server

type AccountPool struct {
	// contains filtered or unexported fields
}

type AuthedCaller struct {
	UserID  uuid.UUID  // set on OAuth path; uuid.Nil on API-key path (V1 keys aren't user-scoped)
	APIKey  *db.APIKey // populated when authed via api_keys
	TokenID *uuid.UUID // populated when authed via oauth_tokens
}

type Config struct {
	DBURL         string
	HTTPAddr      string
	NATSAddr      string
	NATSPublicURL string // returned to clients in /auth/exchange; defaults to ns.ClientURL()
	SeedDir       string

	// SessionKey is the HMAC key used to sign session cookies. Read
	// from PPZ_SESSION_KEY at boot. 32+ bytes recommended.
	SessionKey []byte

	// BaseURL is what the server thinks its own external URL is —
	// used to construct OAuth redirect_uri. e.g.,
	// "https://pipescloud.io" or "http://localhost:8080".
	BaseURL string

	// GitHub OAuth config. Real values come from .env.local (dev) or
	// AWS Secrets Manager (prod). The three URL fields default to
	// real-GitHub if empty; the e2e stack overrides them to point at
	// the mock-github container.
	GitHubClientID     string
	GitHubClientSecret string
	GitHubAuthorizeURL string
	GitHubTokenURL     string
	GitHubUserURL      string

	// DevLogin enables POST /dev/login?user=<seed-user> for tests.
	// MUST be false in production.
	DevLogin bool

	// Auth V2 §Phase 3.5 — NSC/JWT decentralized NATS auth.
	// Operator seed is the runtime secret (signs new per-org
	// Account JWTs as orgs are provisioned). Operator JWT is
	// public — declares the operator's existence to the embedded
	// NATS server. System Account JWT lives in /sys for JetStream.
	NATSOperatorSeed     string
	NATSOperatorJWT      string
	NATSSystemAccountJWT string
}

type OAuthState struct {
	Nonce string
	Next  string
}

type OrgAccount struct {
	OrgID      uuid.UUID
	OrgName    string
	AccountPub string

	// SigningKP is loaded from the per-org signing seed on first
	// access; used to mint per-(user, org) JWTs in /auth/exchange.
	SigningKP nkeys.KeyPair

	// NC is the in-process server-user connection — broad pub/sub
	// in this account. Used by handlers for JetStream management
	// and by the broadcast-subscriber.
	NC *nats.Conn
	JS jetstream.JetStream
	// contains filtered or unexported fields
}

type OrgRole string

type Server struct {
	Pool       *db.Pool
	NATSURL    string
	SessionKey SessionKey

	// Phase 3.5 — per-org account pool. Lazily provisions an
	// Operator-signed Account JWT per org on first use, opens a
	// per-account in-process connection, registers the JWT with
	// the live resolver. AccountPool.Get(orgID) is the path to
	// per-org NATS state. (No legacy single-account fallback —
	// every NATS operation routes through the pool.)
	AccountPool   *AccountPool
	OperatorKP    nkeys.KeyPair              // hot at runtime; signs new Account JWTs
	NATSResolver  natsserver.AccountResolver // for runtime account JWT registration
	NATSClientURL string                     // for AccountPool.openAccount

	BaseURL            string
	GitHubClientID     string
	GitHubClientSecret string
	GitHubAuthorizeURL string
	GitHubTokenURL     string
	GitHubUserURL      string
	DevLogin           bool
}

type SessionKey []byte

type SessionPayload struct {
	UserID    uuid.UUID
	ExpiresAt time.Time
}