conf

type APIConfiguration struct {
	Host               string
	Port               string `envconfig:"PORT" default:"8081"`
	Endpoint           string
	RequestIDHeader    string        `envconfig:"REQUEST_ID_HEADER"`
	ExternalURL        string        `json:"external_url" envconfig:"API_EXTERNAL_URL" required:"true"`
	MaxRequestDuration time.Duration `json:"max_request_duration" split_words:"true" default:"10s"`
}

type AnonymousProviderConfiguration struct {
	Enabled bool `json:"enabled" default:"false"`
}

type AuditLogConfiguration struct {
	DisablePostgres bool `split_words:"true" default:"false"`
}

type CORSConfiguration struct {
	AllowedHeaders []string `json:"allowed_headers" split_words:"true"`
}

type CaptchaConfiguration struct {
	Enabled  bool   `json:"enabled" default:"false"`
	Provider string `json:"provider" default:"hcaptcha"`
	Secret   string `json:"provider_secret"`
}

type CustomOAuthConfiguration struct {
	Enabled      bool `json:"enabled" split_words:"true" default:"false"`
	MaxProviders int  `json:"max_providers" split_words:"true" default:"0"`
}

type DBAdvisorConfiguration struct {
	Enabled             bool          `json:"enabled" default:"true"`
	SamplingInterval    time.Duration `json:"sampling_interval" split_words:"true" default:"200ms"`
	ObservationInterval time.Duration `json:"observation_interval" split_words:"true" default:"20s"`
}

type DBConfiguration struct {
	Driver    string `json:"driver" required:"true"`
	URL       string `json:"url" envconfig:"DATABASE_URL" required:"true"`
	Namespace string `json:"namespace" envconfig:"DB_NAMESPACE" default:"auth"`

	// Percentage of DB conns the auth server may use in
	// integer form i.e.: [1, 100] -> [1%, 100%]
	ConnPercentage int `json:"conn_percentage" split_words:"true"`

	// MaxPoolSize defaults to 0 (unlimited).
	MaxPoolSize       int           `json:"max_pool_size" split_words:"true"`
	MaxIdlePoolSize   int           `json:"max_idle_pool_size" split_words:"true"`
	ConnMaxLifetime   time.Duration `json:"conn_max_lifetime,omitempty" split_words:"true"`
	ConnMaxIdleTime   time.Duration `json:"conn_max_idle_time,omitempty" split_words:"true"`
	HealthCheckPeriod time.Duration `json:"health_check_period" split_words:"true"`
	MigrationsPath    string        `json:"migrations_path" split_words:"true" default:"./migrations"`
	CleanupEnabled    bool          `json:"cleanup_enabled" split_words:"true" default:"false"`

	Advisor DBAdvisorConfiguration `json:"advisor"`
}

type DatabaseEncryptionConfiguration struct {
	Encrypt bool `json:"encrypt"`

	EncryptionKeyID string `json:"encryption_key_id" split_words:"true"`
	EncryptionKey   string `json:"-" split_words:"true"`

	DecryptionKeys map[string]string `json:"-" split_words:"true"`
}

type EmailContentConfiguration struct {
	Invite           string `json:"invite"`
	Confirmation     string `json:"confirmation"`
	Recovery         string `json:"recovery"`
	EmailChange      string `json:"email_change" split_words:"true"`
	MagicLink        string `json:"magic_link" split_words:"true"`
	Reauthentication string `json:"reauthentication"`

	// Account Changes Notifications
	PasswordChangedNotification     string `json:"password_changed_notification" split_words:"true"`
	EmailChangedNotification        string `json:"email_changed_notification" split_words:"true"`
	PhoneChangedNotification        string `json:"phone_changed_notification" split_words:"true"`
	IdentityLinkedNotification      string `json:"identity_linked_notification" split_words:"true"`
	IdentityUnlinkedNotification    string `json:"identity_unlinked_notification" split_words:"true"`
	MFAFactorEnrolledNotification   string `json:"mfa_factor_enrolled_notification" split_words:"true"`
	MFAFactorUnenrolledNotification string `json:"mfa_factor_unenrolled_notification" split_words:"true"`
}

type EmailProviderConfiguration struct {
	Enabled bool `json:"enabled" default:"true"`

