config

type AIConfig struct {
	// Enabled defaults to true when at least one model is configured.
	Enabled *bool `yaml:"enabled"`
	// DefaultModel is the alias used when the client does not specify one.
	DefaultModel string `yaml:"default_model"`
	// DefaultImageModel / DefaultEmbeddingModel aliases.
	DefaultImageModel     string                    `yaml:"default_image_model"`
	DefaultEmbeddingModel string                    `yaml:"default_embedding_model"`
	Providers             map[string]ProviderConfig `yaml:"providers"`
	Models                map[string]ModelConfig    `yaml:"models"`
	// AllowRawModels lets clients pass "provider/model-id" directly.
	AllowRawModels bool `yaml:"allow_raw_models"`
	// ExposeModelIDs includes provider model ids in GET /ai/models.
	ExposeModelIDs bool `yaml:"expose_model_ids"`
	// MaxTokens caps max_tokens per request (default 8192).
	MaxTokens int `yaml:"max_tokens"`
	// RequestTimeout per upstream call (default 120s; streaming: 10m).
	RequestTimeout Duration `yaml:"request_timeout"`
	// SystemPrompt is prepended to every request's system prompt (optional).
	SystemPrompt string `yaml:"system_prompt"`
}

type ALBConfig struct {
	Region string `yaml:"region"`
	// SignerARN is the load balancer ARN expected in the JWT "signer" header.
	SignerARN string `yaml:"signer_arn"`
	// KeyURL override (default https://public-keys.auth.elb.<region>.amazonaws.com).
	KeyURL string `yaml:"key_url"`
}

type AuthConfig struct {
	// Mode: none | oidc | iap | alb | header. "okta", "entra", "azuread",
	// "google", "auth0" and "keycloak" are accepted aliases for "oidc".
	Mode string `yaml:"mode"`
	// Admins are user ids/emails with admin rights.
	Admins []string `yaml:"admins"`
	// AdminGroups grant admin rights to members.
	AdminGroups []string `yaml:"admin_groups"`
	// AllowedDomains restricts access to these email domains (empty = any).
	AllowedDomains []string `yaml:"allowed_domains"`
	// AllowedEmails admits these exact addresses too. With AllowedDomains a
	// person passes when either matches; alone, only the listed addresses
	// pass (empty = no per-address list).
	AllowedEmails []string `yaml:"allowed_emails"`
	// AllowedGroups restricts access to members of these groups (empty = any).
	AllowedGroups []string `yaml:"allowed_groups"`
	// TokenTTL is the lifetime of minted Backyard API tokens (default 720h).
	TokenTTL Duration `yaml:"token_ttl"`
	// Tokens are static bearer tokens (e.g. for CI), stored as sha256 hex.
	Tokens []StaticToken `yaml:"tokens"`

	OIDC   OIDCConfig       `yaml:"oidc"`
	IAP    IAPConfig        `yaml:"iap"`
	ALB    ALBConfig        `yaml:"alb"`
	Header HeaderAuthConfig `yaml:"header"`
}

type AzureConfig struct {
	Account   string `yaml:"account"`
	Container string `yaml:"container"`
	Prefix    string `yaml:"prefix"`
	// ConnectionString optional (Azurite / shared key); default DefaultAzureCredential.
	ConnectionString string `yaml:"connection_string"`
	// AccountKey optional shared key (enables service SAS without user delegation).
	AccountKey string `yaml:"account_key"`
	// Endpoint override, default https://<account>.blob.core.windows.net/.
	Endpoint string `yaml:"endpoint"`
}

type ClaimsMapping struct {
	Email  string `yaml:"email"`  // default "email"
	Name   string `yaml:"name"`   // default "name"
	Title  string `yaml:"title"`  // default "title"
	Team   string `yaml:"team"`   // default "department"
	Slack  string `yaml:"slack"`  // default "slack"
	Avatar string `yaml:"avatar"` // default "picture"
	Groups string `yaml:"groups"` // default "groups"
}

type Config struct {
	Server    ServerConfig    `yaml:"server"`
	Auth      AuthConfig      `yaml:"auth"`
	Identity  IdentityConfig  `yaml:"identity"`
	Storage   StorageConfig   `yaml:"storage"`
	Database  DatabaseConfig  `yaml:"database"`
	PubSub    PubSubConfig    `yaml:"pubsub"`
	AI        AIConfig        `yaml:"ai"`
	Warehouse WarehouseConfig `yaml:"warehouse"`
	Sites     SitesConfig     `yaml:"sites"`
	Files     FilesConfig     `yaml:"files"`
	Deploy    DeployConfig    `yaml:"deploy"`
	MCP       MCPConfig       `yaml:"mcp"`
	RateLimit RateLimitConfig `yaml:"ratelimit"`
	Realtime  RealtimeConfig  `yaml:"realtime"`
	Telemetry TelemetryConfig `yaml:"telemetry"`
}

