config

type APIConfig struct {
	// Endpoint is the base API URL (without path)
	// The source handler will append the appropriate paths, for instance:
	//   - /v0/servers - List all servers (single response, no pagination)
	//   - /v0/servers/{name} - Get specific server (future)
	//   - /v0/info - Get registry metadata (future)
	// Example: "http://my-registry-api.default.svc.cluster.local/api"
	Endpoint string `yaml:"endpoint"`
}

type AuthConfig struct {
	// Mode specifies the authentication mode (anonymous or oauth)
	// Defaults to "oauth" if not specified (security-by-default).
	// Use "anonymous" to explicitly disable authentication for development.
	Mode AuthMode `yaml:"mode,omitempty"`

	// PublicPaths defines additional paths that bypass authentication
	PublicPaths []string `yaml:"publicPaths,omitempty"`

	// OAuth defines OAuth/OIDC specific authentication settings
	// Only used when Mode is "oauth"
	OAuth *OAuthConfig `yaml:"oauth,omitempty"`

	// Authz defines authorization configuration for role-based access control
	Authz *AuthzConfig `yaml:"authz,omitempty"`
}

type AuthMode string

type AuthzConfig struct {
	Roles RolesConfig `yaml:"roles,omitempty"`
}

type Config struct {
	Sources    []SourceConfig   `yaml:"sources"`
	Registries []RegistryConfig `yaml:"registries,omitempty"`
	Database   *DatabaseConfig  `yaml:"database,omitempty"`
	Auth       *AuthConfig      `yaml:"auth,omitempty"`
	Telemetry  *TelemetryConfig `yaml:"telemetry,omitempty"`
}

type ConfigManager interface {
	BuildConfig() (*Config, error)
	GetRegistryServerConfigMapName() string
}

type DatabaseConfig struct {
	// Host is the database server hostname
	Host string `yaml:"host"`

	// Port is the database server port
	Port int32 `yaml:"port"`

	// User is the application user (limited privileges: SELECT, INSERT, UPDATE, DELETE)
	// Credentials provided via pgpass file
	User string `yaml:"user"`

	// MigrationUser is the migration user (elevated privileges: CREATE, ALTER, DROP)
	// Used for running database schema migrations
	// Credentials provided via pgpass file
	MigrationUser string `yaml:"migrationUser"`

	// Database is the database name
	Database string `yaml:"database"`

	// SSLMode is the SSL mode for the connection
	SSLMode string `yaml:"sslMode"`

	// MaxOpenConns is the maximum number of open connections to the database
	MaxOpenConns int32 `yaml:"maxOpenConns"`

	// MaxIdleConns is the maximum number of idle connections in the pool
	MaxIdleConns int32 `yaml:"maxIdleConns"`

	// ConnMaxLifetime is the maximum amount of time a connection may be reused
	ConnMaxLifetime string `yaml:"connMaxLifetime"`

	// MaxMetaSize is the maximum allowed size in bytes for publisher-provided metadata extensions
	MaxMetaSize *int32 `yaml:"maxMetaSize,omitempty"`

	// DynamicAuth defines dynamic database authentication configuration
	DynamicAuth *DynamicAuthConfig `yaml:"dynamicAuth,omitempty"`
}

type DynamicAuthAWSRDSIAM struct {
	Region string `yaml:"region,omitempty"`
}

type DynamicAuthConfig struct {
	AWSRDSIAM *DynamicAuthAWSRDSIAM `yaml:"awsRdsIam,omitempty"`
}

type FileConfig struct {
	// Path is the path to the registry.json file on the local filesystem
	// Can be absolute or relative to the working directory
	Path string `yaml:"path,omitempty"`

	// URL is the HTTP/HTTPS URL to fetch the registry file from
	URL string `yaml:"url,omitempty"`

	// Data is the inline registry data as a JSON string
	Data string `yaml:"data,omitempty"`

	// Timeout is the timeout for HTTP requests when using URL
	Timeout string `yaml:"timeout,omitempty"`
}

type FilterConfig struct {
	Names *NameFilterConfig `yaml:"names,omitempty"`
	Tags  *TagFilterConfig  `yaml:"tags,omitempty"`
}

type GitAuthConfig struct {
	// Username is the Git username for HTTP Basic authentication
	Username string `yaml:"username,omitempty"`

	// PasswordFile is the path to a file containing the Git password/token
	PasswordFile string `yaml:"passwordFile,omitempty"`
}

type GitConfig struct {
	// Repository is the Git repository URL (HTTP/HTTPS/SSH)
	Repository string `yaml:"repository"`

	// Branch is the Git branch to use (mutually exclusive with Tag and Commit)
	Branch string `yaml:"branch,omitempty"`

	// Tag is the Git tag to use (mutually exclusive with Branch and Commit)
	Tag string `yaml:"tag,omitempty"`

	// Commit is the Git commit SHA to use (mutually exclusive with Branch and Tag)
	Commit string `yaml:"commit,omitempty"`

	// Path is the path to the registry file within the repository
	Path string `yaml:"path,omitempty"`

	// Auth contains optional authentication for private repositories
	Auth *GitAuthConfig `yaml:"auth,omitempty"`
}

type KubernetesConfig struct {
	// Namespaces is a list of Kubernetes namespaces to watch for MCP servers.
	// If empty, watches the operator's configured namespace.
	Namespaces []string `yaml:"namespaces,omitempty"`
}

type ManagedConfig struct{}

type MetricsConfig struct {
	Enabled bool `yaml:"enabled"`
}

type NameFilterConfig struct {
	Include []string `yaml:"include,omitempty"`
	Exclude []string `yaml:"exclude,omitempty"`
}

type OAuthConfig struct {
	// ResourceURL is the URL identifying this protected resource (RFC 9728)
	// Used in the /.well-known/oauth-protected-resource endpoint
	ResourceURL string `yaml:"resourceUrl,omitempty"`

