httpserver

type Deps struct {
	Log *slog.Logger
	// Handlers implements the generated API surface. Nil mounts a 501 catch-all.
	Handlers *handlers.Server
	Ready    ReadyFunc
	// Sessions resolves cookies to identities; nil skips session handling.
	Sessions *auth.SessionStore
	// BaseOrigin is the deployment origin for the CSRF check (required when
	// Sessions is set). CORSDevOrigin optionally allows the Vite dev server.
	BaseOrigin    string
	CORSDevOrigin string
	// WSHandler serves GET /api/{v0,v1}/ws (the live scoreboard socket). Nil disables it.
	WSHandler http.Handler
	// V0Sunset is the date advertised in the /api/v0 Sunset header (RFC 8594). The zero
	// value still emits a header (an ancient date); production passes cfg.APIV0Sunset.
	V0Sunset time.Time
	// Tokens resolves `Authorization: Bearer` API tokens; nil disables token auth.
	Tokens *auth.TokenService
	// Limiter rate-limits token requests by token identity; nil disables that limit.
	Limiter         *redisx.Limiter
	TokenRateBurst  int
	TokenRateWindow time.Duration
	// TrustProxy mirrors OSCTF_TRUST_PROXY. When false the server warns once if it
	// receives a forwarded header, since a proxy is likely in front but its client IPs
	// are being ignored (every request would then key to the proxy IP).
	TrustProxy bool
}

type ReadyFunc func(ctx context.Context) map[string]string