config

type AdminAPI struct {
	// Cookies contain cookie settings for the csrf, session, and refresh cookies.
	Cookies *Cookies `json:"cookies,omitempty"`
	// Origins holds configuration for CORS origins. In addition, Origins other than the allowed ones
	// will be rejected with a 403 response.
	Origins *Origins `json:"origins,omitempty"`
	// TLS holds configuration for TLS settings for the admin API.
	TLS *ServerTLS `json:"tls,omitempty"`
}

type AdminConfig struct {
	SuperUser *SuperUser `json:"superUser"`
	API       *AdminAPI  `json:"api,omitempty"`
}

type AuthConfig struct {
	Methods *AuthMethods `json:"methods"`
	Scheme  *AuthScheme  `json:"scheme"`
	Order   int          `json:"order"`
}

type AuthMapping struct {
	Backend       string   `json:"backend"`
	Method        string   `json:"method"`
	Exempt        []string `json:"exempt"`
	Authorization *AuthZ   `json:"authorization"`
}

type AuthMethodBasic struct {
	API *AuthMethodBasicAPI `json:"api,omitempty"`
}

type AuthMethodBasicAPI struct {
	Cookies *Cookies `json:"cookies,omitempty"`
	Origins *Origins `json:"origins,omitempty"`
}

type AuthMethods struct {
	Basic *AuthMethodBasic `json:"basic"`
}

type AuthScheme struct {
	Mappings []*AuthMapping `json:"mappings"`
}

type AuthZ struct {
	Groups []string            `json:"groups"`
	Paths  map[string][]string `json:"paths"`
}

type BackendTLS struct {
	// RootCAFile is the path to a PEM-encoded CA bundle used to verify the backend's certificate.
	// When empty, the system certificate pool is used.
	RootCAFile string `json:"rootCAFile,omitempty"`
	// ClientCertFile and ClientKeyFile enable mTLS.
	// Both must be set together.
	ClientCertFile string `json:"clientCertFile,omitempty"`
	ClientKeyFile  string `json:"clientKeyFile,omitempty"`
	// InsecureSkipVerify disables server certificate verification.
	// Must only be used in non-production environments.
	InsecureSkipVerify bool `json:"insecureSkipVerify,omitempty"`
}

type ConnectorConfig struct {
	// Origins holds configuration for CORS origins. In addition, Origins other than the allowed ones
	// will be rejected with a 403 response.
	Origins *Origins `json:"origins,omitempty"`

	// Persistence holds configuration for the persistence layer.
	Persistence *PersistenceConfig `json:"persistence"`

	// TLS holds configuration for the server TLS settings.
	TLS *ServerTLS `json:"tls,omitempty"`

	// TargetTLS holds configuration for the target TLS settings.
	TargetTLS *TargetTLS `json:"targetTls,omitempty"`
}

type Cookies struct {
	// Domain is the domain setting for cookies, this translates directly to Domain=<value> for cookies.
	Domain string `json:"domain,omitempty"`
	// SameSite is the SameSite setting for cookies, this translates directly to SameSite=<value> for cookies.
	SameSite string `json:"sameSite,omitempty"`
}

type GatewayConfig struct {
	Router *Router    `json:"router"`
	TLS    *ServerTLS `json:"tls,omitempty"`
}

type OASBackendMapping struct {
	Backend       string                 `json:"backend"`
	Specification string                 `json:"specification"`
	Options       *OASBackendMappingOpts `json:"options"`
}

type OASBackendMappingOpts struct {
	ValidateBody bool `json:"validateBody"`
}

type OASConfig struct {
	Order    int                  `json:"order"`
	Mappings []*OASBackendMapping `json:"mappings"`
}

type ObservabilityConfig struct {
	Enabled        bool `json:"enabled"`
	RuntimeMetrics bool `json:"runtimeMetrics"`
}

type Origins struct {
	// AllowedOrigins is a list of allowed origins for CORS.
	AllowedOrigins []string `json:"allowedOrigins,omitempty"`
	// AllowAll indicates whether to allow all origins for CORS. Mutually exclusive with 'allowedOrigins'.
	// AllowAll will mean the Access-Control-Allow-Origin header is set to whatever Origin was received.
	AllowAll bool `json:"allowAll,omitempty"`
	// DenyAll denies any request with an Origin header, effectively disabling cross-site access.
	// Mutually exclusive with 'allowedOrigins' and 'allowAll'.
	DenyAll bool `json:"denyAll,omitempty"`
}

type PersistenceConfig struct {
	// Driver selects the database backend: "sqlite" or "postgres".
	Driver string `json:"driver"`
	// Address is the database address. For postgres: host. For sqlite: file path.
	Address string `json:"address"`

	// Postgres contains specific configuration for the postgres driver. Ignored for other drivers.
	*Postgres `json:"postgres,omitempty"`
}

type Postgres struct {
	// Database is the database name (postgres only).
	Database string `json:"database"`
	// Username is the database user (postgres only).
	Username *string `json:"username,omitempty"`
	// Password is the database password (postgres only).
	Password *string `json:"password,omitempty"`
	// SSLMode controls TLS for postgres connections (e.g. "disable", "require", "verify-full").
	SSLMode *string `json:"sslMode,omitempty"`
}

type RootConfig struct {
	*GatewayConfig       `json:"gateway"`
	*ObservabilityConfig `json:"observability"`
	*AdminConfig         `json:"admin"`
	*OASConfig           `json:"oas,omitempty"`
	*AuthConfig          `json:"auth,omitempty"`
	*PersistenceConfig   `json:"persistence,omitempty"`
	// contains filtered or unexported fields
}

type Router struct {
	Backends []*RouterBackend `json:"backends"`
}

type RouterBackend struct {
	Name      string `json:"name"`
	Host      string `json:"host"`
	Port      int    `json:"port"`
	TimeoutMs int    `json:"timeout,omitempty"`
	// Origins holds configuration for CORS origins. In addition, Origins other than the allowed ones
	// will be rejected with a 403 response.
	Origins *Origins    `json:"origins,omitempty"`
	TLS     *BackendTLS `json:"tls,omitempty"`
}

type ServerTLS struct {
	CertFile string `json:"serverCertFile"`
	KeyFile  string `json:"serverKeyFile"`
}

type SuperUser struct {
	ClientID     string `json:"clientId"`
	ClientSecret string `json:"clientSecret"`
}

type TargetTLS struct {
	// RootCAFile is the path to a PEM-encoded CA bundle used to verify the target's certificate.
	// When empty, the system certificate pool is used.
	RootCAFile string `json:"rootCAFile,omitempty"`
	// InsecureSkipVerify indicates whether to skip TLS verification for the target.
	InsecureSkipVerify bool `json:"insecureSkipVerify,omitempty"`
}