type DatabaseConfig struct {
	// Type: sqlite | postgres | dynamodb | memory.
	Type     string         `yaml:"type"`
	SQLite   SQLiteConfig   `yaml:"sqlite"`
	Postgres PostgresConfig `yaml:"postgres"`
	DynamoDB DynamoDBConfig `yaml:"dynamodb"`
	// MaxDocBytes caps the JSON size of one document (default 262144).
	MaxDocBytes int `yaml:"max_doc_bytes"`
	// MaxList caps query limit (default 1000).
	MaxList int `yaml:"max_list"`
	// MaxDocsPerSite caps documents per site (default 100000; 0 selects the
	// default, a negative value = unlimited).
	MaxDocsPerSite int `yaml:"max_docs_per_site"`
}

type DeployConfig struct {
	// Methods advertised to CLIs, in preference order. Default: ["api"] plus
	// the storage-native method (s3|gcs|azure|rsync for fs).
	Methods []string `yaml:"methods"`
	// RsyncTarget e.g. deploy@backyard.acme.com:/var/lib/backyard/sites
	RsyncTarget string `yaml:"rsync_target"`
	// GatewayURL advertises an external gateway (Lambda / Cloud Run) to CLIs.
	GatewayURL string `yaml:"gateway_url"`
	// AllowAnonymous allows deploys without any token in auth.mode=none.
	AllowAnonymous bool `yaml:"allow_anonymous"`
	// Presign uses presigned storage URLs for uploads when supported (default true).
	Presign *bool `yaml:"presign"`
	// ExposeStorage includes bucket details in /info (default true).
	ExposeStorage *bool `yaml:"expose_storage"`
	// EmbeddedGateway mounts the gateway at /__backyard/api/deploy (default true).
	EmbeddedGateway *bool `yaml:"embedded_gateway"`
}

type DirectoryConfig struct {
	// Type: "" (none) | csv | json.
	Type string `yaml:"type"`
	// Path to the file. CSV header must include "email"; other recognised
	// columns: name,title,team,slack,avatar_url,groups (groups ';'-separated).
	Path string `yaml:"path"`
	// Reload interval (0 = load once).
	Reload Duration `yaml:"reload"`
}

type Duration time.Duration

type DynamoDBConfig struct {
	Table    string `yaml:"table"` // default "backyard"
	Region   string `yaml:"region"`
	Endpoint string `yaml:"endpoint"` // DynamoDB Local / LocalStack
	// CreateTable creates the table (on-demand billing) if missing.
	CreateTable bool `yaml:"create_table"`
	// MaxScan caps items read per query before in-memory filtering/sorting (default 10000).
	MaxScan int `yaml:"max_scan"`
}

type FSConfig struct {
	Root string `yaml:"root"` // default /var/lib/backyard (dev: ./.backyard-data)
}

type FilesConfig struct {
	MaxUploadBytes int64 `yaml:"max_upload_bytes"` // default 100 MiB
}

type GCSConfig struct {
	Bucket string `yaml:"bucket"`
	Prefix string `yaml:"prefix"`
	// CredentialsFile optional; default Application Default Credentials.
	CredentialsFile string `yaml:"credentials_file"`
	// SignerEmail is the service account used for V4 signed URLs when ADC has
	// no private key (Cloud Run / GCE); default: auto-detected.
	SignerEmail string `yaml:"signer_email"`
	// Endpoint override (testing / emulators).
	Endpoint string `yaml:"endpoint"`
}

type HeaderAuthConfig struct {
	EmailHeader  string `yaml:"email_header"`  // e.g. X-Forwarded-Email, X-MS-CLIENT-PRINCIPAL-NAME
	NameHeader   string `yaml:"name_header"`   // optional
	GroupsHeader string `yaml:"groups_header"` // optional, comma separated
	// Optional JWT verification (Cloudflare Access, Pomerium, …).
	JWTHeader string   `yaml:"jwt_header"`
	JWKSURL   string   `yaml:"jwks_url"`
	Issuer    string   `yaml:"issuer"`
	Audiences []string `yaml:"audiences"`
}

