auth

type Config struct {
	Enabled         bool     `yaml:"enabled" json:"enabled"`
	CookieName      string   `yaml:"cookieName" json:"cookieName"`
	SessionTTLHours int      `yaml:"sessionTTLHours,omitempty" json:"sessionTTLHours,omitempty"` // cookie/session lifetime; default 168h (7 days)
	DefaultUsername string   `yaml:"defaultUsername" json:"defaultUsername"`
	IpHashKey       string   `yaml:"ipHashKey" json:"ipHashKey"`
	TrustedProxies  []string `yaml:"trustedProxies" json:"trustedProxies"`
	RedirectPath    string   `yaml:"redirectPath" json:"redirectPath"`
	// New unified model
	OAuth *OAuth `yaml:"oauth" json:"oauth"`
	Local *Local `yaml:"local" json:"local"`
	JWT   *JWT   `yaml:"jwt" json:"jwt,omitempty"`
}

type JWT struct {
	Enabled bool `yaml:"enabled" json:"enabled"`
	// RSA holds one or more scy resource URLs pointing to RSA public keys (PEM).
	// Example: "/path/to/public.pem" or "scy://secret/public_key|blowfish://default"
	RSA []string `yaml:"rsa,omitempty" json:"rsa,omitempty"`
	// HMAC is a scy resource URL pointing to the HMAC shared secret.
	HMAC string `yaml:"hmac,omitempty" json:"hmac,omitempty"`
	// CertURL is a JWKS endpoint URL for key discovery (alternative to RSA/HMAC).
	CertURL string `yaml:"certURL,omitempty" json:"certURL,omitempty"`
	// RSAPrivateKey is a scy resource URL pointing to the RSA private key for signing.
	// Only needed when the server itself signs tokens (e.g. for local JWT issuance).
	RSAPrivateKey string `yaml:"rsaPrivateKey,omitempty" json:"rsaPrivateKey,omitempty"`
}

type Local struct {
	Enabled bool `yaml:"enabled" json:"enabled"`
}

type OAuth struct {
	Mode   string       `yaml:"mode" json:"mode"` // bearer|spa|bff|mixed
	Name   string       `yaml:"name" json:"name"`
	Label  string       `yaml:"label" json:"label"`
	Client *OAuthClient `yaml:"client" json:"client"`
}

type OAuthClient struct {
	ConfigURL      string   `yaml:"configURL" json:"configURL"`       // for bff
	DiscoveryURL   string   `yaml:"discoveryURL" json:"discoveryURL"` // for spa/bearer
	JWKSURL        string   `yaml:"jwksURL" json:"jwksURL"`           // for bearer verifier
	RedirectURI    string   `yaml:"redirectURI" json:"redirectURI"`
	ClientID       string   `yaml:"clientID" json:"clientID"`
	Scopes         []string `yaml:"scopes" json:"scopes"`
	WebUIScopes    []string `yaml:"webUIScopes,omitempty" json:"webUIScopes,omitempty"`
	MobileUIScopes []string `yaml:"mobileUIScopes,omitempty" json:"mobileUIScopes,omitempty"`
	CLIScopes      []string `yaml:"cliScopes,omitempty" json:"cliScopes,omitempty"`
	Issuer         string   `yaml:"issuer" json:"issuer"`       // optional expected iss claim
	Audiences      []string `yaml:"audiences" json:"audiences"` // optional expected aud claim(s)
}

type UserInfo = shared.UserInfo