types

type AccountLink struct {
	Plugin      string `json:"plugin"`
	AccountName string `json:"account_name"`
}

type ActionConfig struct {
	MaxRequestBodyBytes int64 `toml:"max_request_body_bytes"`
}

type AppApplyResponse struct {
	DryRun                bool                `json:"dry_run"`
	CommitId              string              `json:"commit_id"`
	SkippedApply          bool                `json:"skipped_apply"`
	CreateResults         []AppCreateResponse `json:"create_results"`
	UpdateResults         []AppPathDomain     `json:"update_results"`
	ApproveResults        []ApproveResult     `json:"approve_results"`
	PromoteResults        []AppPathDomain     `json:"promote_results"`
	ReloadResults         []AppPathDomain     `json:"reload_results"`
	SkippedResults        []AppPathDomain     `json:"skipped_results"`
	FilteredApps          []AppPathDomain     `json:"filtered_apps"`
	CreateBindingResults  []string            `json:"create_binding_results"`
	UpdateBindingResults  []string            `json:"update_binding_results"`
	PromoteBindingResults []string            `json:"promote_binding_results"`
}

type AppApplyResult struct {
	DryRun        bool              `json:"dry_run"`
	CreateResult  AppCreateResponse `json:"create_result"`
	ApproveResult *ApproveResult    `json:"approve_result"`
	Updated       []AppPathDomain   `json:"updated"`
	Reloaded      []AppPathDomain   `json:"reloaded"`
	Skipped       []AppPathDomain   `json:"skipped"`
	Promoted      bool              `json:"promoted"`
}

type AppApproveResponse struct {
	DryRun              bool            `json:"dry_run"`
	StagedUpdateResults []ApproveResult `json:"staged_update_results"`
	PromoteResults      []AppPathDomain `json:"promote_results"`
}

type AppAuthnType string

type AppBuilderConfig struct {
	Enabled         bool   `toml:"enabled"`
	PreviewPath     string `toml:"preview_path"` // mount prefix for draft preview apps
	DefaultAgent    string `toml:"default_agent"`
	MaxSessions     int    `toml:"max_sessions"`
	SessionIdleMins int    `toml:"session_idle_mins"`
	WorkspaceDir    string `toml:"workspace_dir"` // default $OPENRUN_HOME/run/builder
	SystemPrompt    string `toml:"system_prompt"` // replaces the embedded base prompt when set
	PromptExtra     string `toml:"prompt_extra"`  // admin text appended to the system prompt

	// DefaultGitConfig names the [builder_git.*] entry used when the
	// session's prompt preset does not pick one. Empty (and no preset
	// choice) selects local publish mode ($OPENRUN_HOME/app_src)
	DefaultGitConfig string `toml:"default_git_config"`
}

type AppConfig struct {
	CORS       CORS         `toml:"cors"`
	Action     ActionConfig `toml:"action"`
	Container  Container    `toml:"container"`
	Kubernetes Kubernetes   `toml:"kubernetes"`
	Proxy      Proxy        `toml:"proxy"`
	FS         FS           `toml:"fs"`
	Audit      Audit        `toml:"audit"`
	Security   Security     `toml:"security"`
	StarBase   string       `toml:"star_base"` // The base directory for starlark config files
}

type AppCreateResponse struct {
	AppPathDomain  AppPathDomain   `json:"app_path_domain"`
	DryRun         bool            `json:"dry_run"`
	HttpUrl        string          `json:"http_url"`
	HttpsUrl       string          `json:"https_url"`
	ApproveResults []ApproveResult `json:"approve_results"`
	OrigSourceUrl  string          `json:"orig_source_url"`
	SourceUrl      string          `json:"source_url"`
}

type AppDeleteResponse struct {
	DryRun  bool      `json:"dry_run"`
	AppInfo []AppInfo `json:"app_info"`
}

type AppEntry struct {
	Id            AppId  `json:"id"`
	Path          string `json:"path"`
	Domain        string `json:"domain"`
	MainApp       AppId  `json:"main_app"`        // the id of the app that this app is linked to
	LinkedAppPath string `json:"linked_app_path"` // the path of the app that this app is linked to
	// for main app, points to the stage app. For stage app, points to the main app.
	// For preview apps, points to the base app. Not set for dev apps.
	SourceUrl  string      `json:"source_url"`
	IsDev      bool        `json:"is_dev"`
	UserID     string      `json:"user_id"`
	CreateTime *time.Time  `json:"create_time"`
	UpdateTime *time.Time  `json:"update_time"`
	Settings   AppSettings `json:"settings"` // settings are not version controlled
	Metadata   AppMetadata `json:"metadata"` // metadata is version controlled
}

type AppExportResponse struct {
	Config string `json:"config"`
}

type AppFile struct {
	Name string
	Etag string
	Size int64
}

type AppGetResponse struct {
	AppEntry AppEntry `json:"app_entry"`
}

type AppId string

type AppInfo struct {
	AppPathDomain
	Name           string
	Id             AppId
	IsDev          bool
	MainApp        AppId
	LinkedAppPath  string
	Auth           AppAuthnType
	SourceUrl      string
	Spec           AppSpec
	Version        int
	GitSha         string
	GitMessage     string
	Branch         string
	StarBase       string
	UpdateTime     time.Time
	RetainVersions int
	AppliedSyncId  string
	UserID         string // user who created the app, used for RBAC owner checks
}

type AppLinkAccountResponse struct {
	DryRun              bool            `json:"dry_run"`
	StagedUpdateResults []AppPathDomain `json:"staged_update_results"`
	PromoteResults      []AppPathDomain `json:"promote_results"`
}