	AuthorizedAddresses []string `json:"authorized_addresses" split_words:"true"`

	MagicLinkEnabled bool `json:"magic_link_enabled" default:"true" split_words:"true"`
}

type EthereumConfiguration struct {
	Enabled                 bool          `json:"enabled,omitempty" split_words:"true"`
	MaximumValidityDuration time.Duration `json:"maximum_validity_duration,omitempty" default:"10m" split_words:"true"`
}

type ExperimentalConfiguration struct {
	// Names of providers (e.g. "google") which have their own identity
	// linking domain, meaning that the ones listed here _will not
	// participate_ in email similarity linking with other accounts.
	ProvidersWithOwnLinkingDomain []string `split_words:"true"`
}

type ExtensibilityPointConfiguration struct {
	URI     string `json:"uri"`
	Enabled bool   `json:"enabled"`
	// For internal use together with Postgres Hook. Not publicly exposed.
	HookName string `json:"-"`
	// We use | as a separator for keys and : as a separator for keys within a keypair. For instance: v1,whsec_test|v1a,whpk_myother:v1a,whsk_testkey|v1,whsec_secret3
	HTTPHookSecrets HTTPHookSecrets `json:"secrets" envconfig:"secrets"`
}

type GlobalConfiguration struct {
	API           APIConfiguration
	DB            DBConfiguration
	External      ProviderConfiguration
	CustomOAuth   CustomOAuthConfiguration `envconfig:"CUSTOM_OAUTH"`
	OAuthServer   OAuthServerConfiguration `envconfig:"OAUTH_SERVER"`
	Logging       LoggingConfig            `envconfig:"LOG"`
	Profiler      ProfilerConfig           `envconfig:"PROFILER"`
	OperatorToken string                   `split_words:"true" required:"false"`
	Tracing       TracingConfig
	Metrics       MetricsConfig
	SMTP          SMTPConfiguration
	AuditLog      AuditLogConfiguration `split_words:"true"`

	RateLimitHeader                     string  `split_words:"true"`
	RateLimitEmailSent                  Rate    `split_words:"true" default:"30"`
	RateLimitSmsSent                    Rate    `split_words:"true" default:"30"`
	RateLimitVerify                     float64 `split_words:"true" default:"30"`
	RateLimitTokenRefresh               float64 `split_words:"true" default:"150"`
	RateLimitSso                        float64 `split_words:"true" default:"30"`
	RateLimitAnonymousUsers             float64 `split_words:"true" default:"30"`
	RateLimitOtp                        float64 `split_words:"true" default:"30"`
	RateLimitWeb3                       float64 `split_words:"true" default:"30"`
	RateLimitOAuthDynamicClientRegister float64 `split_words:"true" default:"10"`

	SiteURL         string   `json:"site_url" split_words:"true" required:"true"`
	URIAllowList    []string `json:"uri_allow_list" split_words:"true"`
	URIAllowListMap map[string]glob.Glob
	Password        PasswordConfiguration    `json:"password"`
	JWT             JWTConfiguration         `json:"jwt"`
	Mailer          MailerConfiguration      `json:"mailer"`
	Sms             SmsProviderConfiguration `json:"sms"`
	DisableSignup   bool                     `json:"disable_signup" split_words:"true"`
	Hook            HookConfiguration        `json:"hook" split_words:"true"`
	Security        SecurityConfiguration    `json:"security"`
	Sessions        SessionsConfiguration    `json:"sessions"`
	MFA             MFAConfiguration         `json:"MFA"`
	SAML            SAMLConfiguration        `json:"saml"`
	WebAuthn        WebAuthnConfiguration    `json:"webauthn"`
	Passkey         PasskeyConfiguration     `json:"passkey"`
	CORS            CORSConfiguration        `json:"cors"`
	IndexWorker     IndexWorkerConfiguration `json:"index_worker" split_words:"true"`

	Experimental ExperimentalConfiguration `json:"experimental"`
	Reloading    ReloadingConfiguration    `json:"reloading"`
}

type HIBPBloomConfiguration struct {
	Enabled        bool    `json:"enabled"`
	Items          uint    `json:"items" default:"100000"`
	FalsePositives float64 `json:"false_positives" split_words:"true" default:"0.0000099"`
}

type HIBPConfiguration struct {
	Enabled    bool `json:"enabled"`
	FailClosed bool `json:"fail_closed" split_words:"true"`

	UserAgent string `json:"user_agent" split_words:"true" default:"https://github.com/supatype/server"`

