation and as the base for OAuth metadata.
	Issuer string `koanf:"issuer"`
	// JWKSURL is the URL to fetch JSON Web Key Set for token verification.
	JWKSURL string `koanf:"jwks_url"`
	// AuthorizationEndpoint is the OAuth authorization endpoint URL.
	AuthorizationEndpoint string `koanf:"authorization_endpoint"`
	// TokenEndpoint is the OAuth token endpoint URL.
	TokenEndpoint string `koanf:"token_endpoint"`
}

type SecretManagementConfig struct {
	// Enabled toggles the Secret management API (POST/PUT/GET/LIST/DELETE under
	// /api/v1alpha1/namespaces/{ns}/secrets). When false, all five
	// endpoints return 501 Not Implemented.
	Enabled bool `koanf:"enabled"`
}

type SecurityConfig struct {
	// Enabled enables all security checks (authentication and authorization).
	// When false, authentication and authorization enforcement is skipped and
	// requests are processed as anonymous without any access restrictions.
	Enabled bool `koanf:"enabled"`
	// Authentication defines authentication settings.
	Authentication AuthenticationConfig `koanf:"authentication"`
	// Subjects defines subject types for identity classification.
	// Keys are subject type identifiers (e.g., "user", "service_account").
	Subjects map[string]SubjectConfig `koanf:"subjects"`
	// Authorization defines authorization (Casbin) settings.
	Authorization AuthorizationConfig `koanf:"authorization"`
}

type ServerConfig struct {
	// BindAddress is the address to bind the HTTP server to.
	BindAddress string `koanf:"bind_address"`
	// Port is the HTTP server port.
	Port int `koanf:"port"`
	// PublicURL is the externally accessible URL of this server.
	// Used for OAuth resource metadata and self-referential links.
	PublicURL string `koanf:"public_url"`
	// Timeouts defines HTTP server timeout settings.
	Timeouts TimeoutsConfig `koanf:"timeouts"`
	// TLS defines TLS/HTTPS settings.
	TLS TLSConfig `koanf:"tls"`
	// Middleware defines middleware configurations.
	Middleware MiddlewareConfig `koanf:"middleware"`
}

type SubjectConfig struct {
	// DisplayName is the human-readable name for this subject type.
	DisplayName string `koanf:"display_name"`
	// Priority determines check order (lower = higher priority).
	Priority int `koanf:"priority"`
	// Mechanisms defines authentication mechanisms and their entitlement extraction.
	// Keys are mechanism types (e.g., "jwt").
	Mechanisms map[string]MechanismConfig `koanf:"mechanisms"`
}

type TLSConfig struct {
	// Enabled enables TLS for the HTTP server.
	Enabled bool `koanf:"enabled"`
	// CertFile is the path to the TLS certificate file.
	CertFile string `koanf:"cert_file"`
	// KeyFile is the path to the TLS private key file.
	KeyFile string `koanf:"key_file"`
}

type TimeoutsConfig struct {
	// Read is the maximum duration for reading the entire request.
	Read time.Duration `koanf:"read"`
	// Write is the maximum duration before timing out writes of the response.
	Write time.Duration `koanf:"write"`
	// Idle is the maximum duration to wait for the next request.
	Idle time.Duration `koanf:"idle"`
	// Shutdown is the maximum duration to wait for active connections to close.
	Shutdown time.Duration `koanf:"shutdown"`
}