type AppListResponse struct {
	Apps []AppResponse `json:"apps"`
}

type AppMetadata struct {
	Name                       string            `json:"name"`
	VersionMetadata            VersionMetadata   `json:"version_metadata"`
	Loads                      []string          `json:"loads"`
	Permissions                []Permission      `json:"permissions"`
	Accounts                   []AccountLink     `json:"accounts"`
	BindingSourcePerms         []string          `json:"binding_source_perms"`          // the binding source permissions that are requested for the app
	ApprovedBindingSourcePerms []string          `json:"approved_binding_source_perms"` // the binding source permissions that are approved for the app
	ParamValues                map[string]string `json:"param_values"`
	Spec                       AppSpec           `json:"spec"`
	SpecFiles                  *SpecFiles        `json:"spec_files"`
	ContainerOptions           map[string]string `json:"container_options"`
	ContainerArgs              map[string]string `json:"container_args"`
	ContainerVolumes           []string          `json:"container_volumes"`
	AppConfig                  map[string]string `json:"appconfig"`
	AuthnType                  AppAuthnType      `json:"authn_type"`
	GitAuthName                string            `json:"git_auth_name"`
	Bindings                   []string          `json:"bindings"`
	AppliedSyncId              string            `json:"applied_sync_id"` // id of the sync entry which last applied to this app, empty for imperative changes
}

type AppMetadataConfigType string

type AppPathDomain struct {
	Path   string
	Domain string
}

type AppPreviewResponse struct {
	DryRun        bool          `json:"dry_run"`
	HttpUrl       string        `json:"http_url"`
	HttpsUrl      string        `json:"https_url"`
	Success       bool          `json:"success"`
	ApproveResult ApproveResult `json:"approve_result"`
}

type AppPromoteResponse struct {
	DryRun         bool            `json:"dry_run"`
	PromoteResults []AppPathDomain `json:"promote_results"`
}

type AppReloadOption string

type AppReloadResponse struct {
	DryRun         bool            `json:"dry_run"`
	ReloadResults  []AppPathDomain `json:"reload_results"`
	ApproveResults []ApproveResult `json:"approve_results"`
	PromoteResults []AppPathDomain `json:"promote_results"`
	SkippedResults []AppPathDomain `json:"skipped_results"`
}

type AppReloadResult struct {
	DryRun         bool            `json:"dry_run"`
	ReloadResults  []AppPathDomain `json:"reload_results"`
	ApproveResult  *ApproveResult  `json:"approve_result"`
	PromoteResults []AppPathDomain `json:"promote_results"`
	SkippedResults []AppPathDomain `json:"skipped_results"`
}

type AppResponse struct {
	AppEntry
	StagedChanges bool `json:"staged_changes"`
}

type AppSettings struct {
	//Deprecated: use AppMetadata.AuthnType instead
	AuthnType AppAuthnType `json:"authn_type"`
	//Deprecated: use AppMetadata.GitAuthName instead
	GitAuthName        string        `json:"git_auth_name"`
	StageWriteAccess   bool          `json:"stage_write_access"`
	PreviewWriteAccess bool          `json:"preview_write_access"`
	WebhookTokens      WebhookTokens `json:"webhook_tokens"`
	OrigSourceUrl      string        `json:"orig_source_url"` // the original source url of the app, used for git create in dev mode
}

type AppSpec string

type AppStagedUpdateResponse struct {
	DryRun              bool            `json:"dry_run"`
	StagedUpdateResults any             `json:"staged_update_results"`
	PromoteResults      []AppPathDomain `json:"promote_results"`
}

type AppToken struct {
	Type  WebhookType `json:"type"`
	Url   string      `json:"url"`
	Token string      `json:"token"`
}

type AppUpdateMessage struct {
	MessageType string           `json:"message_type"`
	Payload     AppUpdatePayload `json:"payload"`
}

type AppUpdateMetadataResponse struct {
	DryRun              bool            `json:"dry_run"`
	StagedUpdateResults []AppPathDomain `json:"staged_update_results"`
	PromoteResults      []AppPathDomain `json:"promote_results"`
}

type AppUpdatePayload struct {
	AppPathDomains []AppPathDomain `json:"app_path_domains"`
	ServerId       ServerId        `json:"server_id"`
}

type AppUpdateSettingsResponse struct {
	DryRun        bool            `json:"dry_run"`
	UpdateResults []AppPathDomain `json:"update_results"`
}

type AppVersion struct {
	Active          bool
	AppId           AppId
	Version         int
	PreviousVersion int
	UserId          string
	Metadata        *AppMetadata
	CreateTime      time.Time
}

type AppVersionFilesResponse struct {
	Files []AppFile `json:"files"`
}

type AppVersionListResponse struct {
	Versions []AppVersion `json:"versions"`
}

type AppVersionSwitchResponse struct {
	DryRun      bool `json:"dry_run"`
	FromVersion int  `json:"from_version"`
	ToVersion   int  `json:"to_version"`
}

type ApproveResult struct {
	Id                         AppId         `json:"id"`
	AppPathDomain              AppPathDomain `json:"app_path_domain"`
	NewLoads                   []string      `json:"new_loads"`
	NewPermissions             []Permission  `json:"new_permissions"`
	ApprovedLoads              []string      `json:"approved_loads"`
	ApprovedPermissions        []Permission  `json:"approved_permissions"`
	NewBindingSourcePerms      []string      `json:"new_binding_source_perms"`
	ApprovedBindingSourcePerms []string      `json:"approved_binding_source_perms"`
	NeedsApproval              bool          `json:"needs_approval"`
}

