config

type AITriageConfig struct {
	// Enabled controls whether AI triage feature is available platform-wide.
	Enabled bool

	// Platform AI Provider Configuration
	// Used when tenants choose "platform" mode (don't provide their own keys)
	PlatformProvider string // "claude", "openai", or "gemini"
	PlatformModel    string // e.g., "claude-3-5-sonnet-20241022", "gemini-1.5-pro"
	AnthropicAPIKey  string // Platform's Anthropic API key
	OpenAIAPIKey     string // Platform's OpenAI API key
	GeminiAPIKey     string // Platform's Google Gemini API key

	// Rate Limiting
	MaxConcurrentJobs int // Max concurrent AI triage jobs
	RateLimitRPM      int // Rate limit per minute
	TimeoutSeconds    int // Timeout for AI API calls
	MaxTokens         int // Max tokens per request

	// LLM Parameters
	Temperature float64 // Temperature for LLM (0.0-1.0, lower = more deterministic)

	// Default Auto-Triage Settings (can be overridden per tenant)
	DefaultAutoTriageEnabled    bool
	DefaultAutoTriageSeverities []string
	DefaultAutoTriageDelay      time.Duration

	// Stuck Job Recovery Settings
	RecoveryEnabled       bool          // Enable background recovery for stuck jobs
	RecoveryInterval      time.Duration // How often to check for stuck jobs (default: 5 minutes)
	RecoveryStuckDuration time.Duration // How long before a job is considered stuck (default: 15 minutes)
	RecoveryBatchSize     int           // Max jobs to recover per run (default: 50)
}

type AgentConfig struct {
	// HeartbeatTimeout is the duration after which an agent is marked as inactive
	// if no heartbeat is received. Default: 5 minutes.
	HeartbeatTimeout time.Duration

	// HealthCheckInterval is how often to check for stale agents.
	// Default: 1 minute.
	HealthCheckInterval time.Duration

	// Enabled controls whether agent health checking is enabled.
	// Default: true.
	Enabled bool

	// LoadBalancing holds configuration for agent load balancing weights.
	LoadBalancing LoadBalancingConfig
}

type AppConfig struct {
	Name  string
	Env   string
	Debug bool
}

type AuthConfig struct {
	// Provider determines which authentication methods are available.
	// Values: "local", "oidc", "hybrid"
	Provider AuthProvider

	// JWT settings for local auth
	JWTSecret            string        // Secret key for signing JWTs (required for local/hybrid)
	JWTIssuer            string        // Token issuer claim
	AccessTokenDuration  time.Duration // Access token lifetime (default: 15m)
	RefreshTokenDuration time.Duration // Refresh token lifetime (default: 7d)
	SessionDuration      time.Duration // Session lifetime (default: 30d)

	// Password policy
	PasswordMinLength      int  // Minimum password length (default: 8)
	PasswordRequireUpper   bool // Require uppercase letter
	PasswordRequireLower   bool // Require lowercase letter
	PasswordRequireNumber  bool // Require number
	PasswordRequireSpecial bool // Require special character

	// Security settings
	MaxLoginAttempts  int           // Max failed attempts before lockout (default: 5)
	LockoutDuration   time.Duration // Account lockout duration (default: 15m)
	MaxActiveSessions int           // Max concurrent sessions per user (default: 10)

	// Registration settings
	AllowRegistration        bool // Allow new user registration (default: true)
	RequireEmailVerification bool // Require email verification (default: true)

	// Email verification/reset token settings
	EmailVerificationDuration time.Duration // Email verification token lifetime (default: 24h)
	PasswordResetDuration     time.Duration // Password reset token lifetime (default: 1h)

	// Cookie settings for tokens (security best practice)
	CookieSecure           bool   // Use Secure flag (HTTPS only) - should be true in production
	CookieDomain           string // Cookie domain (empty = current host)
	CookieSameSite         string // SameSite policy: "strict", "lax", or "none"
	AccessTokenCookieName  string // Cookie name for access token (default: "auth_token")
	RefreshTokenCookieName string // Cookie name for refresh token (default: "refresh_token")
	TenantCookieName       string // Cookie name for tenant (default: "app_tenant")
}

type AuthProvider string

type CORSConfig struct {
	AllowedOrigins []string
	AllowedMethods []string
	AllowedHeaders []string
	MaxAge         int
}

type Config struct {
	App        AppConfig
	Server     ServerConfig
	GRPC       GRPCConfig
	Database   DatabaseConfig
	Redis      RedisConfig
	Log        LogConfig
	Auth       AuthConfig
	OAuth      OAuthConfig
	Keycloak   KeycloakConfig
	CORS       CORSConfig
	RateLimit  RateLimitConfig
	SMTP       SMTPConfig
	Worker     WorkerConfig
	Encryption EncryptionConfig
	AITriage   AITriageConfig
}

type DatabaseConfig struct {
	Host            string
	Port            int
	User            string
	Password        string
	Name            string
	SSLMode         string
	MaxOpenConns    int
	MaxIdleConns    int
	ConnMaxLifetime time.Duration
}

type EncryptionConfig struct {
	// Key is the encryption key for AES-256-GCM encryption of sensitive data.
	// Must be exactly 32 bytes (256 bits) when decoded.
	// Can be provided as:
	// - Raw 32-byte key
	// - Hex-encoded (64 characters)
	// - Base64-encoded (44 characters)
	Key string

