config

const (
	// KeyAuditBackend is the Viper key for the audit backend type (sql or dynamodb).
	KeyAuditBackend = "audit.backend"
	// KeyAuditDynamoDBTableName is the Viper key for the DynamoDB audit table name.
	KeyAuditDynamoDBTableName = "audit.dynamodb.table_name"
	// KeyAuditDynamoDBTTLDays is the Viper key for DynamoDB audit entry TTL in days.
	KeyAuditDynamoDBTTLDays = "audit.dynamodb.ttl_days"
	// KeyAuditSQLDSN is the Viper key for the SQL audit connection DSN.
	KeyAuditSQLDSN = "audit.sql.dsn"
)

const (
	// DefaultDynamoDBTableName is the default DynamoDB table name for audit logs.
	DefaultDynamoDBTableName = "audit_logs"

	// DefaultDynamoDBTTLDays is the default TTL in days for DynamoDB audit entries.
	// 90 days provides sufficient audit history for compliance while managing storage costs.
	DefaultDynamoDBTTLDays = 90

	// MaxDynamoDBTTLDays is the maximum allowed TTL in days for DynamoDB audit entries.
	MaxDynamoDBTTLDays = 365
)

const (
	// ConfigRootLinux is the default config directory root on Linux.
	ConfigRootLinux = "/etc/"
	// ConfigRootWindows is the default config directory root on Windows.
	ConfigRootWindows = "C:\\ProgramData\\"
	// ConfigRootDarwin is the default config directory root on macOS.
	ConfigRootDarwin = "/Library/Application Support/"
	// ConfigFileName is the base name of the config file (without extension).
	ConfigFileName = "config"
	// ConfigFileExtension is the config file extension used by Viper.
	ConfigFileExtension = "yaml"
	// KeyAWSRegion is the Viper key for the AWS region setting.
	KeyAWSRegion = "aws_region"
)

const (
	// KeyFIPSEnabled is the Viper key for enabling FIPS 140 mode.
	KeyFIPSEnabled = "fips.enabled"
	// KeyFIPSMode is the Viper key for the FIPS mode (on or only).
	KeyFIPSMode = "fips.mode"
)

const (
	// KeyLoggerLevel is the Viper key for the log level.
	KeyLoggerLevel = "logger.level"
	// KeyLoggerFormat is the Viper key for the log format (e.g. json, text).
	KeyLoggerFormat = "logger.format"
)

const (
	// KeyOIDCAudience is the Viper key for the OIDC token audience.
	KeyOIDCAudience = "oidc.audience"
	// DefaultOIDCAudience is the default audience value when not set.
	DefaultOIDCAudience = "gate"
)

const (
	// KeyOriginEnabled is the Viper key for enabling origin verification.
	KeyOriginEnabled = "origin.enabled"
	// KeyOriginHeaderName is the Viper key for the origin verification header name.
	KeyOriginHeaderName = "origin.header_name"
	// KeyOriginHeaderValue is the Viper key for the expected origin verification header value.
	KeyOriginHeaderValue = "origin.header_value"
)

const (
	// KeyOTelEnabled is the Viper key for enabling the OpenTelemetry pipeline.
	KeyOTelEnabled = "otel.enabled"
	// KeyOTelServiceName is the Viper key for the OTel service.name resource attribute.
	KeyOTelServiceName = "otel.service_name"
	// KeyOTelEndpoint is the Viper key for the OTLP/gRPC collector endpoint.
	KeyOTelEndpoint = "otel.endpoint"
	// KeyOTelProtocol is the Viper key for the OTLP transport protocol (only "grpc" is supported).
	KeyOTelProtocol = "otel.protocol"
	// KeyOTelInsecure is the Viper key for disabling TLS on the OTLP/gRPC connection.
	KeyOTelInsecure = "otel.insecure"
	// KeyOTelSampleRate is the Viper key for the trace sampler ratio (0.0-1.0).
	KeyOTelSampleRate = "otel.sample_rate"
	// KeyOTelExporterTimeout is the Viper key for the OTLP exporter timeout.
	KeyOTelExporterTimeout = "otel.exporter_timeout"

	// DefaultOTelServiceName is the default service.name when not set.
	DefaultOTelServiceName = "gate"
	// DefaultOTelEndpoint is the default OTLP/gRPC collector endpoint.
	DefaultOTelEndpoint = "localhost:4317"
	// DefaultOTelProtocol is the only supported OTLP transport.
	DefaultOTelProtocol = "grpc"
	// DefaultOTelInsecure requires explicit opt-in to plaintext connections.
	DefaultOTelInsecure = false
	// DefaultOTelSampleRate is the default trace sampler ratio.
	DefaultOTelSampleRate = 1.0
	// DefaultOTelExporterTimeout is the default OTLP exporter timeout.
	DefaultOTelExporterTimeout = 10 * time.Second
)