type Audit struct {
	RedactUrl      bool `toml:"redact_url"`
	SkipHttpEvents bool `toml:"skip_http_events"`
}

type AuditEvent struct {
	RequestId  string
	AppId      AppId
	CreateTime time.Time
	UserId     string
	EventType  EventType
	Operation  string
	Target     string
	Status     string
	Detail     string
}

type AuthConfig struct {
	Key          string   `toml:"key"`           // the client id
	Secret       string   `toml:"secret"`        // the client secret
	OrgUrl       string   `toml:"org_url"`       // the org url, used for Okta
	Domain       string   `toml:"domain"`        // the domain, used for Auth0
	DiscoveryUrl string   `toml:"discovery_url"` // the discovery url, used for OIDC
	HostedDomain string   `toml:"hosted_domain"` // the hosted domain, used for Google
	Scopes       []string `toml:"scopes"`        // oauth scopes
}

type AuthorizerFunc func(ctx context.Context, permissions []string) (bool, error)

type Binding struct {
	Id               string          `json:"id"`           // the id of the binding
	Path             string          `json:"path"`         // the path of the binding
	Source           string          `json:"source"`       // service id, or the base binding path
	ServiceType      string          `json:"service_type"` // the type of the service
	ServiceName      string          `json:"service_name"` // the name of the service
	ServiceIsDefault bool            `json:"-"`
	DerivedFrom      string          `json:"derived_from"` // the base binding path this is derived from
	StagedMetadata   BindingMetadata `json:"staged_metadata"`
	Metadata         BindingMetadata `json:"metadata"`
	CreatedBy        string          `json:"created_by"` // user who created the binding
	CreateTime       time.Time       `json:"create_time"`
	UpdateTime       time.Time       `json:"update_time"`
}

type BindingGrant struct {
	GrantType   GrantType `json:"grant_type"`
	GrantTarget string    `json:"grant_target"`
}

type BindingMetadata struct {
	Grants        []string          `json:"grants"`
	GrantsApplied []BindingGrant    `json:"grants_applied"`
	Config        map[string]string `json:"config"`
	Account       map[string]string `json:"account,omitempty"`
	ApplyInfo     []byte            `json:"apply_info"`
}

type BoolValue int

type BuilderActivity struct {
	Id         string         `json:"id"`
	SessionId  string         `json:"session_id"`
	UserID     string         `json:"user_id"`
	CreateTime time.Time      `json:"create_time"`
	Kind       string         `json:"kind"` // prompt|agent_message|tool_call|lifecycle|approve|publish|unpublish|error
	Content    string         `json:"content"`
	Metadata   map[string]any `json:"metadata,omitempty"`
}

type BuilderAgentConfig struct {
	Type        string            `toml:"type"`         // optional; must match the type inferred from the name
	Dockerfile  string            `toml:"dockerfile"`   // overrides the embedded Dockerfile
	Command     []string          `toml:"command"`      // overrides the embedded ACP command
	Env         map[string]string `toml:"env"`          // container env, {{secret ...}} resolved at launch
	ConfigFiles []string          `toml:"config_files"` // host:container[:ro] mounts
	Model       string            `toml:"model"`        // model passed to the agent at session start (agent's naming)
	Effort      string            `toml:"effort"`       // reasoning effort level passed to the agent at session start
}

type BuilderConfig struct {
	Mode            string `toml:"mode"` // "auto", "kaniko", "command", "delegate:<url>", "delegate_server"
	KanikoImage     string `toml:"kaniko_image"`
	KanikoCache     bool   `toml:"kaniko_cache"`      // enable kaniko layer caching in the registry
	KanikoCacheRepo string `toml:"kaniko_cache_repo"` // cache repo, defaults to <registry_url>[/<project>]/kaniko-cache
}

type BuilderGitConfig struct {
	Repo      string `toml:"repo"`       // publish repo url
	Branch    string `toml:"branch"`     // branch for publish commits
	Auth      string `toml:"auth"`       // [git_auth.*] entry for the repo
	AppsFile  string `toml:"apps_file"`  // declarative file, relative to repo root
	SourceDir string `toml:"source_dir"` // repo directory for published app sources
}

type BuilderPromptConfig struct {
	Prompt      string `toml:"prompt"`
	Replace     bool   `toml:"replace"`     // replace the system prompt instead of appending to it
	Description string `toml:"description"` // shown in the new-app form
	GitConfig   string `toml:"git_config"`  // [builder_git.*] entry sessions created with this preset publish to; empty = builder default
}

type BuilderPublishConfig struct {
	Path        string `toml:"path"`        // app path glob, e.g. /teams/* or example.com:/**
	Description string `toml:"description"` // shown in the publish dialog: which RBAC rules apply
}

type BuilderSession struct {
	Id           string               `json:"id"`
	UserID       string               `json:"user_id"`
	Name         string               `json:"name"`
	Spec         string               `json:"spec"`
	Agent        string               `json:"agent"`  // [builder_agent.*] profile name
	Preset       string               `json:"preset"` // [builder_prompt.*] preset chosen at creation; decides the git destination
	Status       BuilderSessionStatus `json:"status"`
	WorkspaceDir string               `json:"workspace_dir"`
	PreviewPath  string               `json:"preview_path"` // dev app path, once created
	PublishPath  string               `json:"publish_path"` // once published
	CreateTime   time.Time            `json:"create_time"`
	UpdateTime   time.Time            `json:"update_time"`
}

type BuilderSessionStatus string

type CORS struct {
	AllowOrigin      string `toml:"allow_origin"`
	AllowMethods     string `toml:"allow_methods"`
	AllowHeaders     string `toml:"allow_headers"`
	AllowCredentials string `toml:"allow_credentials"`
	MaxAge           string `toml:"max_age"`
}