	Bloom HIBPBloomConfiguration `json:"bloom"`
}

type HTTPHookSecrets []string

type HookConfiguration struct {
	MFAVerificationAttempt      ExtensibilityPointConfiguration `json:"mfa_verification_attempt" split_words:"true"`
	PasswordVerificationAttempt ExtensibilityPointConfiguration `json:"password_verification_attempt" split_words:"true"`
	CustomAccessToken           ExtensibilityPointConfiguration `json:"custom_access_token" split_words:"true"`
	SendEmail                   ExtensibilityPointConfiguration `json:"send_email" split_words:"true"`
	SendSMS                     ExtensibilityPointConfiguration `json:"send_sms" split_words:"true"`

	BeforeUserCreated ExtensibilityPointConfiguration `json:"before_user_created" split_words:"true"`
	AfterUserCreated  ExtensibilityPointConfiguration `json:"after_user_created" split_words:"true"`
}

type IndexWorkerConfiguration struct {
	// user opt-in — when true, always create indexes (threshold is ignored).
	EnsureUserSearchIndexesExist bool `json:"ensure_user_search_indexes_exist" split_words:"true" default:"false"`
	// progressive rollout — when > 0, create indexes only if user count ≤ threshold.
	// A value of 0 means disabled. Has no effect when EnsureUserSearchIndexesExist is true.
	MaxUsersThreshold int64 `json:"max_users_threshold" split_words:"true" default:"0"`
}

type JWTConfiguration struct {
	Secret           string         `json:"secret" required:"true"`
	Exp              int            `json:"exp"`
	Aud              string         `json:"aud"`
	AdminGroupName   string         `json:"admin_group_name" split_words:"true"`
	AdminRoles       []string       `json:"admin_roles" split_words:"true"`
	DefaultGroupName string         `json:"default_group_name" split_words:"true"`
	Issuer           string         `json:"issuer"`
	KeyID            string         `json:"key_id" split_words:"true"`
	Keys             JwtKeysDecoder `json:"keys"`
	ValidMethods     []string       `json:"-" split_words:"true"`
}

type JwkInfo struct {
	PublicKey  jwk.Key `json:"public_key"`
	PrivateKey jwk.Key `json:"private_key"`
}

type JwtKeysDecoder map[string]JwkInfo

type LoggingConfig struct {
	Level            string                 `mapstructure:"log_level" json:"log_level"`
	File             string                 `mapstructure:"log_file" json:"log_file"`
	DisableColors    bool                   `mapstructure:"disable_colors" split_words:"true" json:"disable_colors"`
	QuoteEmptyFields bool                   `mapstructure:"quote_empty_fields" split_words:"true" json:"quote_empty_fields"`
	TSFormat         string                 `mapstructure:"ts_format" json:"ts_format"`
	Fields           map[string]interface{} `mapstructure:"fields" json:"fields"`
	SQL              string                 `mapstructure:"sql" json:"sql"`
}

type MFAConfiguration struct {
	ChallengeExpiryDuration     float64                      `json:"challenge_expiry_duration" default:"300" split_words:"true"`
	FactorExpiryDuration        time.Duration                `json:"factor_expiry_duration" default:"300s" split_words:"true"`
	RateLimitChallengeAndVerify float64                      `split_words:"true" default:"15"`
	MaxEnrolledFactors          float64                      `split_words:"true" default:"10"`
	MaxVerifiedFactors          int                          `split_words:"true" default:"10"`
	Phone                       PhoneFactorTypeConfiguration `split_words:"true"`
	TOTP                        TOTPFactorTypeConfiguration  `split_words:"true"`
	WebAuthn                    MFAFactorTypeConfiguration   `split_words:"true"`
}

type MFAFactorTypeConfiguration struct {
	EnrollEnabled bool `json:"enroll_enabled" split_words:"true" default:"false"`
	VerifyEnabled bool `json:"verify_enabled" split_words:"true" default:"false"`
}

type MailerConfiguration struct {
	Autoconfirm                 bool `json:"autoconfirm"`
	AllowUnverifiedEmailSignIns bool `json:"allow_unverified_email_sign_ins" split_words:"true" default:"false"`

	Subjects      EmailContentConfiguration  `json:"subjects"`
	Templates     EmailContentConfiguration  `json:"templates"`
	URLPaths      EmailContentConfiguration  `json:"url_paths"`
	Notifications NotificationsConfiguration `json:"notifications" split_words:"true"`