const (
	// KeyPolicyVersion is the Viper key for the policy schema version.
	KeyPolicyVersion = "policy.version"
	// KeyPolicyTrustPolicyPath is the Viper key for the trust policy file path.
	KeyPolicyTrustPolicyPath = "policy.trust_policy_path"
	// KeyPolicyDefaultTokenTTL is the Viper key for the default token TTL in seconds.
	KeyPolicyDefaultTokenTTL = "policy.default_token_ttl"
	// KeyPolicyMaxTokenTTL is the Viper key for the maximum token TTL in seconds.
	KeyPolicyMaxTokenTTL = "policy.max_token_ttl"
	// KeyPolicyRequireExplicitPolicy is the Viper key for requiring an explicit matching policy.
	KeyPolicyRequireExplicitPolicy = "policy.require_explicit_policy"
	// KeyPolicyGitHubAPIBaseURL is the Viper key for the GitHub API base URL.
	KeyPolicyGitHubAPIBaseURL = "policy.github_api_base_url"
	// KeyPolicyGitHubRawBaseURL is the Viper key for the GitHub raw content base URL.
	KeyPolicyGitHubRawBaseURL = "policy.github_raw_base_url"
	// KeyPolicyProviders is the Viper key for the OIDC provider list.
	KeyPolicyProviders = "policy.providers"
	// KeyPolicyMaxPermissions is the Viper key for the maximum allowed permissions map.
	KeyPolicyMaxPermissions = "policy.max_permissions"

	// DefaultPolicyVersion is the default policy schema version.
	DefaultPolicyVersion = "1.0"
	// DefaultPolicyDefaultTokenTTL is the default token TTL in seconds.
	DefaultPolicyDefaultTokenTTL = 900
	// DefaultPolicyMaxTokenTTL is the default maximum token TTL in seconds.
	DefaultPolicyMaxTokenTTL = 3600
	// DefaultGitHubAPIBaseURL is the default GitHub API base URL.
	DefaultGitHubAPIBaseURL = "https://api.github.com"
	// DefaultGitHubRawBaseURL is the default GitHub raw content base URL.
	DefaultGitHubRawBaseURL = "https://raw.githubusercontent.com"
)

const (
	// KeySelectorType is the Viper key for the selector store type (memory, redis, or dynamodb).
	KeySelectorType = "selector.type"
	// KeySelectorRedisAddress is the Viper key for the Redis server address.
	KeySelectorRedisAddress = "selector.redis.address"
	// KeySelectorRedisPassword is the Viper key for the Redis password.
	KeySelectorRedisPassword = "selector.redis.password" // #nosec G101 -- config key name, not a credential
	// KeySelectorRedisDB is the Viper key for the Redis database index.
	KeySelectorRedisDB = "selector.redis.db"
	// KeySelectorRedisTLS is the Viper key for enabling TLS to Redis.
	KeySelectorRedisTLS = "selector.redis.tls"
	// KeySelectorDynamoDBTableName is the Viper key for the selector DynamoDB table name.
	KeySelectorDynamoDBTableName = "selector.dynamodb.table_name"
	// KeySelectorDynamoDBTTLMinutes is the Viper key for selector DynamoDB entry TTL in minutes.
	KeySelectorDynamoDBTTLMinutes = "selector.dynamodb.ttl_minutes"
)

const (
	// DefaultSelectorStoreType is the default selector store when type is not set (in-memory).
	DefaultSelectorStoreType = SelectorStoreTypeMemory
	// DefaultRedisDB is the default Redis database index when not set.
	DefaultRedisDB = 0
)

const (
	// KeyServerPort is the Viper key for the server listen port.
	KeyServerPort = "server.port"
	// KeyServerReadTimeout is the Viper key for the HTTP read timeout.
	KeyServerReadTimeout = "server.read_timeout"
	// KeyServerWriteTimeout is the Viper key for the HTTP write timeout.
	KeyServerWriteTimeout = "server.write_timeout"
	// KeyServerShutdownTimeout is the Viper key for the server shutdown timeout.
	KeyServerShutdownTimeout = "server.shutdown_timeout"
	// KeyServerRequestTimeout is the Viper key for the per-request timeout.
	KeyServerRequestTimeout = "server.request_timeout"
	// KeyServerIdleTimeout is the Viper key for the HTTP idle (keep-alive) timeout.
	KeyServerIdleTimeout = "server.idle_timeout"
	// KeyServerWaitTimeout is the Viper key for the graceful shutdown wait timeout.
	KeyServerWaitTimeout = "server.wait_timeout"
	// KeyServerTLSCertFilePath is the Viper key for the TLS certificate file path.
	KeyServerTLSCertFilePath = "server.tls.cert_file_path"
	// KeyServerTLSKeyFilePath is the Viper key for the TLS private key file path.
	KeyServerTLSKeyFilePath = "server.tls.key_file_path"

	// DefaultServerPort is the default HTTP listen port.
	DefaultServerPort = 8080
	// DefaultServerReadTimeout is the default HTTP read timeout.
	DefaultServerReadTimeout = 30 * time.Second
	// DefaultServerWriteTimeout is the default HTTP write timeout.
	DefaultServerWriteTimeout = 30 * time.Second
	// DefaultServerShutdownTimeout is the default server shutdown timeout.
	DefaultServerShutdownTimeout = 10 * time.Second
	// DefaultServerRequestTimeout is the default per-request timeout.
	DefaultServerRequestTimeout = 30 * time.Second
	// DefaultServerIdleTimeout is the default HTTP idle timeout.
	DefaultServerIdleTimeout = 10 * time.Second
	// DefaultServerWaitTimeout is the default graceful shutdown wait duration.
	DefaultServerWaitTimeout = 10 * time.Second
)

const (
	// MaxSelectorDynamoDBTTLMinutes is the maximum TTL in minutes
	// for selector DynamoDB entries (24 hours).
	MaxSelectorDynamoDBTTLMinutes = 1440
)