type IAPConfig struct {
	// Audience: /projects/<number>/global/backendServices/<id> (load balancer)
	// or /projects/<number>/locations/<region>/services/<name> (Cloud Run).
	Audience string `yaml:"audience"`
	// AdditionalAudiences are also accepted (e.g. the deploy backend service).
	AdditionalAudiences []string `yaml:"additional_audiences"`
	// JWKSURL override (default https://www.gstatic.com/iap/verify/public_key-jwk).
	JWKSURL string `yaml:"jwks_url"`
}

type IdentityConfig struct {
	Claims    ClaimsMapping   `yaml:"claims"`
	Directory DirectoryConfig `yaml:"directory"`
	// ExtraClaims are additional claim names copied into User.Extra.
	ExtraClaims []string `yaml:"extra_claims"`
}

type MCPConfig struct {
	// Enabled serves the connector endpoint and Backyard's OAuth endpoints
	// (default false: every connector path answers 404).
	Enabled bool `yaml:"enabled"`
	// Clients are the Client ID Metadata Document URLs that may connect
	// (only these are fetched). Unset: DefaultMCPClients; [] turns CIMD off,
	// so clients register automatically (stateless DCR).
	Clients []string `yaml:"clients"`
	// RedirectURIs are the exact https addresses that may receive sign-in
	// codes (unset: DefaultMCPRedirectURIs). http loopback addresses are
	// always allowed and are not listed.
	RedirectURIs []string `yaml:"redirect_uris"`
	// MaxPublishBytes caps the decoded file bytes of one backyard_publish
	// call (default 4194304). The MCP request body limit is 2× this + 1 MiB.
	MaxPublishBytes int64 `yaml:"max_publish_bytes"`
}

type ModelConfig struct {
	Provider    string `yaml:"provider"` // key in ai.providers
	Model       string `yaml:"model"`    // provider model id
	Kind        string `yaml:"kind"`     // chat (default) | image | embedding
	Description string `yaml:"description"`
	MaxTokens   int    `yaml:"max_tokens"` // per-alias cap
	Effort      string `yaml:"effort"`     // anthropic effort override
}

type NamedQuery struct {
	Source      string   `yaml:"source"`
	SQL         string   `yaml:"sql"`
	Description string   `yaml:"description"`
	Params      []string `yaml:"params"` // names used as @name in SQL
}

type OIDCConfig struct {
	Issuer       string   `yaml:"issuer"`
	ClientID     string   `yaml:"client_id"`
	ClientSecret string   `yaml:"client_secret"`
	Scopes       []string `yaml:"scopes"` // default: openid profile email (+ groups if GroupsClaim set)
	// RedirectURL defaults to <public_url>/__backyard/auth/callback.
	RedirectURL string `yaml:"redirect_url"`
	// SessionTTL is the browser session lifetime (default 12h).
	SessionTTL Duration `yaml:"session_ttl"`
	// UseUserInfo calls the userinfo endpoint to enrich claims.
	UseUserInfo bool `yaml:"use_userinfo"`
	// DeviceClientID enables the CLI device-authorization flow with this
	// (public/native) client id.
	DeviceClientID string `yaml:"device_client_id"`
	// DeviceScopes default: openid profile email offline_access.
	DeviceScopes []string `yaml:"device_scopes"`
	// APIAudiences are additional accepted audiences for IdP-issued bearer
	// JWTs presented to the API/gateway.
	APIAudiences []string `yaml:"api_audiences"`
	// InsecureSkipIssuerCheck is for IdPs with non-standard issuer URLs (avoid).
	InsecureSkipIssuerCheck bool `yaml:"insecure_skip_issuer_check"`
}

type PostgresConfig struct {
	DSN      string `yaml:"dsn"` // postgres://user:pass@host:5432/db?sslmode=require
	MaxConns int    `yaml:"max_conns"`
	// Schema to create tables in (default "public").
	Schema string `yaml:"schema"`
	// AutoMigrate creates/updates tables on start (default true).
	AutoMigrate *bool `yaml:"auto_migrate"`
}

type PostgresPubSub struct {
	DSN     string `yaml:"dsn"`     // default database.postgres.dsn
	Channel string `yaml:"channel"` // default "backyard_events"
}

type ProviderConfig struct {
	// Type: anthropic | openai | azure-openai | bedrock | gemini | ollama.
	// ("ollama" is openai-compatible with base_url default http://localhost:11434/v1.)
	Type    string            `yaml:"type"`
	APIKey  string            `yaml:"api_key"`
	BaseURL string            `yaml:"base_url"`
	Headers map[string]string `yaml:"headers"`