	SecureEmailChangeEnabled bool `json:"secure_email_change_enabled" split_words:"true" default:"true"`

	OtpExp    uint `json:"otp_exp" split_words:"true"`
	OtpLength int  `json:"otp_length" split_words:"true"`

	ExternalHosts []string `json:"external_hosts" split_words:"true"`

	// EXPERIMENTAL: All config below here may be removed in a future release.
	EmailBackgroundSending        bool   `json:"email_background_sending" split_words:"true" default:"false"`
	EmailValidationExtended       bool   `json:"email_validation_extended" split_words:"true" default:"false"`
	EmailValidationServiceURL     string `json:"email_validation_service_url" split_words:"true"`
	EmailValidationServiceHeaders string `json:"email_validation_service_headers" split_words:"true"`
	EmailValidationBlockedMX      string `json:"email_validation_blocked_mx" split_words:"true"`

	// Max size in bytes we will read from a template endpoint
	TemplateMaxSize int `json:"template_max_size" split_words:"true" default:"1000000"`

	// MailerProvider selects the email delivery backend.
	// Accepted values: "" or "smtp" (default, uses SMTP settings), "console", "resend", "ses".
	// When "console": emails are logged only (development).
	// When "resend": RESEND_API_KEY and RESEND_FROM env vars must be set.
	// When "ses": AWS credential chain is used; SES_FROM env var must be set.
	MailerProvider string `json:"mailer_provider" split_words:"true"`

	// The maximum age of a template before we consider it stale.
	TemplateMaxAge time.Duration `json:"template_max_age" split_words:"true" default:"10m"`

	// The time between retrying a failed template reload.
	TemplateRetryInterval time.Duration `json:"template_retry_interval" split_words:"true" default:"10s"`

	// If true enable background reloading of templates to avoid blocking
	// IO in requests.
	TemplateReloadingEnabled bool `json:"template_reloading_enabled" split_words:"true" default:"false"`

	// The maximum time a server may be idle before template reloading stops.
	// Note that even when the server is idle, a config reload will trigger a
	// template reload.
	TemplateReloadingMaxIdle time.Duration `json:"template_reloading_max_idle" split_words:"true" default:"20m"`
	// contains filtered or unexported fields
}

type MessagebirdProviderConfiguration struct {
	AccessKey  string `json:"access_key" split_words:"true"`
	Originator string `json:"originator" split_words:"true"`
}

type MetricsConfig struct {
	Enabled bool

	Exporter MetricsExporter `default:"opentelemetry"`

	// ExporterProtocol is the OTEL_EXPORTER_OTLP_PROTOCOL env variable,
	// only available when exporter is opentelemetry. See:
	// https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/protocol/exporter.md
	ExporterProtocol string `default:"http/protobuf" envconfig:"OTEL_EXPORTER_OTLP_PROTOCOL"`

	PrometheusListenHost string `default:"0.0.0.0" envconfig:"OTEL_EXPORTER_PROMETHEUS_HOST"`
	PrometheusListenPort string `default:"9100" envconfig:"OTEL_EXPORTER_PROMETHEUS_PORT"`
}

type MetricsExporter = string

type NotificationsConfiguration struct {
	PasswordChangedEnabled     bool `json:"password_changed_enabled" split_words:"true" default:"false"`
	EmailChangedEnabled        bool `json:"email_changed_enabled" split_words:"true" default:"false"`
	PhoneChangedEnabled        bool `json:"phone_changed_enabled" split_words:"true" default:"false"`
	IdentityLinkedEnabled      bool `json:"identity_linked_enabled" split_words:"true" default:"false"`
	IdentityUnlinkedEnabled    bool `json:"identity_unlinked_enabled" split_words:"true" default:"false"`
	MFAFactorEnrolledEnabled   bool `json:"mfa_factor_enrolled_enabled" split_words:"true" default:"false"`
	MFAFactorUnenrolledEnabled bool `json:"mfa_factor_unenrolled_enabled" split_words:"true" default:"false"`
}

type OAuthProviderConfiguration struct {
	ClientID      []string `json:"client_id" split_words:"true"`
	Secret        string   `json:"secret"`
	RedirectURI   string   `json:"redirect_uri" split_words:"true"`
	URL           string   `json:"url"`
	ApiURL        string   `json:"api_url" split_words:"true"`
	Enabled       bool     `json:"enabled"`
	EmailOptional bool     `json:"email_optional" split_words:"true"`
	// SkipNonceCheck bypasses nonce verification during OIDC token validation.
	// Note: Nonce verification helps prevent replay attacks; only disable when necessary.
	SkipNonceCheck bool `json:"skip_nonce_check" split_words:"true"`
}

