resourceproxy

type Config struct {
	// Listen is the inbound listener.
	Listen string
	// Upstream is the stock server. Its path, if any, is where the
	// resource's own path maps to: upstream http://127.0.0.1:8081/mcp for
	// resource https://h/metrics sends /metrics to /mcp and /metrics/x to
	// /mcp/x.
	Upstream string
	// IssuerURL, ResourceURL and Scope configure identity/resource.
	IssuerURL   string
	ResourceURL string
	Scope       string

	// MaxRequestBytes caps a request body; more is refused with 413.
	MaxRequestBytes int64
	// BodyReadTimeout bounds reading one request body.
	BodyReadTimeout time.Duration
	// UpstreamTimeout bounds the wait for the stock server's response
	// headers. A streamed response is not bounded by it.
	UpstreamTimeout time.Duration

	// Outbound side. Empty OutboundListen turns it off.
	OutboundListen        string
	OutboundTarget        string
	OutboundTokenEndpoint string
	OutboundClientID      string
	OutboundAudience      string
	OutboundSATokenFile   string
	// OutboundCAFile is a PEM bundle appended to the system roots for the
	// outbound forwarder's connection to OutboundTarget, and only that
	// one: the issuer and the token exchange keep the system roots alone.
	OutboundCAFile string
	// OutboundAllowNonLoopback lets the outbound listener bind anything
	// but loopback. Anyone who can reach it borrows this workload's
	// identity, so it is refused unless asked for by name.
	OutboundAllowNonLoopback bool
	// RefreshBefore is how long before expiry a token is exchanged again.
	RefreshBefore time.Duration
}

type Inbound struct {
	// contains filtered or unexported fields
}

type Outbound struct {
	// contains filtered or unexported fields
}

type TokenSource struct {
	// contains filtered or unexported fields
}