	// anthropic: platform "anthropic" (default) | "vertex" | "bedrock".
	Platform string `yaml:"platform"`
	// anthropic: enable server-side refusal fallbacks on the first-party API (default true).
	RefusalFallback *bool `yaml:"refusal_fallback"`
	// anthropic: default effort for models that support it (low|medium|high|xhigh|max).
	Effort string `yaml:"effort"`

	// openai: OpenAI-Organization / OpenAI-Project headers.
	Organization  string `yaml:"organization"`
	OpenAIProject string `yaml:"openai_project"`

	// azure-openai
	Endpoint   string `yaml:"endpoint"`    // https://<resource>.openai.azure.com
	APIVersion string `yaml:"api_version"` // default 2024-10-21
	// azure-openai: use Entra ID (DefaultAzureCredential) instead of api_key.
	UseAzureAD bool `yaml:"use_azure_ad"`

	// bedrock / anthropic(platform=bedrock)
	Region string `yaml:"region"`

	// gemini: AI Studio (api_key) or Vertex AI (project+location, ADC).
	// anthropic(platform=vertex) also uses project+location.
	ProjectID string `yaml:"project_id"`
	Location  string `yaml:"location"`
}

type PubSubConfig struct {
	// Type: memory (single instance) | postgres | redis. Default memory.
	Type     string         `yaml:"type"`
	Redis    RedisConfig    `yaml:"redis"`
	Postgres PostgresPubSub `yaml:"postgres"`
}

type RateLimitConfig struct {
	Disabled          bool `yaml:"disabled"`
	APIPerMinute      int  `yaml:"api_per_minute"`       // default 600
	DBWritesPerMinute int  `yaml:"db_writes_per_minute"` // default 300
	AIPerMinute       int  `yaml:"ai_per_minute"`        // default 20
	// AITokensPerDay caps input+output AI tokens per user per UTC day
	// (default 2000000; negative = unlimited).
	AITokensPerDay     int64 `yaml:"ai_tokens_per_day"`
	DeploysPerHour     int   `yaml:"deploys_per_hour"`     // default 60
	UploadsPerMinute   int   `yaml:"uploads_per_minute"`   // default 60
	WarehousePerMinute int   `yaml:"warehouse_per_minute"` // default 30
}

type RealtimeConfig struct {
	Disabled          bool `yaml:"disabled"`
	MaxRoomsPerConn   int  `yaml:"max_rooms_per_conn"`  // default 50
	MaxSubsPerConn    int  `yaml:"max_subs_per_conn"`   // default 100
	MessagesPerSecond int  `yaml:"messages_per_second"` // default 60
	MessageBurst      int  `yaml:"message_burst"`       // default 120
	MaxMessageBytes   int  `yaml:"max_message_bytes"`   // default 65536
	MaxConnsPerUser   int  `yaml:"max_conns_per_user"`  // default 50
	MaxPresenceBytes  int  `yaml:"max_presence_bytes"`  // default 8192
	// AllowCrossSiteWS lets pages on other Backyard sites open this site's websocket (default false).
	AllowCrossSiteWS bool `yaml:"allow_cross_site_ws"`
}

type RedisConfig struct {
	URL string `yaml:"url"` // redis://[:password@]host:6379/0 or rediss://
}

type S3Config struct {
	Bucket         string `yaml:"bucket"`
	Region         string `yaml:"region"`
	Prefix         string `yaml:"prefix"`
	Endpoint       string `yaml:"endpoint"` // custom endpoint for S3-compatible stores
	ForcePathStyle bool   `yaml:"force_path_style"`
	// Static credentials (optional; default AWS credential chain).
	AccessKeyID     string `yaml:"access_key_id"`
	SecretAccessKey string `yaml:"secret_access_key"`
	// SSEKMSKeyID enables SSE-KMS with this key for writes (optional).
	SSEKMSKeyID string `yaml:"sse_kms_key_id"`
}

type SQLiteConfig struct {
	Path string `yaml:"path"` // default <fs root>/backyard.db
}