	// KeyFormat specifies the format of the encryption key.
	// Values: "raw", "hex", "base64"
	// Default: auto-detected based on key length
	KeyFormat string
}

type GRPCConfig struct {
	Port int
}

type KeycloakConfig struct {
	// BaseURL is the Keycloak server URL (e.g., "https://keycloak.example.com")
	BaseURL string
	// Realm is the Keycloak realm name
	Realm string
	// ClientID is the expected audience in tokens (optional, for audience validation)
	ClientID string
	// JWKSRefreshInterval is how often to refresh JWKS keys
	JWKSRefreshInterval time.Duration
	// HTTPTimeout is the timeout for HTTP requests to Keycloak
	HTTPTimeout time.Duration
}

type LoadBalancingConfig struct {
	// JobWeight is the weight for job load factor (current_jobs/max_jobs * 100).
	// Default: 0.30 (30%)
	JobWeight float64

	// CPUWeight is the weight for CPU usage percentage.
	// Default: 0.40 (40%) - CPU is typically the most important metric
	CPUWeight float64

	// MemoryWeight is the weight for memory usage percentage.
	// Default: 0.15 (15%)
	MemoryWeight float64

	// DiskIOWeight is the weight for disk I/O score.
	// Default: 0.10 (10%)
	DiskIOWeight float64

	// NetworkWeight is the weight for network I/O score.
	// Default: 0.05 (5%)
	NetworkWeight float64

	// MaxDiskThroughputMBPS is the maximum expected disk throughput in MB/s.
	// Used to normalize disk I/O metrics to a 0-100 scale.
	// Default: 500 (500 MB/s combined read+write)
	MaxDiskThroughputMBPS float64

	// MaxNetworkThroughputMBPS is the maximum expected network throughput in MB/s.
	// Used to normalize network metrics to a 0-100 scale.
	// Default: 1000 (1 Gbps combined rx+tx)
	MaxNetworkThroughputMBPS float64
}

type LogConfig struct {
	Level  string
	Format string

	// Sampling configuration for high-traffic production environments
	SamplingEnabled   bool    // Enable log sampling (default: false for dev, true for prod)
	SamplingThreshold int     // First N identical logs per second (default: 100)
	SamplingRate      float64 // Sample rate after threshold, 0.0-1.0 (default: 0.1 = 10%)
	ErrorSamplingRate float64 // Sample rate for errors, 0.0-1.0 (default: 1.0 = 100%)

	// HTTP logging configuration
	SkipHealthLogs     bool // Skip logging health check endpoints (default: true in prod)
	SlowRequestSeconds int  // Log requests slower than this as warnings (default: 5)
}

type OAuthConfig struct {
	// Enabled controls whether OAuth login is enabled
	Enabled bool

	// FrontendCallbackURL is the frontend URL for OAuth callbacks
	// e.g., "http://localhost:3000/auth/callback"
	FrontendCallbackURL string

	// StateSecret is used to sign OAuth state tokens for CSRF protection
	StateSecret string

	// StateDuration is how long OAuth state tokens are valid
	StateDuration time.Duration

	// Providers
	Google    OAuthProviderConfig
	GitHub    OAuthProviderConfig
	Microsoft OAuthProviderConfig
}

type OAuthProviderConfig struct {
	Enabled      bool
	ClientID     string
	ClientSecret string
	// Scopes are the OAuth scopes to request (optional, defaults provided)
	Scopes []string
}

type RateLimitConfig struct {
	Enabled         bool
	RequestsPerSec  float64
	Burst           int
	CleanupInterval time.Duration
}

type RedisConfig struct {
	Host          string
	Port          int
	Password      string
	DB            int
	PoolSize      int
	MinIdleConns  int
	DialTimeout   time.Duration
	ReadTimeout   time.Duration
	WriteTimeout  time.Duration
	TLSEnabled    bool
	TLSSkipVerify bool
	MaxRetries    int
	MinRetryDelay time.Duration
	MaxRetryDelay time.Duration
}

type SMTPConfig struct {
	Host       string
	Port       int
	User       string
	Password   string
	From       string
	FromName   string
	TLS        bool
	SkipVerify bool
	Enabled    bool
	BaseURL    string // Frontend base URL for email links (e.g., https://app.openctem.io)
	Timeout    time.Duration
}

type ServerConfig struct {
	Host            string
	Port            int
	ReadTimeout     time.Duration
	WriteTimeout    time.Duration
	RequestTimeout  time.Duration // Per-request handler timeout
	ShutdownTimeout time.Duration
	MaxBodySize     int64
}

type WorkerConfig = AgentConfig