type ClientCertConfig struct {
	CACertFile string         `toml:"ca_cert_file"`
	RootCAs    *x509.CertPool `toml:"-"`
}

type ClientConfig struct {
	GlobalConfig
	Client ClientConfigStruct `toml:"client"`
}

type ClientConfigStruct struct {
	SkipCertCheck bool   `toml:"skip_cert_check"`
	AdminPassword string `toml:"admin_password"`
	DefaultFormat string `toml:"default_format"` // the default format for the CLI output
}

type ConfigDraft struct {
	RBAC         RBACConfig `json:"rbac"`          // the draft RBAC section
	BaseVersion  string     `json:"base_version"`  // live config version the draft was forked from
	DraftVersion string     `json:"draft_version"` // bumped on every draft edit, CAS for edits/discard
	CreatedBy    string     `json:"created_by"`
	CreateTime   time.Time  `json:"create_time"`
	UpdatedBy    string     `json:"updated_by"`
	UpdateTime   time.Time  `json:"update_time"`
}

type ConfigHistoryEntry struct {
	VersionId  string    `json:"version_id"`
	UserId     string    `json:"user_id"`
	UpdateTime time.Time `json:"update_time"`
}

type ConfigResponse struct {
	DynamicConfig DynamicConfig `json:"dynamic_config"`
}

type ConfigUpdateMessage struct {
	MessageType string              `json:"message_type"`
	Payload     ConfigUpdatePayload `json:"payload"`
}

type ConfigUpdatePayload struct {
	ServerId ServerId `json:"server_id"`
}

type Container struct {
	// Health check related config
	HealthUrl                  string `toml:"health_url"`
	HealthAttemptsAfterStartup int    `toml:"health_attempts_after_startup"`
	HealthTimeoutSecs          int    `toml:"health_timeout_secs"`
	DeployProbePeriodSecs      int    `toml:"deploy_probe_period_secs"`
	DeployHealthAttempts       int    `toml:"deploy_health_attempts"`
	// Overrides Kubernetes progressDeadlineSeconds when >0. Keep 0 unless tests
	// or operators deliberately want failed rollouts to be declared earlier.
	DeployProgressDeadlineSecs int `toml:"deploy_progress_deadline_secs"`

	LogLinesToShow     int  `toml:"log_lines_to_show"`
	ShowLogsForFailure bool `toml:"show_logs_for_failure"`

	// Idle shutdown related config
	IdleShutdownSecs       int  `toml:"idle_shutdown_secs"`
	IdleShutdownDevApps    bool `toml:"idle_shutdown_dev_apps"`
	IdleBytesHighWatermark int  `toml:"idle_bytes_high_watermark"`

	// Status check related config
	StatusCheckIntervalSecs int `toml:"status_check_interval_secs"`
	StatusHealthAttempts    int `toml:"status_health_attempts"`
}

type ContextKey string

type CreateAppRequest struct {
	Path               string            `json:"path"`
	SourceUrl          string            `json:"source_url"`
	IsDev              bool              `json:"is_dev"`
	AppAuthn           AppAuthnType      `json:"app_authn"`
	GitBranch          string            `json:"git_branch"`
	GitCommit          string            `json:"git_commit"`
	GitAuthName        string            `json:"git_auth_name"`
	Spec               AppSpec           `json:"spec"`
	ParamValues        map[string]string `json:"param_values"`
	ContainerOptions   map[string]string `json:"container_options"`
	ContainerArgs      map[string]string `json:"container_args"`
	ContainerVolumes   []string          `json:"container_volumes"`
	AppConfig          map[string]string `json:"appconfig"`
	Bindings           []string          `json:"bindings"`
	BindingSourcePerms []string          `json:"binding_source_perms"`
	StageAt            string            `json:"stage_at"`
	Verify             bool              `json:"verify"`
}

type CreateBindingRequest struct {
	Path      string            `json:"path"`
	Source    string            `json:"source"`
	Grants    []string          `json:"grants"`
	Config    map[string]string `json:"config"`
	ApplyInfo []byte            `json:"-"`
}

type CreateSecretRequest struct {
	Name        string `json:"name"`
	Prefix      string `json:"prefix"`
	Value       string `json:"value"`
	Encoding    string `json:"encoding"` // "" for plain string, "base64" for binary values
	Description string `json:"description"`
	Provider    string `json:"provider"` // secret provider name, default "db"
	SourceFile  string `json:"source_file"`
}

type CustomPermsFunc func(ctx context.Context) ([]string, error)

type DryRun bool

type DynamicConfig struct {
	VersionId string     `json:"version_id"`
	RBAC      RBACConfig `json:"rbac"`

	// Entries holds the dynamically configured named entries: section name ->
	// entry name -> field values, mirroring the named-entry map sections of
	// openrun.toml ([git_auth.x], [auth.y], [saml.z], ...). Dynamic entries
	// take precedence over static entries with the same name. Unlike RBAC,
	// entry updates are not staged and take effect immediately
	Entries map[string]map[string]map[string]any `json:"entries,omitempty"`