type OAuthServerConfiguration struct {
	Enabled                  bool          `json:"enabled" default:"false"`
	AllowDynamicRegistration bool          `json:"allow_dynamic_registration" split_words:"true"`
	AuthorizationPath        string        `json:"authorization_path" split_words:"true"`
	AuthorizationTTL         time.Duration `json:"authorization_ttl" split_words:"true" default:"10m"`
	// Placeholder for now, for (near) future extensibility
	DefaultScope string `json:"default_scope" split_words:"true" default:"email"`
}

type PasskeyConfiguration struct {
	Enabled            bool `json:"enabled" default:"false"`
	MaxPasskeysPerUser int  `json:"max_passkeys_per_user" split_words:"true" default:"10"`
}

type PasswordConfiguration struct {
	MinLength int `json:"min_length" split_words:"true"`

	RequiredCharacters PasswordRequiredCharacters `json:"required_characters" split_words:"true"`

	HIBP HIBPConfiguration `json:"hibp"`
}

type PasswordRequiredCharacters []string

type PhoneFactorTypeConfiguration struct {
	// Default to false in order to ensure Phone MFA is opt-in
	MFAFactorTypeConfiguration
	OtpLength    int                `json:"otp_length" split_words:"true"`
	SMSTemplate  *template.Template `json:"-"`
	MaxFrequency time.Duration      `json:"max_frequency" split_words:"true"`
	Template     string             `json:"template"`
}

type PhoneProviderConfiguration struct {
	Enabled bool `json:"enabled" default:"false"`
}

type ProfilerConfig struct {
	Enabled bool   `default:"false"`
	Host    string `default:"localhost"`
	Port    string `default:"9998"`
}

type ProviderConfiguration struct {
	AnonymousUsers          AnonymousProviderConfiguration `json:"anonymous_users" split_words:"true"`
	Apple                   OAuthProviderConfiguration     `json:"apple"`
	Azure                   OAuthProviderConfiguration     `json:"azure"`
	Bitbucket               OAuthProviderConfiguration     `json:"bitbucket"`
	Discord                 OAuthProviderConfiguration     `json:"discord"`
	Facebook                OAuthProviderConfiguration     `json:"facebook"`
	Snapchat                OAuthProviderConfiguration     `json:"snapchat"`
	Figma                   OAuthProviderConfiguration     `json:"figma"`
	Fly                     OAuthProviderConfiguration     `json:"fly"`
	Github                  OAuthProviderConfiguration     `json:"github"`
	Gitlab                  OAuthProviderConfiguration     `json:"gitlab"`
	Google                  OAuthProviderConfiguration     `json:"google"`
	Kakao                   OAuthProviderConfiguration     `json:"kakao"`
	Notion                  OAuthProviderConfiguration     `json:"notion"`
	Keycloak                OAuthProviderConfiguration     `json:"keycloak"`
	Linkedin                OAuthProviderConfiguration     `json:"linkedin"`
	LinkedinOIDC            OAuthProviderConfiguration     `json:"linkedin_oidc" envconfig:"LINKEDIN_OIDC"`
	Spotify                 OAuthProviderConfiguration     `json:"spotify"`
	Slack                   OAuthProviderConfiguration     `json:"slack"`
	SlackOIDC               OAuthProviderConfiguration     `json:"slack_oidc" envconfig:"SLACK_OIDC"`
	Twitter                 OAuthProviderConfiguration     `json:"twitter"`
	Twitch                  OAuthProviderConfiguration     `json:"twitch"`
	VercelMarketplace       OAuthProviderConfiguration     `json:"vercel_marketplace" split_words:"true"`
	WorkOS                  OAuthProviderConfiguration     `json:"workos"`
	Email                   EmailProviderConfiguration     `json:"email"`
	Phone                   PhoneProviderConfiguration     `json:"phone"`
	X                       OAuthProviderConfiguration     `json:"x" envconfig:"X"`
	Zoom                    OAuthProviderConfiguration     `json:"zoom"`
	IosBundleId             string                         `json:"ios_bundle_id" split_words:"true"`
	RedirectURL             string                         `json:"redirect_url"`
	AllowedIdTokenIssuers   []string                       `json:"allowed_id_token_issuers" split_words:"true"`
	FlowStateExpiryDuration time.Duration                  `json:"flow_state_expiry_duration" split_words:"true"`