	// Providers defines the OAuth/OIDC providers for authentication
	// Multiple providers can be configured (e.g., Kubernetes + external IDP)
	Providers []OAuthProviderConfig `yaml:"providers,omitempty"`

	// ScopesSupported defines the OAuth scopes supported by this resource (RFC 9728)
	// Defaults to ["mcp-registry:read", "mcp-registry:write"] if not specified
	ScopesSupported []string `yaml:"scopesSupported,omitempty"`

	// Realm is the protection space identifier for WWW-Authenticate header (RFC 7235)
	// Defaults to "mcp-registry" if not specified
	Realm string `yaml:"realm,omitempty"`
}

type OAuthProviderConfig struct {
	// Name is a unique identifier for this provider (e.g., "kubernetes", "keycloak")
	Name string `yaml:"name"`

	// IssuerURL is the OIDC issuer URL (e.g., https://accounts.google.com)
	// The JWKS URL will be discovered automatically from .well-known/openid-configuration
	// unless JwksUrl is explicitly specified
	IssuerURL string `yaml:"issuerUrl"`

	// JwksUrl is the URL to fetch the JSON Web Key Set (JWKS) from
	// If specified, OIDC discovery is skipped and this URL is used directly
	// Example: https://kubernetes.default.svc/openid/v1/jwks
	JwksUrl string `yaml:"jwksUrl,omitempty"`

	// Audience is the expected audience claim in the token (REQUIRED)
	// Per RFC 6749 Section 4.1.3, tokens must be validated against expected audience
	// For Kubernetes, this is typically the API server URL
	Audience string `yaml:"audience"`

	// ClientID is the OAuth client ID for token introspection (optional)
	ClientID string `yaml:"clientId,omitempty"`

	// ClientSecretFile is the path to a file containing the client secret
	// The file should contain only the secret with optional trailing whitespace
	ClientSecretFile string `yaml:"clientSecretFile,omitempty"`

	// CACertPath is the path to a CA certificate bundle for verifying the provider's TLS certificate
	// Required for Kubernetes in-cluster authentication or self-signed certificates
	CACertPath string `yaml:"caCertPath,omitempty"`

	// AuthTokenFile is the path to a file containing a bearer token for authenticating to OIDC/JWKS endpoints
	// Useful when the OIDC discovery or JWKS endpoint requires authentication
	// Example: /var/run/secrets/kubernetes.io/serviceaccount/token
	AuthTokenFile string `yaml:"authTokenFile,omitempty"`

	// IntrospectionURL is the OAuth 2.0 Token Introspection endpoint (RFC 7662)
	// Used for validating opaque (non-JWT) tokens
	// If not specified, only JWT tokens can be validated via JWKS
	IntrospectionURL string `yaml:"introspectionUrl,omitempty"`

	// AllowPrivateIP allows JWKS/OIDC endpoints on private IP addresses
	// Required when the OAuth provider (e.g., Kubernetes API server) is running on a private network
	// Example: Set to true when using https://kubernetes.default.svc as the issuer URL
	AllowPrivateIP bool `yaml:"allowPrivateIP,omitempty"`
}

type RegistryConfig struct {
	Name    string         `yaml:"name"`
	Sources []string       `yaml:"sources"`
	Claims  map[string]any `yaml:"claims,omitempty"`
}

type RolesConfig struct {
	SuperAdmin       []map[string]any `yaml:"superAdmin,omitempty"`
	ManageSources    []map[string]any `yaml:"manageSources,omitempty"`
	ManageRegistries []map[string]any `yaml:"manageRegistries,omitempty"`
	ManageEntries    []map[string]any `yaml:"manageEntries,omitempty"`
}

type SourceConfig struct {
	Name       string            `yaml:"name"`
	Format     string            `yaml:"format,omitempty"`
	Claims     map[string]any    `yaml:"claims,omitempty"`
	Git        *GitConfig        `yaml:"git,omitempty"`
	API        *APIConfig        `yaml:"api,omitempty"`
	File       *FileConfig       `yaml:"file,omitempty"`
	Managed    *ManagedConfig    `yaml:"managed,omitempty"`
	Kubernetes *KubernetesConfig `yaml:"kubernetes,omitempty"`
	SyncPolicy *SyncPolicyConfig `yaml:"syncPolicy,omitempty"`
	Filter     *FilterConfig     `yaml:"filter,omitempty"`
}

type SyncPolicyConfig struct {
	Interval string `yaml:"interval"`
}

type TagFilterConfig struct {
	Include []string `yaml:"include,omitempty"`
	Exclude []string `yaml:"exclude,omitempty"`
}

type TelemetryConfig struct {
	Enabled        bool           `yaml:"enabled"`
	ServiceName    string         `yaml:"serviceName,omitempty"`
	ServiceVersion string         `yaml:"serviceVersion,omitempty"`
	Endpoint       string         `yaml:"endpoint,omitempty"`
	Insecure       bool           `yaml:"insecure,omitempty"`
	Tracing        *TracingConfig `yaml:"tracing,omitempty"`
	Metrics        *MetricsConfig `yaml:"metrics,omitempty"`
}

type TracingConfig struct {
	Enabled  bool     `yaml:"enabled"`
	Sampling *float64 `yaml:"sampling,omitempty"`
}