	// Settings holds dynamically configured fields of the struct sections of
	// openrun.toml: section name -> dotted field key -> value (for example
	// security -> default_git_auth, app_config -> cors.allow_origin). A set
	// field takes precedence over the static config value. Like Entries,
	// settings updates are not staged and take effect immediately
	Settings map[string]map[string]any `json:"settings,omitempty"`
}

type EventStatus string

type EventType string

type ExportOptions struct {
	ServiceRef         string `json:"service_ref"`         // default: emit service type only; exact: emit type/name
	GitAuthRef         string `json:"git_auth_ref"`        // default: omit git_auth; exact: emit stored git auth name
	ExactCommit        bool   `json:"exact_commit"`        // pin git_commit to the currently deployed commit
	ExcludeDeclarative bool   `json:"exclude_declarative"` // skip apps and bindings already managed declaratively
}

type FS struct {
	FileAccess     []string `toml:"file_access"`
	RetainVersions int      `toml:"retain_versions"` // number of older versions to keep for each app
}

type ForwardConfig struct {
	AuthUrl             string   `toml:"auth_url"`              // the auth url to send the GET request to
	ForwardHeaders      []string `toml:"forward_headers"`       // the headers to forward to the auth url. If empty, all headers are forwarded.
	CopyResponseHeaders []string `toml:"copy_response_headers"` // the headers to copy from the authserver response to app. Default is none
}

type GitAuthEntry struct {
	UserID      string `toml:"user_id"`       // the user id of the user, defaults to "git" https://github.com/src-d/go-git/issues/637
	KeyFilePath string `toml:"key_file_path"` // the path to the private key file
	PrivateKey  string `toml:"private_key"`   // the private key contents (PEM), used instead of key_file_path; supports {{secret}} references
	Password    string `toml:"password"`      // the password for the private key file
}

type GlobalConfig struct {
	ConfigFile string `toml:"config_file"`
	AdminUser  string `toml:"admin_user"`
	ServerUri  string `toml:"server_uri"`
}

type GrantType string

type HttpConfig struct {
	Host            string `toml:"host"`
	Port            int    `toml:"port"`
	RedirectToHttps bool   `toml:"redirect_to_https"`
}

type HttpsConfig struct {
	Host               string `toml:"host"`
	Port               int    `toml:"port"`
	EnableCertLookup   bool   `toml:"enable_cert_lookup"`
	MkcertPath         string `toml:"mkcert_path"`
	ServiceEmail       string `toml:"service_email"`
	UseStaging         bool   `toml:"use_staging"`
	StorageLocation    string `toml:"storage_location"`
	CertLocation       string `toml:"cert_location"`
	DisableClientCerts bool   `toml:"disable_client_certs"`
}

type JSLibrary struct {
	LibType           LibraryType
	DirectUrl         string
	PackageName       string
	Version           string
	EsbuildArgs       [10]string // use an array so that the struct can be used as key in the jsCache map
	SanitizedFileName string
}

type Kubernetes struct {
	DefaultVolumeSize   string `toml:"default_volume_size"`
	ScalingThresholdCPU int32  `toml:"scaling_threshold_cpu"` // CPU utilization threshold for HPA scaling
}

type KubernetesConfig struct {
	Namespace   string `toml:"namespace"`
	UseNodePort bool   `toml:"use_node_port"` // Use NodePort mode instead of default ClusterIP mode

}

type LibraryType string

type LogConfig struct {
	Level         string `toml:"level"`
	MaxBackups    int    `toml:"max_backups"`
	MaxSizeMB     int    `toml:"max_size_mb"`
	Console       bool   `toml:"console"`
	File          bool   `toml:"file"`
	AccessLogging bool   `toml:"access_logging"`
}

type Logger struct {
	*zerolog.Logger
}

type MetadataConfig struct {
	DBConnection        string `toml:"db_connection"`
	AutoUpgrade         bool   `toml:"auto_upgrade"`
	AuditDBConnection   string `toml:"audit_db_connection"`
	IgnoreHigherVersion bool   `toml:"ignore_higher_version"` // If true, ignore higher version of the metadata schema
	FileCacheConnection string `toml:"file_cache_connection"` // The connection string for the file cache database

	// ConfigHistoryVersions is the number of dynamic config snapshots retained
	// in the config_history table. Every config change appends a snapshot
	ConfigHistoryVersions int `toml:"config_history_versions"`
}

type NodeConfig map[string]any

type NotificationMessage struct {
	MessageType string `json:"message_type"`
}

type Permission struct {
	Plugin    string   `json:"plugin" toml:"plugin"`
	Method    string   `json:"method" toml:"method"`
	Arguments []string `json:"arguments" toml:"arguments"`
	Permit    []string `json:"permit" toml:"permit"`                       // Custom RBAC permissions, any one of which allows the call.
	IsRead    *bool    `json:"is_read,omitempty" toml:"is_read,omitempty"` // Whether the call is a Read operation or Write operation.
	// nil value means go with the default as set in the plugin code
	Secrets [][]string `json:"secrets" toml:"secrets"` // The secrets that are allowed to be used in the call.
}

type PermissionsConfig struct {
	Allow              []Permission `toml:"allow"`                // the permissions that are allowed for all apps, without requiring explicit approval
	FullAccess         []string     `toml:"full_access"`          // the apps that have full access to all plugins
	BindingSourcePerms []string     `toml:"binding_source_perms"` // the binding sources that are allowed for all apps, without requiring explicit approval

}

type PluginContext struct {
	Logger    *Logger
	AppId     AppId
	StoreInfo *starlark_type.StoreInfo
	Config    PluginSettings
	AppConfig AppConfig
	AppPath   string
}

type PluginSettings map[string]any

type Proxy struct {
	// Proxy related config
	MaxIdleConns        int  `toml:"max_idle_conns"`
	IdleConnTimeoutSecs int  `toml:"idle_conn_timeout_secs"`
	DisableCompression  bool `toml:"disable_compression"`
	RewriteLocation     bool `toml:"rewrite_location"`
}

type RBACConfig struct {
	Enabled bool                        `json:"enabled"` // whether rbac is enabled
	Groups  map[string][]string         `json:"groups"`  // groups names to user ids. These groups are appended to the groups info from SAML
	Roles   map[string][]RBACPermission `json:"roles"`   // role names to permissions.
	Grants  []RBACGrant                 `json:"grants"`  // grants are used to grant permissions to users/groups for specific apps

