config

type App struct {
	Mod      string        `yaml:"module"`
	Services []*ServiceCfg `yaml:"services"`
	// contains filtered or unexported fields
}

type ClientAuth struct {
	// Type defines how to authenticate the client.
	// Supported types are:
	//   - mtls: Mutual TLS authentication
	//   - clientSecret: Client Secret authentication
	Type string `yaml:"type" default:"mtls"`
	// MTLS contains the mTLS configuration when Type is set to "mtls".
	MTLS *commoncfg.MTLS `yaml:"mTLS"`
	// ClientSecret contains the client secret source reference when Type is set to "clientSecret".
	ClientSecret commoncfg.SourceRef `yaml:"clientSecret"`

	// Deprecated: ClientID is no longer used in the application code, but is still required in the config
	// to backfill existing database entries during migration.
	// It will be removed in a future release once the migration has been applied in all environments.
	ClientID string `yaml:"clientID"`
}

type Config struct {
	commoncfg.BaseConfig `yaml:",inline"`

	HTTP HTTPServer `yaml:"http"`
	GRPC GRPCServer `yaml:"grpc"`

	Database       Database       `yaml:"database"`
	ValKey         ValKey         `yaml:"valkey"`
	Migrate        Migrate        `yaml:"migrate"`
	SessionManager SessionManager `yaml:"sessionManager"`
	Housekeeper    Housekeeper    `yaml:"housekeeper"`
	Trust          Trust          `yaml:"trust"`
	Credentials    Credentials    `yaml:"credentials"`

	// Apps configures long-running components that satisfy the sessionmanager.App
	// interface. The map key is an operator-chosen name. Each entry MUST set
	// "module:" to the registered module ID; remaining fields are passed to the
	// module via UnmarshalExtension.
	Apps map[string]*App `yaml:"apps"`
	// AppsOrder optionally overrides the start order of apps. Apps not listed
	// here are started in parser-defined order after the listed ones. At
	// shutdown, apps are stopped in the reverse of the order in which they were
	// successfully started.
	AppsOrder []string `yaml:"appsOrder"`
}

type CookieSameSiteValue string

type CookieTemplate struct {
	Name     string              `yaml:"name"`
	MaxAge   int                 `yaml:"maxAge"`
	Path     string              `yaml:"path"`
	Domain   string              `yaml:"domain"`
	Secure   bool                `yaml:"secure"`
	SameSite CookieSameSiteValue `yaml:"sameSite"`
	HTTPOnly bool                `yaml:"httpOnly"`
}

type Credentials struct {
	Mod string `yaml:"module" default:"credentials.module.oauth2"`
	// contains filtered or unexported fields
}

type Database struct {
	Mod string `yaml:"module" default:"database.module.pgxpool"`
	// contains filtered or unexported fields
}

type GRPCServer struct {
	commoncfg.GRPCServer `yaml:",inline"`

	ShutdownTimeout time.Duration `yaml:"shutdownTimeout" default:"5s"`
}

type HTTPServer struct {
	Address         string        `yaml:"address" default:":8080"`
	ShutdownTimeout time.Duration `yaml:"shutdownTimeout" default:"5s"`
}

type Housekeeper struct {
	// TriggerInterval defines how often the housekeeper jobs run.
	TriggerInterval time.Duration `yaml:"triggerInterval" default:"10m"`
	// ConcurrencyLimit defines the maximum number of sessions handled concurrently during housekeeping.
	ConcurrencyLimit int `yaml:"concurrencyLimit" default:"10"`
	// TokenRefreshTriggerInterval defines the duration before token expiry when a token refresh should be triggered.
	// This should at least match the TriggerInterval to ensure that expiring tokens are refreshed in time.
	TokenRefreshTriggerInterval time.Duration `yaml:"tokenRefreshTriggerInterval" default:"15m"`
}

type Migrate struct {
	Mod string `yaml:"module" default:"trust.migration.module.oidc"`
	// contains filtered or unexported fields
}

type ServiceCfg struct {
	Mod string `yaml:"module"`
	// contains filtered or unexported fields
}

type SessionManager struct {
	IdleSessionTimeout time.Duration `yaml:"idleSessionTimeout" default:"90m"`
	SessionDuration    time.Duration `yaml:"sessionDuration" default:"12h"`

	// CallbackURL is the URL path for the OAuth2 callback endpoint, where we receive the authorization code.
	CallbackURL      string              `yaml:"callbackURL" default:"/sm/callback"`
	ClientAuth       ClientAuth          `yaml:"clientAuth"`
	CSRFSecret       commoncfg.SourceRef `yaml:"csrfSecret"`
	CSRFSecretParsed []byte              `yaml:"-"`
	// SessionCookieTemplate defines the template attributes for the session cookie.
	SessionCookieTemplate CookieTemplate `yaml:"sessionCookieTemplate"`
	// CSRFCookieTemplate defines the template attributes for the CSRF cookie.
	CSRFCookieTemplate CookieTemplate `yaml:"csrfCookieTemplate"`
	// LoginCSRFCookieTemplate defines the template attributes for the CSRF cookie.
	LoginCSRFCookieTemplate CookieTemplate `yaml:"loginCSRFCookieTemplate"`

	// AllowedRedirectBaseURLs defines the list of allowed base URLs for redirection
	// during the authorization flow and post logout. This is used to validate the redirect
	// URLs provided in the authorization request and post logout requests.
	AllowedRedirectBaseURLs []string `yaml:"allowedRedirectBaseURLs"`

	// AllowHttpScheme permits OIDC issuers served over plain http:// (e.g. a local
	// mock IdP such as Dex during development). Defaults to false so production
	// only trusts https:// issuers.
	AllowHttpScheme bool `yaml:"allowHttpScheme" default:"false"`
}

type Trust struct {
	Mod string `yaml:"module" default:"trust.module.oidc"`
	// contains filtered or unexported fields
}

type ValKey struct {
	Mod       string              `yaml:"module" default:"sessionstore.module.valkey"`
	Host      commoncfg.SourceRef `yaml:"host"`
	User      commoncfg.SourceRef `yaml:"user"`
	Password  commoncfg.SourceRef `yaml:"password"`
	Prefix    string              `yaml:"prefix"`
	SecretRef commoncfg.SecretRef `yaml:"secretRef"`
	// contains filtered or unexported fields
}