config

type Config struct {
	LogLevel string `cfg:"log_level" default:"info"`

	// Connections are the named connection profiles, keyed by name.
	Connections map[string]Connection `cfg:"connections"`

	// Pool is the default pool configuration for every connection. A
	// connection's own pool block overrides it field by field.
	Pool Pool `cfg:"pool"`

	Server Server `cfg:"server"`
	MCP    MCP    `cfg:"mcp"`
}

type Connection struct {
	// Disabled keeps a profile in configuration without exposing or connecting it.
	Disabled bool `cfg:"disabled"`
	// Type is the driver name: pgx, odbc, godror, sqlite3 or sqlserver.
	Type string `cfg:"type"`
	// Dialect selects database-specific catalog queries when the driver is
	// generic, for example "ingres" for an Ingres ODBC connection.
	Dialect string `cfg:"dialect"`
	// Source is the DSN. Masked in logs because it usually carries a password.
	Source string `cfg:"source" log:"-"`
	// Description is free-form text surfaced to MCP clients to help an agent
	// pick the right database.
	Description string `cfg:"description"`
	// Permission caps what may be run against this connection:
	// read-only, safe-write or full. Defaults to read-only.
	Permission string `cfg:"permission"`
	// Pool overrides the global pool settings for this connection only.
	Pool Pool `cfg:"pool"`
}

type Endpoint struct {
	Path       string   `cfg:"path"`
	Permission string   `cfg:"permission"`
	Allow      []string `cfg:"allow"`
	// Export exposes dbq_export on this endpoint when MCP export is globally enabled.
	Export bool `cfg:"export"`
}

type MCP struct {
	// Enabled turns MCP serving on. When false no endpoint is mounted.
	Enabled bool `cfg:"enabled" default:"true"`
	// Endpoints are independently configured MCP paths. Each endpoint applies a
	// permission ceiling and may restrict which connections it exposes.
	Endpoints []Endpoint `cfg:"endpoints"`
	// MaxRows caps rows returned by a single MCP tool call.
	MaxRows int `cfg:"max_rows" default:"200"`
	// MaxSchemaTables caps how many tables dbq_schema_context describes in one call.
	MaxSchemaTables int `cfg:"max_schema_tables" default:"40"`
	// MaxCellChars caps the characters returned for one text value. A row cap
	// alone does not bound a response: a single TEXT column can hold megabytes.
	MaxCellChars int `cfg:"max_cell_chars" default:"500"`
	// QueryTimeout bounds a single MCP statement, so an agent-issued cartesian
	// join cannot pin a connection until the client gives up.
	// It sits below the request timeout most MCP clients use, so a runaway
	// query surfaces as dbq's own actionable error rather than a generic
	// client-side give-up.
	QueryTimeout time.Duration `cfg:"query_timeout" default:"30s"`
	// ExportEnabled explicitly enables bulk query exports and their download route.
	ExportEnabled bool `cfg:"export_enabled"`
	// ExportDir stores short-lived SQL export artifacts. Empty uses a private
	// process-specific temporary directory.
	ExportDir string `cfg:"export_dir"`
	// ExportTTL controls how long generated download links remain valid.
	ExportTTL time.Duration `cfg:"export_ttl" default:"15m"`
	// MaxExportRows and MaxExportBytes bound one generated artifact.
	MaxExportRows  int   `cfg:"max_export_rows" default:"100000"`
	MaxExportBytes int64 `cfg:"max_export_bytes" default:"104857600"`
	// MaxTotalExportBytes, MaxExportFiles and MaxConcurrentExports bound aggregate use.
	MaxTotalExportBytes  int64 `cfg:"max_total_export_bytes" default:"524288000"`
	MaxExportFiles       int   `cfg:"max_export_files" default:"100"`
	MaxConcurrentExports int   `cfg:"max_concurrent_exports" default:"2"`
	// PublicBaseURL makes export links absolute when dbq is behind a proxy.
	// Empty returns a root-relative download URL.
	PublicBaseURL string `cfg:"public_base_url"`
	// AllowedOrigins permits browser MCP clients from these exact origins.
	// Same-origin and non-browser requests are accepted without entries.
	AllowedOrigins []string `cfg:"allowed_origins"`
	// Stateless runs the MCP handler without session state.
	//
	// It defaults on because it describes what dbq actually is: every tool call
	// resolves a connection, authorizes a statement and returns: nothing is
	// carried between calls. Keeping sessions would only add a failure mode —
	// a request that lands on another replica, or arrives after a restart, is
	// rejected with "session not found" — while buying nothing.
	//
	// Turn it off only for a client that requires the session handshake. Doing
	// so is also a prerequisite for any future server-to-client interaction
	// (elicitation, sampling), which a stateless server rejects outright.
	Stateless bool `cfg:"stateless" default:"true"`
	// JSONResponse returns application/json instead of text/event-stream.
	JSONResponse bool `cfg:"json_response"`
	// SessionTimeout closes idle MCP sessions. Zero means never.
	// Ignored when Stateless is set, because there are no sessions to expire.
	SessionTimeout time.Duration `cfg:"session_timeout" default:"30m"`
}

type Pool struct {
	// MaxOpen caps open connections, idle or in use.
	MaxOpen int `cfg:"max_open"`
	// MaxIdle caps idle connections kept for reuse.
	MaxIdle int `cfg:"max_idle"`
	// MaxLifetime retires a connection after this long.
	MaxLifetime time.Duration `cfg:"max_lifetime"`
	// MaxIdleTime closes a connection idle for this long.
	MaxIdleTime time.Duration `cfg:"max_idle_time"`
}

type ResolvedEndpoint struct {
	Permission database.Permission
	Path       string
	Allow      []string
	Export     bool
}

type Server struct {
	Host                   string        `cfg:"host" default:"0.0.0.0"`
	Port                   string        `cfg:"port" default:"8080"`
	ShutdownTimeout        time.Duration `cfg:"shutdown_timeout" default:"10s"`
	ConnectionCheckTimeout time.Duration `cfg:"connection_check_timeout" default:"10s"`
}