	// ForceRBACWhenEnabled applies RBAC to every app when RBAC is enabled,
	// as if all app auth strings carried the rbac: prefix. When false, only
	// apps whose auth has the rbac: prefix are enforced (the pre-flag
	// behavior). A pointer so configs saved before this field keep the
	// default (true); use ForceRBAC() to read
	ForceRBACWhenEnabled *bool `json:"force_rbac_when_enabled,omitempty"`

	// OwnerPermissions overrides the default permissions granted to the creator of an
	// asset. Keys are resource names (app, sync); values are the permissions the owner
	// gets on assets they created. Missing key means the built-in default; an empty
	// list disables the owner rule for that resource. app:approve is not allowed.
	OwnerPermissions map[string][]RBACPermission `json:"owner_permissions,omitempty"`
}

type RBACGrant struct {
	Description string   `json:"description"`
	Users       []string `json:"users"`   // users/groups granted by this rule
	Roles       []string `json:"roles"`   // the roles granted by this rule
	Targets     []string `json:"targets"` // the app path globs for which this grant applies
}

type RBACPermission string

type RBACPermissionGroup struct {
	Resource    string           `json:"resource"`
	Permissions []RBACPermission `json:"permissions"`
}

type RegistryConfig struct {
	URL            string `toml:"url"`
	Project        string `toml:"project"`
	Type           string `toml:"type"` // "", "ecr"
	Username       string `toml:"username"`
	Password       string `toml:"password"`
	PasswordFile   string `toml:"password_file"`
	CAFile         string `toml:"ca_file"`
	ClientCertFile string `toml:"client_cert_file"`
	ClientKeyFile  string `toml:"client_key_file"`
	Insecure       bool   `toml:"insecure"`
	AWSRegion      string `toml:"aws_region"`
}

type RequestError struct {
	Message string `json:"message"`
	Code    int    `json:"code"`
}

type RunBindingCommandRequest struct {
	BindingName string `json:"binding_name"`
	UseStaging  bool   `json:"use_staging"`
	Command     string `json:"command"`
}

type SAMLConfig struct {
	MetadataURL string `toml:"metadata_url"`
	GroupsAttr  string `toml:"groups_attr"`
	UsePost     bool   `toml:"use_post"`     // whether to use POST binding
	ForceAuthn  bool   `toml:"force_authn"`  // whether to force authn
	SPKeyFile   string `toml:"sp_key_file"`  // the SP key file to use
	SPCertFile  string `toml:"sp_cert_file"` // the SP cert file to use
}

type SecretConfig map[string]any

type SecretCreateResponse struct {
	Name      string `json:"name"`
	Provider  string `json:"provider"`
	SecretRef string `json:"secret_ref"` // ready to use {{secret ...}} reference
	Updated   bool   `json:"updated"`    // true if an existing secret was updated
}

type SecretDeleteResponse struct {
	Name string `json:"name"`
}

type SecretEntry struct {
	Name       string
	Value      []byte
	Nonce      []byte
	KeyId      string
	CreatedBy  string
	CreateTime time.Time
	UpdateTime time.Time
	Metadata   SecretMetadata
}

type SecretGetResponse struct {
	SecretInfo
	Value    string `json:"value,omitempty"`
	Encoding string `json:"encoding,omitempty"`
}

type SecretInfo struct {
	Name        string    `json:"name"`
	KeyId       string    `json:"key_id"`
	CreatedBy   string    `json:"created_by"`
	CreateTime  time.Time `json:"create_time"`
	UpdateTime  time.Time `json:"update_time"`
	Description string    `json:"description"`
	SourceFile  string    `json:"source_file"`
}

type SecretListResponse struct {
	Secrets []SecretInfo `json:"secrets"`
}

type SecretMetadata struct {
	Description string `json:"description,omitempty"`
	SourceFile  string `json:"source_file,omitempty"` // original file name when created from a file
}

type SecretRekeyResponse struct {
	Rekeyed int `json:"rekeyed"`
	Skipped int `json:"skipped"`
}

type Security struct {
	DefaultSecretsProvider string `toml:"default_secrets_provider"`
	DisableCSRFProtection  bool   `toml:"disable_csrf_protection"`
	// HeadersLevel controls the set of security related HTTP response headers added to
	// app responses. Valid values are 0 to 10: 0 adds no extra headers and 10 adds the
	// strictest full set. Levels 0, 2, 5 and 10 are currently implemented; any other
	// value is rounded down to the nearest implemented level. Default is 2.
	HeadersLevel int `toml:"headers_level"`
}

type SecurityConfig struct {
	UnsafeAdminOverTCP       bool              `toml:"unsafe_admin_over_tcp"`
	AdminPasswordBcrypt      string            `toml:"admin_password_bcrypt"`
	AppDefaultAuthType       string            `toml:"app_default_auth_type"`
	AuthRequired             bool              `toml:"auth_required"`
	SessionMaxAge            int               `toml:"session_max_age"`
	SessionHttpsOnly         bool              `toml:"session_https_only"`
	TrustedProxies           []string          `toml:"trusted_proxies"`
	CallbackUrl              string            `toml:"callback_url"`
	DefaultGitAuth           string            `toml:"default_git_auth"`
	StageEnableWriteAccess   bool              `toml:"stage_enable_write_access"`
	PreviewEnableWriteAccess bool              `toml:"preview_enable_write_access"`
	AllowedContainerArgs     map[string]string `toml:"allowed_container_args"` // the container args that are allowed to be used in the app config
	AllowedMounts            []string          `toml:"allowed_mounts"`         // the volume mounts paths that are allowed to be used in the app config
}

