config

type APIConfig struct {
	// Endpoint is the base API URL (without path)
	// The registry handler will append the appropriate paths for the MCP Registry API v0.1:
	//   - /v0.1/servers - List all servers
	//   - /v0.1/servers/{name}/versions - List server versions
	//   - /v0.1/servers/{name}/versions/{version} - Get specific version
	// Example: "http://my-registry-api.default.svc.cluster.local/registry"
	Endpoint string `yaml:"endpoint" json:"endpoint"`
}

type AuthConfig struct {
	// Mode specifies the authentication mode (anonymous or oauth)
	// Defaults to "oauth" if not specified (security-by-default).
	// Use "anonymous" to explicitly disable authentication for development.
	Mode AuthMode `yaml:"mode,omitempty"`

	// PublicPaths defines additional paths that bypass authentication
	// These extend the default public paths (health, docs, swagger, well-known)
	// Example: ["/custom/public", "/metrics"]
	PublicPaths []string `yaml:"publicPaths,omitempty"`

	// OAuth contains OAuth/OIDC specific configuration
	// Required when Mode is "oauth"
	OAuth *OAuthConfig `yaml:"oauth,omitempty"`
}

type AuthMode string

type Config struct {
	// RegistryName is the name/identifier for this registry instance
	// Defaults to "default" if not specified
	RegistryName string             `yaml:"registryName,omitempty"`
	Registries   []RegistryConfig   `yaml:"registries"`
	Database     *DatabaseConfig    `yaml:"database,omitempty"`
	FileStorage  *FileStorageConfig `yaml:"fileStorage,omitempty"`
	Auth         *AuthConfig        `yaml:"auth,omitempty"`
	// contains filtered or unexported fields
}

type DatabaseConfig struct {
	// Host is the database server hostname or IP address
	Host string `yaml:"host"`

	// Port is the database server port
	Port int `yaml:"port"`

	// User is the database username for normal operations (SELECT, INSERT, UPDATE, DELETE)
	User string `yaml:"user"`

	// MigrationUser is the database username for schema migrations (optional)
	// This user typically has elevated privileges (CREATE, ALTER, DROP)
	// If not specified, defaults to User for backward compatibility
	MigrationUser string `yaml:"migrationUser,omitempty"`

	// Database is the database name
	Database string `yaml:"database"`

	// SSLMode is the SSL mode for the connection (disable, require, verify-ca, verify-full)
	SSLMode string `yaml:"sslMode,omitempty"`

	// MaxOpenConns is the maximum number of open connections to the database
	MaxOpenConns int32 `yaml:"maxOpenConns,omitempty"`

	// MaxIdleConns is the maximum number of idle connections in the pool
	MaxIdleConns int32 `yaml:"maxIdleConns,omitempty"`

	// ConnMaxLifetime is the maximum lifetime of a connection (e.g., "1h", "30m")
	ConnMaxLifetime string `yaml:"connMaxLifetime,omitempty"`
}

type FileConfig struct {
	// Path is the path to the registry.json file on the local filesystem
	// Can be absolute or relative to the working directory
	// Mutually exclusive with URL and Data - exactly one must be specified
	Path string `yaml:"path,omitempty" json:"path,omitempty"`

	// URL is the HTTP/HTTPS URL to fetch the registry file from
	// Mutually exclusive with Path and Data - exactly one must be specified
	// HTTPS is required unless the host is localhost or THV_REGISTRY_INSECURE_URL=true
	URL string `yaml:"url,omitempty" json:"url,omitempty"`

	// Data is the inline registry data as a JSON string
	// Mutually exclusive with Path and URL - exactly one must be specified
	// Useful for API-created registries where the data is provided directly
	Data string `yaml:"data,omitempty" json:"data,omitempty"`

	// Timeout is the timeout for HTTP requests when using URL
	// Defaults to 30s if not specified
	// Only applicable when URL is set
	Timeout string `yaml:"timeout,omitempty" json:"timeout,omitempty"`
}

type FileStorageConfig struct {
	// BaseDir is the base directory for file storage
	// Defaults to "./data" if not specified
	BaseDir string `yaml:"baseDir,omitempty"`
}

type FilterConfig struct {
	Names *NameFilterConfig `yaml:"names,omitempty" json:"names,omitempty"`
	Tags  *TagFilterConfig  `yaml:"tags,omitempty" json:"tags,omitempty"`
}

type GitConfig struct {
	// Repository is the Git repository URL (HTTP/HTTPS/SSH)
	Repository string `yaml:"repository" json:"repository"`

	// Branch is the Git branch to use (mutually exclusive with Tag and Commit)
	Branch string `yaml:"branch,omitempty" json:"branch,omitempty"`

	// Tag is the Git tag to use (mutually exclusive with Branch and Commit)
	Tag string `yaml:"tag,omitempty" json:"tag,omitempty"`

	// Commit is the Git commit SHA to use (mutually exclusive with Branch and Tag)
	Commit string `yaml:"commit,omitempty" json:"commit,omitempty"`