	// OIDCProviderCacheTTL controls how long OIDC discovery documents are cached.
	OIDCProviderCacheTTL time.Duration `json:"oidc_provider_cache_ttl" split_words:"true" default:"1h"`

	Web3Solana   SolanaConfiguration   `json:"web3_solana" split_words:"true"`
	Web3Ethereum EthereumConfiguration `json:"web3_ethereum" split_words:"true"`
}

type Rate struct {
	Events   float64       `json:"events,omitempty"`
	OverTime time.Duration `json:"over_time,omitempty"`
	// contains filtered or unexported fields
}

type ReloadingConfiguration struct {

	// If notify reloading is enabled the auth server will attempt to use the
	// filesystems notification support to watch for config updates.
	NotifyEnabled bool `json:"notify_enabled" split_words:"true" default:"true"`

	// When notify reloading fails, fallback to filesystem polling if this
	// setting is enabled.
	PollerEnabled bool `json:"poller_enabled" split_words:"false" default:"false"`

	// This determines how often to poll the filesystem when notify is disabled.
	PollerInterval time.Duration `json:"poller_interval" split_words:"true" default:"10s"`

	// If signal reloading is enabled the auth server will listen for the
	// given SignalNumber and reload the config when received. This may be
	// used to configure `systemd reload` support, by default the SIGUSR1 linux
	// signal number of 10 is used.
	SignalEnabled bool `json:"signal_enabled" split_words:"true" default:"false"`
	SignalNumber  int  `json:"signal_number" split_words:"true" default:"10"`

	// When at least one reloader is enabled this flag determines how much idle
	// time must pass before triggering a reload. This ensures a single
	// auth server config reload operation during a burst of config updates.
	GracePeriodInterval time.Duration `json:"grace_period_interval" split_words:"true" default:"5s"`
}

type SAMLConfiguration struct {
	Enabled                  bool          `json:"enabled"`
	PrivateKey               string        `json:"-" split_words:"true"`
	AllowEncryptedAssertions bool          `json:"allow_encrypted_assertions" split_words:"true"`
	RelayStateValidityPeriod time.Duration `json:"relay_state_validity_period" split_words:"true"`

	RSAPrivateKey *rsa.PrivateKey   `json:"-"`
	RSAPublicKey  *rsa.PublicKey    `json:"-"`
	Certificate   *x509.Certificate `json:"-"`

	ExternalURL string `json:"external_url,omitempty" split_words:"true"`

	RateLimitAssertion float64 `default:"15" split_words:"true"`
}

type SMTPConfiguration struct {
	MaxFrequency   time.Duration `json:"max_frequency" split_words:"true"`
	Host           string        `json:"host"`
	Port           int           `json:"port,omitempty" default:"587"`
	User           string        `json:"user"`
	Pass           string        `json:"pass,omitempty"`
	AdminEmail     string        `json:"admin_email" split_words:"true"`
	SenderName     string        `json:"sender_name" split_words:"true"`
	Headers        string        `json:"headers"`
	LoggingEnabled bool          `json:"logging_enabled" split_words:"true" default:"false"`
	// contains filtered or unexported fields
}

type SecurityConfiguration struct {
	Captcha                               CaptchaConfiguration `json:"captcha"`
	RefreshTokenUpgradePercentage         int                  `json:"refresh_token_upgrade_percentage" split_words:"true"`
	RefreshTokenAlgorithmVersion          int                  `json:"refresh_token_algorithm_version" split_words:"true"`
	RefreshTokenRotationEnabled           bool                 `json:"refresh_token_rotation_enabled" split_words:"true" default:"true"`
	RefreshTokenReuseInterval             int                  `json:"refresh_token_reuse_interval" split_words:"true"`
	RefreshTokenAllowReuse                bool                 `json:"refresh_token_allow_reuse" split_words:"true"`
	UpdatePasswordRequireReauthentication bool                 `json:"update_password_require_reauthentication" split_words:"true"`
	UpdatePasswordRequireCurrentPassword  bool                 `json:"update_password_require_current_password" split_words:"true"`
	ManualLinkingEnabled                  bool                 `json:"manual_linking_enabled" split_words:"true" default:"false"`
	SbForwardedForEnabled                 bool                 `json:"sb_forwarded_for_enabled" split_words:"true" default:"false"`

