redis

type Config struct {
	// Addr is the Redis server address (host:port) for standalone or cluster
	// modes. Mutually exclusive with SentinelConfig.
	Addr string

	// ClusterMode enables the Redis Cluster protocol. Requires Addr. Cluster
	// mode ignores DB because Redis Cluster only supports database 0.
	ClusterMode bool

	// SentinelConfig activates Sentinel failover mode. Mutually exclusive
	// with Addr.
	SentinelConfig *SentinelConfig

	// Username is the optional ACL username (Redis 6.0+). When empty, auth
	// falls back to legacy AUTH using only Password.
	//
	// When DynamicAuth is set, whether Username is required depends on the
	// backend: AWS ElastiCache/MemoryDB IAM and Azure Entra ID require it (the
	// IAM user / principal object ID that minted tokens authenticate as); GCP
	// Memorystore IAM authentication is token-only and rejects a username, so
	// Username must be left empty for that backend.
	Username string

	// Password is the AUTH/ACL password. May be empty when the server does
	// not require authentication. Mutually exclusive with DynamicAuth.
	Password string //nolint:gosec // G101: field name, not a hardcoded credential

	// DynamicAuth, when non-nil, mints short-lived AUTH credentials from a
	// cloud IAM backend instead of using a static Password. NewClient
	// installs an Options.CredentialsProviderContext hook that resolves
	// fresh credentials for each connection attempt — during go-redis's
	// handshake, before RESP3 negotiation and DB selection — and sets
	// ConnMaxLifetime (when Config's own ConnMaxLifetime is zero) to a value
	// inside the backend's token TTL so pooled connections are periodically
	// retired and redialed with current credentials.
	//
	// Dynamic authentication requires a verified TLS connection (Config.TLS
	// set, with InsecureSkipVerify false): cloud IAM tokens are bearer
	// credentials, and sending them over an unverified or plaintext
	// connection lets a network attacker capture and replay them. Set
	// DynamicAuthConfig.AllowInsecureTransport to opt out for trusted local
	// tunneling (for example, a sidecar-terminated mTLS tunnel where this
	// package's own TLS handshake would be redundant).
	DynamicAuth *DynamicAuthConfig

	// DB is the Redis database index. Applies to standalone and sentinel
	// modes; ignored in cluster mode.
	DB int

	// DialTimeout is the timeout for establishing a connection. When zero,
	// DefaultDialTimeout is used.
	DialTimeout time.Duration

	// ReadTimeout is the timeout for socket reads. When zero,
	// DefaultReadTimeout is used.
	ReadTimeout time.Duration

	// WriteTimeout is the timeout for socket writes. When zero,
	// DefaultWriteTimeout is used.
	WriteTimeout time.Duration

	// TLS configures TLS for master/cluster connections. When nil, those
	// connections are plaintext.
	TLS *TLSConfig

	// SentinelTLS configures TLS for sentinel daemon connections. Only
	// applies when SentinelConfig is set. When nil, sentinel connections are
	// plaintext (independent of TLS).
	SentinelTLS *TLSConfig

	// ConnMaxLifetime is the maximum amount of time a connection may be
	// reused before go-redis retires and redials it. When zero and
	// DynamicAuth is set, a backend-specific default inside the token's TTL
	// is used instead of go-redis's own default. Ignored (left at go-redis's
	// default) when DynamicAuth is nil and this is zero.
	ConnMaxLifetime time.Duration
}

type CredentialsFunc func(ctx context.Context) (username, password string, err error)

type DynamicAuthAWSElastiCacheIAM struct {
	// Region is the AWS region used to sign IAM tokens. Use "detect" to
	// auto-discover the region from the EC2 instance metadata service (IMDS).
	Region string

	// ClusterName is the ElastiCache replication group ID / cache name, or
	// the MemoryDB cluster name, that the presigned token is scoped to.
	ClusterName string

	// ServiceName is the SigV4 signing service name. Must be empty (the
	// default, treated as "elasticache") or "memorydb".
	ServiceName string

	// ResourceType selects the AWS-required resource-type query parameter
	// for serverless caches. Must be empty (the default, for provisioned
	// ElastiCache/MemoryDB clusters) or "ServerlessCache" (for ElastiCache
	// Serverless / MemoryDB Serverless).
	ResourceType string
}

type DynamicAuthAzureAD struct{}

type DynamicAuthConfig struct {
	// AWSElastiCacheIAM enables AWS ElastiCache/MemoryDB IAM authentication
	// tokens.
	AWSElastiCacheIAM *DynamicAuthAWSElastiCacheIAM

	// AzureAD enables Azure Entra ID (formerly Azure AD) authentication
	// tokens for Azure Cache for Redis.
	AzureAD *DynamicAuthAzureAD

	// GCPMemorystoreIAM enables GCP Memorystore for Redis Cluster IAM
	// authentication tokens.
	GCPMemorystoreIAM *DynamicAuthGCPMemorystoreIAM

	// AllowInsecureTransport opts out of the requirement that Config.TLS be
	// set (with verification enabled) when DynamicAuth is configured. Leave
	// false unless a trusted local tunnel already provides transport
	// security outside this package's own TLS handling.
	AllowInsecureTransport bool
}

type DynamicAuthGCPMemorystoreIAM struct{}

type SentinelConfig struct {
	// MasterName is the logical name of the monitored master, as configured
	// on the sentinel daemons.
	MasterName string

	// SentinelAddrs is the list of sentinel daemon addresses (host:port).
	SentinelAddrs []string
}

type TLSConfig struct {
	// InsecureSkipVerify disables certificate verification. Intended for
	// self-signed development setups; never use in production.
	InsecureSkipVerify bool

	// CACert is the PEM-encoded CA bundle used to verify the server. When
	// nil, system root CAs are used.
	CACert []byte

	// ClientCert and ClientKey are a PEM-encoded client certificate/key pair
	// presented to the server for mutual TLS. Both fields must be set together.
	ClientCert []byte
	ClientKey  []byte
}