	// Path is the path to the registry file within the repository
	Path string `yaml:"path,omitempty" json:"path,omitempty"`
}

type KubernetesConfig struct{}

type ManagedConfig struct {
}

type NameFilterConfig struct {
	Include []string `yaml:"include,omitempty" json:"include,omitempty"`
	Exclude []string `yaml:"exclude,omitempty" json:"exclude,omitempty"`
}

type OAuthConfig struct {
	// ResourceURL is the URL identifying this protected resource (RFC 9728)
	// Used in the /.well-known/oauth-protected-resource endpoint
	ResourceURL string `yaml:"resourceUrl,omitempty"`

	// Providers defines the OAuth/OIDC providers for authentication
	// Multiple providers can be configured (e.g., Kubernetes + external IDP)
	Providers []OAuthProviderConfig `yaml:"providers,omitempty"`

	// ScopesSupported defines the OAuth scopes supported by this resource (RFC 9728)
	// Defaults to ["mcp-registry:read", "mcp-registry:write"] if not specified
	ScopesSupported []string `yaml:"scopesSupported,omitempty"`

	// Realm is the protection space identifier for WWW-Authenticate header (RFC 7235)
	// Defaults to "mcp-registry" if not specified
	Realm string `yaml:"realm,omitempty"`
}

type OAuthProviderConfig struct {
	// Name is a unique identifier for this provider (e.g., "kubernetes", "keycloak")
	Name string `yaml:"name"`

	// IssuerURL is the OIDC issuer URL (e.g., https://accounts.google.com)
	// The JWKS URL will be discovered automatically from .well-known/openid-configuration
	// unless JwksUrl is explicitly specified
	IssuerURL string `yaml:"issuerUrl"`

	// JwksUrl is the URL to fetch the JSON Web Key Set (JWKS) from
	// If specified, OIDC discovery is skipped and this URL is used directly
	// Example: https://kubernetes.default.svc/openid/v1/jwks
	JwksUrl string `yaml:"jwksUrl,omitempty"`

	// Audience is the expected audience claim in the token (REQUIRED)
	// Per RFC 6749 Section 4.1.3, tokens must be validated against expected audience
	// For Kubernetes, this is typically the API server URL
	Audience string `yaml:"audience"`

	// ClientID is the OAuth client ID for token introspection (optional)
	ClientID string `yaml:"clientId,omitempty"`

	// ClientSecretFile is the path to a file containing the client secret
	// The file should contain only the secret with optional trailing whitespace
	ClientSecretFile string `yaml:"clientSecretFile,omitempty"`

	// CACertPath is the path to a CA certificate bundle for verifying the provider's TLS certificate
	// Required for Kubernetes in-cluster authentication or self-signed certificates
	CACertPath string `yaml:"caCertPath,omitempty"`

	// AuthTokenFile is the path to a file containing a bearer token for authenticating to OIDC/JWKS endpoints
	// Useful when the OIDC discovery or JWKS endpoint requires authentication
	// Example: /var/run/secrets/kubernetes.io/serviceaccount/token
	AuthTokenFile string `yaml:"authTokenFile,omitempty"`

	// IntrospectionURL is the OAuth 2.0 Token Introspection endpoint (RFC 7662)
	// Used for validating opaque (non-JWT) tokens
	// If not specified, only JWT tokens can be validated via JWKS
	IntrospectionURL string `yaml:"introspectionUrl,omitempty"`

	// AllowPrivateIP allows JWKS/OIDC endpoints on private IP addresses
	// Required when the OAuth provider (e.g., Kubernetes API server) is running on a private network
	// Example: Set to true when using https://kubernetes.default.svc as the issuer URL
	AllowPrivateIP bool `yaml:"allowPrivateIP,omitempty"`
}

type Option func(*loaderConfig) error

type RegistryConfig struct {
	// Name is the identifier for this registry
	Name string `yaml:"name"`

	// Format specifies the data format (toolhive or upstream)
	Format string `yaml:"format"`

	// Type-specific configurations (only one should be set)
	Git        *GitConfig        `yaml:"git,omitempty"`
	API        *APIConfig        `yaml:"api,omitempty"`
	File       *FileConfig       `yaml:"file,omitempty"`
	Managed    *ManagedConfig    `yaml:"managed,omitempty"`
	Kubernetes *KubernetesConfig `yaml:"kubernetes,omitempty"`

	// Per-registry sync policy
	// Note: Not applicable for non-synced registries (managed and kubernetes) - will be ignored if set
	SyncPolicy *SyncPolicyConfig `yaml:"syncPolicy,omitempty"`

	// Per-registry filtering rules
	// Note: Not applicable for non-synced registries (managed and kubernetes) - will be ignored if set
	Filter *FilterConfig `yaml:"filter,omitempty"`
}

type SourceType string

type StorageType string

type SyncPolicyConfig struct {
	Interval string `yaml:"interval" json:"interval"`
}

type TagFilterConfig struct {
	Include []string `yaml:"include,omitempty" json:"include,omitempty"`
	Exclude []string `yaml:"exclude,omitempty" json:"exclude,omitempty"`
}