type ServerConfig struct {
	GlobalConfig
	Http           HttpConfig                      `toml:"http"`
	Https          HttpsConfig                     `toml:"https"`
	Security       SecurityConfig                  `toml:"security"`
	Metadata       MetadataConfig                  `toml:"metadata"`
	Log            LogConfig                       `toml:"logging"`
	Telemetry      TelemetryConfig                 `toml:"telemetry"`
	System         SystemConfig                    `toml:"system"`
	Registry       RegistryConfig                  `toml:"registry"`
	Builder        BuilderConfig                   `toml:"builder"`
	Kubernetes     KubernetesConfig                `toml:"kubernetes"`
	GitAuth        map[string]GitAuthEntry         `toml:"git_auth"`
	Plugins        map[string]PluginSettings       `toml:"plugin"`
	Auth           map[string]AuthConfig           `toml:"auth"`
	SAML           map[string]SAMLConfig           `toml:"saml"`
	ClientAuth     map[string]ClientCertConfig     `toml:"client_auth"`
	Secret         map[string]SecretConfig         `toml:"secret"`
	Forward        map[string]ForwardConfig        `toml:"forward"`
	ProfileMode    string                          `toml:"profile_mode"`
	AppConfig      AppConfig                       `toml:"app_config"`
	NodeConfig     NodeConfig                      `toml:"node_config"`
	Permissions    PermissionsConfig               `toml:"permissions"`
	AppBuilder     AppBuilderConfig                `toml:"app_builder"`
	BuilderAgent   map[string]BuilderAgentConfig   `toml:"builder_agent"`
	BuilderPublish map[string]BuilderPublishConfig `toml:"builder_publish"`
	BuilderPrompt  map[string]BuilderPromptConfig  `toml:"builder_prompt"`
	BuilderGit     map[string]BuilderGitConfig     `toml:"builder_git"`
}

type ServerId string // the id of the server that sent the notification

type Service struct {
	Id          string            `json:"id"`
	Name        string            `json:"name"`
	ServiceType string            `json:"service_type"`
	IsDefault   bool              `json:"is_default"`
	Staging     string            `json:"staging"`
	Config      map[string]string `json:"config"`
	CreateTime  time.Time         `json:"create_time"`
	UpdateTime  time.Time         `json:"update_time"`
}

type SpecFiles map[string]string

type StringValue string

type StyleType string

type SyncCreateResponse struct {
	DryRun            bool          `json:"dry_run"`
	Id                string        `json:"id"`
	WebhookUrl        string        `json:"webhook_url"`
	WebhookSecret     string        `json:"webhook_secret"`
	ScheduleFrequency int           `json:"schedule_minutes"`
	SyncJobStatus     SyncJobStatus `json:"sync_job_status"`
}

type SyncDeleteResponse struct {
	DryRun bool   `json:"dry_run"`
	Id     string `json:"id"`
}

type SyncEntry struct {
	Id          string        `json:"id"`
	Path        string        `json:"path"`
	IsScheduled bool          `json:"is_scheduled"` // whether this is a scheduled sync
	UserID      string        `json:"user_id"`
	CreateTime  *time.Time    `json:"create_time"`
	Metadata    SyncMetadata  `json:"metadata"`
	Status      SyncJobStatus `json:"status"`
}

type SyncJobStatus struct {
	State             string           `json:"state"`               // the state of the sync job
	FailureCount      int              `json:"failure_count"`       // the number of times the sync job has failed recently
	LastExecutionTime time.Time        `json:"last_execution_time"` // the last time the sync job was executed
	Error             string           `json:"error"`               // the error message if the sync job failed
	CommitId          string           `json:"commit_id"`           // the commit id of the sync job
	IsApply           bool             `json:"is_apply"`            // whether this is an apply job
	ApplyResponse     AppApplyResponse `json:"app_apply_response"`  // the response of the apply job
}

type SyncListResponse struct {
	Entries []*SyncEntry `json:"entries"`
}

type SyncMetadata struct {
	GitBranch string `json:"git_branch"` // the git branch to sync from
	GitAuth   string `json:"git_auth"`   // the git auth entry to use for the sync

	Promote     bool   `json:"promote"`      // whether this sync does a promote
	Approve     bool   `json:"approve"`      // whether this sync does an approve
	Verify      bool   `json:"verify"`       // whether this sync verifies container reloads
	Reload      string `json:"reload"`       // which apps to reload after the sync
	Clobber     bool   `json:"clobber"`      // whether to force update the sync, overwriting non-declarative changes
	ForceReload bool   `json:"force_reload"` // whether to force reload even if there is no new commit