type ServerConfig struct {
	// Listen address, e.g. ":8080". Empty → ":$PORT" if PORT is set, else ":8080".
	Listen string `yaml:"listen"`
	// BaseDomain is the hub host; sites live at <site>.<base_domain> (host mode).
	BaseDomain string `yaml:"base_domain"`
	// PublicURL is the externally visible hub URL, e.g. https://backyard.acme.com.
	// Defaults to https://<base_domain> (http:// for localhost).
	PublicURL string `yaml:"public_url"`
	// URLMode is "host" (default; wildcard subdomains) or "path" (/s/<site>/).
	URLMode string `yaml:"url_mode"`
	// Secret signs/encrypts sessions, API tokens, deploy ids and upload URLs.
	// Must be at least 32 characters. Generated (ephemeral) in dev mode.
	Secret string `yaml:"secret"`
	// TrustedProxies are CIDRs (or IPs) whose X-Forwarded-* headers are trusted
	// and who may supply identity headers in auth.mode=header.
	TrustedProxies []string `yaml:"trusted_proxies"`
	// Dev enables developer defaults (see ApplyDevDefaults).
	Dev bool `yaml:"dev"`
	// Name shown in the hub UI.
	Name string `yaml:"name"`
	// ReadTimeout/WriteTimeout/IdleTimeout for the HTTP server. Websockets and
	// streaming responses are exempt from WriteTimeout.
	ReadTimeout  Duration `yaml:"read_timeout"`
	WriteTimeout Duration `yaml:"write_timeout"`
	IdleTimeout  Duration `yaml:"idle_timeout"`
	// ShutdownTimeout bounds graceful shutdown.
	ShutdownTimeout Duration `yaml:"shutdown_timeout"`
}

type SitesConfig struct {
	// Ownership: none (default, anyone can overwrite — the Quick philosophy) |
	// owner (first deployer owns the site; owners/admins may overwrite/delete).
	Ownership string   `yaml:"ownership"`
	Reserved  []string `yaml:"reserved"`
	// MaxSiteBytes total (default 500 MiB), MaxFiles (default 10000),
	// MaxFileBytes per file (default 100 MiB).
	MaxSiteBytes int64 `yaml:"max_site_bytes"`
	MaxFiles     int   `yaml:"max_files"`
	MaxFileBytes int64 `yaml:"max_file_bytes"`
}

type StaticToken struct {
	Name   string `yaml:"name"`
	SHA256 string `yaml:"sha256"`
	Admin  bool   `yaml:"admin"`
}

type StorageConfig struct {
	// Type: fs | s3 | gcs | azure.
	Type  string      `yaml:"type"`
	FS    FSConfig    `yaml:"fs"`
	S3    S3Config    `yaml:"s3"`
	GCS   GCSConfig   `yaml:"gcs"`
	Azure AzureConfig `yaml:"azure"`
	// CacheBytes is the in-memory cache size for small static files
	// (default 64 MiB; -1 disables the cache).
	CacheBytes int64 `yaml:"cache_bytes"`
	// CacheTTL is how long cached objects are trusted (default 5s).
	CacheTTL Duration `yaml:"cache_ttl"`
}

type TelemetryConfig struct {
	LogLevel  string `yaml:"log_level"`  // debug | info (default) | warn | error
	LogFormat string `yaml:"log_format"` // json (default) | text
	Metrics   bool   `yaml:"metrics"`    // expose Prometheus metrics
	// MetricsListen serves /metrics on a separate address (recommended in prod).
	MetricsListen string `yaml:"metrics_listen"`
	// AccessLog logs every request (default false).
	AccessLog bool `yaml:"access_log"`
}

type WarehouseConfig struct {
	Sources map[string]WarehouseSource `yaml:"sources"`
	// DefaultSource name (default "default", or the only source).
	DefaultSource string `yaml:"default_source"`
	// AllowRawSQL permits ad-hoc SQL from sites (default false).
	AllowRawSQL bool `yaml:"allow_raw_sql"`
	// AllowAnyStatement disables the SELECT/WITH-only guard (default false).
	AllowAnyStatement bool                  `yaml:"allow_any_statement"`
	Queries           map[string]NamedQuery `yaml:"queries"`
	MaxRows           int                   `yaml:"max_rows"` // default 10000
	Timeout           Duration              `yaml:"timeout"`  // default 60s
}

type WarehouseSource struct {
	// Type: bigquery | postgres | athena.
	Type        string `yaml:"type"`
	Description string `yaml:"description"`
	// bigquery
	ProjectID       string `yaml:"project_id"`
	Location        string `yaml:"location"`
	MaxBytesBilled  int64  `yaml:"max_bytes_billed"`
	CredentialsFile string `yaml:"credentials_file"`
	// postgres (also Redshift, AlloyDB, Aurora, …)
	DSN string `yaml:"dsn"`
	// athena
	Region         string `yaml:"region"`
	Workgroup      string `yaml:"workgroup"`
	Database       string `yaml:"database"`
	Catalog        string `yaml:"catalog"`
	OutputLocation string `yaml:"output_location"`
}