	DBEncryption DatabaseEncryptionConfiguration `json:"database_encryption" split_words:"true"`
}

type SessionsConfiguration struct {
	Timebox           *time.Duration `json:"timebox,omitempty"`
	InactivityTimeout *time.Duration `json:"inactivity_timeout,omitempty" split_words:"true"`
	AllowLowAAL       *time.Duration `json:"allow_low_aal,omitempty" split_words:"true"`

	SinglePerUser bool     `json:"single_per_user" split_words:"true"`
	Tags          []string `json:"tags,omitempty"`
}

type SmsProviderConfiguration struct {
	Autoconfirm       bool               `json:"autoconfirm"`
	MaxFrequency      time.Duration      `json:"max_frequency" split_words:"true"`
	OtpExp            uint               `json:"otp_exp" split_words:"true"`
	OtpLength         int                `json:"otp_length" split_words:"true"`
	Provider          string             `json:"provider"`
	Template          string             `json:"template"`
	TestOTP           map[string]string  `json:"test_otp" split_words:"true"`
	TestOTPValidUntil Time               `json:"test_otp_valid_until" split_words:"true"`
	SMSTemplate       *template.Template `json:"-"`

	Twilio       TwilioProviderConfiguration       `json:"twilio"`
	TwilioVerify TwilioVerifyProviderConfiguration `json:"twilio_verify" split_words:"true"`
	Messagebird  MessagebirdProviderConfiguration  `json:"messagebird"`
	Textlocal    TextlocalProviderConfiguration    `json:"textlocal"`
	Vonage       VonageProviderConfiguration       `json:"vonage"`
}

type SolanaConfiguration struct {
	Enabled                 bool          `json:"enabled,omitempty" split_words:"true"`
	MaximumValidityDuration time.Duration `json:"maximum_validity_duration,omitempty" default:"10m" split_words:"true"`
}

type TOTPFactorTypeConfiguration struct {
	EnrollEnabled bool `json:"enroll_enabled" split_words:"true" default:"true"`
	VerifyEnabled bool `json:"verify_enabled" split_words:"true" default:"true"`
}

type TextlocalProviderConfiguration struct {
	ApiKey string `json:"api_key" split_words:"true"`
	Sender string `json:"sender" split_words:"true"`
}

type Time struct {
	time.Time
}

type TracingConfig struct {
	Enabled  bool
	Exporter TracingExporter `default:"opentelemetry"`

	// ExporterProtocol is the OTEL_EXPORTER_OTLP_PROTOCOL env variable,
	// only available when exporter is opentelemetry. See:
	// https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/protocol/exporter.md
	ExporterProtocol string `default:"http/protobuf" envconfig:"OTEL_EXPORTER_OTLP_PROTOCOL"`

	// Host is the host of the OpenTracing collector.
	Host string

	// Port is the port of the OpenTracing collector.
	Port string

	// ServiceName is the service name to use with OpenTracing.
	ServiceName string `default:"gotrue" split_words:"true"`

	// Tags are the tags to associate with OpenTracing.
	Tags map[string]string
}

type TracingExporter = string

type TwilioProviderConfiguration struct {
	AccountSid        string `json:"account_sid" split_words:"true"`
	AuthToken         string `json:"auth_token" split_words:"true"`
	MessageServiceSid string `json:"message_service_sid" split_words:"true"`
	ContentSid        string `json:"content_sid" split_words:"true"`
}

type TwilioVerifyProviderConfiguration struct {
	AccountSid        string `json:"account_sid" split_words:"true"`
	AuthToken         string `json:"auth_token" split_words:"true"`
	MessageServiceSid string `json:"message_service_sid" split_words:"true"`
}

type VonageProviderConfiguration struct {
	ApiKey    string `json:"api_key" split_words:"true"`
	ApiSecret string `json:"api_secret" split_words:"true"`
	From      string `json:"from" split_words:"true"`
}

type WebAuthnConfiguration struct {
	RPID                    string        `json:"rp_id" envconfig:"RP_ID"`
	RPDisplayName           string        `json:"rp_display_name" split_words:"true"`
	RPOrigins               []string      `json:"rp_origins" split_words:"true"`
	ChallengeExpiryDuration time.Duration `json:"challenge_expiry_duration" split_words:"true" default:"5m"`
}