	WebhookUrl        string `json:"webhook_url"`        // for webhook : the url to use
	WebhookSecret     string `json:"webhook_secret"`     // for webhook : the secret to use
	ScheduleFrequency int    `json:"schedule_frequency"` // for scheduled: the frequency of the sync, every N minutes
}

type SystemConfig struct {
	TailwindCSSCommand                  string   `toml:"tailwindcss_command"`
	TailwindVersion                     int      `toml:"tailwind_version"`
	DaisyUIURL                          string   `toml:"daisyui_url"`       // url for the prebundled daisyui plugin, used with tailwind_version 4
	DaisyUIThemeURL                     string   `toml:"daisyui_theme_url"` // url for the prebundled daisyui theme plugin, used for custom themes
	FileWatcherDebounceMillis           int      `toml:"file_watcher_debounce_millis"`
	WatchIgnorePatterns                 []string `toml:"watch_ignore_patterns"`
	NodePath                            string   `toml:"node_path"`
	ContainerCommand                    string   `toml:"container_command"`
	StaleContainerCleanupIntervalMins   int      `toml:"stale_container_cleanup_interval_mins"` // Interval for stale OpenRun container cleanup. Set <=0 to disable.
	ContainerBuilder                    string   `toml:"container_builder"`
	DefaultDomain                       string   `toml:"default_domain"`
	RootServeListApps                   string   `toml:"root_serve_list_apps"`
	EnableCompression                   bool     `toml:"enable_compression"`
	HttpEventRetentionDays              int      `toml:"http_event_retention_days"`
	NonHttpEventRetentionDays           int      `toml:"non_http_event_retention_days"`
	AllowedEnv                          []string `toml:"allowed_env"`                             // List of environment variables that are allowed to be used in the node config
	DefaultScheduleMins                 int      `toml:"default_schedule_mins"`                   // Default schedule time in minutes for scheduled sync
	MaxSyncFailureCount                 int      `toml:"max_sync_failure_count"`                  // Max failure count for sync jobs
	MaxConcurrentBuilds                 int      `toml:"max_concurrent_builds"`                   // Max concurrent container builds
	MaxBuildWaitSecs                    int      `toml:"max_build_wait_secs"`                     // Max wait time for a build lock
	UseImagePreBuildStep                bool     `toml:"use_image_pre_build_step"`                // Pre-build container images for verified reloads before the metadata transaction starts
	EarlyHints                          bool     `toml:"early_hints"`                             // enable early hints for HTML responses
	LeaderElectionLeaseSecs             int      `toml:"leader_election_lease_secs"`              // The lease time for the leader election
	LeaderElectionHeartbeatIntervalSecs int      `toml:"leader_election_heartbeat_interval_secs"` // The interval for the leader election heartbeat
	FileWorkers                         int      `toml:"file_workers"`                            // number of parallel workers for file compression during app version creation
	ListAppsTitle                       string   `toml:"list_apps_title"`                         // the title of the list apps page
	ShowHostedWith                      bool     `toml:"show_hosted_with"`                        // whether to show "Hosted with OpenRun" in the list apps page
	FallbackUnknownDomains              bool     `toml:"fallback_unknown_domains"`                // whether to fallback to default domain for unknown domains
	ForwardAuthTimeoutSecs              int      `toml:"forward_auth_timeout_secs"`               // timeout in seconds for forward auth requests. Defaults to 30 seconds.
	BuilderAuthToken                    string   `toml:"builder_auth_token"`                      // the token for the builder auth
	// StageAt is the default staging mode for new prod apps. "domain" stages at domain level,
	// "path" stages at path level, and any other value is treated as the staging domain.
	// Defaults to "domain".
	StageAt            string `toml:"stage_at"`
	DefaultStageDomain string `toml:"default_stage_domain"`
}

type TelemetryConfig struct {
	Enabled     bool              `toml:"enabled"`
	ServiceName string            `toml:"service_name"`
	Environment string            `toml:"environment"`
	Endpoint    string            `toml:"endpoint"`
	Headers     map[string]string `toml:"headers"`
	Traces      bool              `toml:"traces"`
	Metrics     bool              `toml:"metrics"`
	// PluginSpans, when true, creates a span around each Starlark plugin
	// invocation. Off by default because data-heavy apps may issue many
	// plugin calls per request.
	PluginSpans bool `toml:"plugin_spans"`
}

type TokenCreateResponse struct {
	DryRun bool     `json:"dry_run"`
	Token  AppToken `json:"token"`
}

type TokenDeleteResponse struct {
	DryRun bool `json:"dry_run"`
}

type TokenListResponse struct {
	Tokens []AppToken `json:"tokens"`
}

type Transaction struct {
	*sql.Tx
}

type UpdateAppMetadataRequest struct {
	Spec          StringValue           `json:"spec"`
	ConfigType    AppMetadataConfigType `json:"config_type"`
	ConfigEntries []string              `json:"config_entries"`
}

type UpdateAppRequest struct {
	AuthnType          StringValue `json:"authn_type"`
	GitAuthName        StringValue `json:"git_auth_name"`
	StageWriteAccess   BoolValue   `json:"stage_write_access"`
	PreviewWriteAccess BoolValue   `json:"preview_write_access"`
	Spec               StringValue `json:"spec"`
}

type UpdateBindingRequest struct {
	Path         string   `json:"path"`
	AddGrants    []string `json:"add_grants"`
	DeleteGrants []string `json:"delete_grants"`
}

type UserFile struct {
	Id           string
	AppId        string
	FilePath     string
	FileName     string
	MimeType     string
	CreateTime   time.Time
	ExpireAt     time.Time
	CreatedBy    string
	SingleAccess bool
	Visibility   string
	Metadata     map[string]any
}

type VersionMetadata struct {
	Version         int    `json:"version"`
	PreviousVersion int    `json:"previous_version"`
	GitBranch       string `json:"git_branch"`
	GitCommit       string `json:"git_commit"`
	GitMessage      string `json:"git_message"`
	ApplyInfo       []byte `json:"apply_info"`
	AppliedSyncId   string `json:"applied_sync_id"`
}

type WebhookTokens struct {
	Reload        string `json:"reload"`
	ReloadPromote string `json:"reload_promote"`
	Promote       string `json:"promote"`
}

type WebhookType string