config

type Config struct {
	// StoreURI selects the backing store via a URI scheme. Examples:
	//   sqlite:/tmp/aibrix-console.db                   (file-backed, dev default)
	//   sqlite:/var/lib/aibrix/console.db               (file-backed, absolute)
	//   sqlite::memory:                                 (in-memory SQLite)
	//   memory://                                       (alias for in-memory SQLite)
	//   mysql://user:pass@host:3306/aibrix              (production)
	// Future: postgres://, redis://, mongodb:// — add a case in store.NewFromURI.
	StoreURI string

	// GatewayEndpoint is the AIBrix gateway URL for proxying inference requests.
	GatewayEndpoint string
	// MetadataServiceURL is the metadata service URL for file proxy operations.
	MetadataServiceURL string
	// DefaultBatchModelDeploymentTemplate is injected as aibrix.model_template
	// on CreateJob requests when the caller does not provide one. Temporary
	// stop-gap until the Model entity carries a per-model batch_template.
	DefaultBatchModelDeploymentTemplate string
	// Provisioner selects which RM provisioner backend the planner should
	// use at runtime. Forwarded to resource_manager.NewResourceManager
	// which validates against the supported set defined in
	// resource_manager/types.ResourceProvisionType*
	Provisioner string
	// PlanningPolicy is the policy type to use for the planner.
	PlanningPolicy string
	// PlannerWorkerCount is the number of worker threads to use for the planner.
	// Defaults to 10.
	PlannerWorkerCount int

	// GRPCAddr is the listen address for the gRPC server.
	GRPCAddr string
	// HTTPAddr is the listen address for the HTTP gateway.
	HTTPAddr string

	// AuthMode controls authentication: "dev", "oidc", or "basic".
	AuthMode string
	// OIDCIssuerURL is the OIDC provider issuer URL.
	OIDCIssuerURL string
	// OIDCClientID is the OIDC client identifier.
	OIDCClientID string
	// OIDCClientSecret is the OIDC client secret.
	OIDCClientSecret string
	// OIDCRedirectURL is the OIDC redirect URL after authentication.
	OIDCRedirectURL string
	// OIDCPostLogoutRedirectURL is the URL the OIDC provider should send
	// the browser to after end-session is complete. Must be registered as
	// a post-logout redirect URI in the SSO console.
	OIDCPostLogoutRedirectURL string
	// OIDCEndSessionURL is a fallback for the provider's end-session
	// endpoint when it isn't advertised in the discovery document. Set
	// it explicitly (e.g. https://${sso}/oidc/v1/logout) to enable
	// RP-initiated logout against IdPs that don't publish the URL.
	OIDCEndSessionURL string
	// OIDCGroupsClaim is the ID-token claim name that carries the user's
	// group memberships (string array). Defaults to "groups".
	OIDCGroupsClaim string
	// OIDCAdminGroups is a comma-separated list of group names that map
	// to the "admin" role. Users not in any of these groups receive the
	// "viewer" role. Empty means every authenticated user is "viewer".
	OIDCAdminGroups string
	// OIDCAdminEmails is a comma-separated list of email addresses that
	// map to the "admin" role regardless of group membership. Useful for
	// IdPs whose ID tokens don't carry a groups claim (e.g. our internal
	// SSO) — operators can still grant admin without per-user IdP changes.
	OIDCAdminEmails string
	// OIDCSigningAlg overrides the ID-token signing algorithm. Defaults to
	// RS256 (verified via the provider's JWKS). Set to "HS256" for IdPs
	// that sign ID tokens with the client_secret as a shared HMAC key —
	// at the time of writing, the company SSO documents this as the only
	// supported algorithm for its default Authorization Server.
	OIDCSigningAlg string

	// SessionSecret is used to sign session cookies. Must be provided via
	// SESSION_SECRET env var in non-dev modes; generated randomly in dev mode.
	SessionSecret string

	// SecretsEncryptionKey is the 32-byte hex-encoded AES-256 key used to
	// encrypt stored secret values. Must be provided via SECRETS_ENCRYPTION_KEY
	// env var in non-dev modes; generated randomly in dev mode.
	SecretsEncryptionKey string

	// DevUserName is the display name used in dev auth mode.
	DevUserName string
	// DevUserEmail is the email address used in dev auth mode.
	DevUserEmail string

	// BasicUsername is the username for basic auth mode.
	BasicUsername string
	// BasicPassword is the password for basic auth mode.
	BasicPassword string

	// StaticFilesDir is the path to the frontend dist/ directory.
	// When empty, static file serving is disabled.
	StaticFilesDir string

	// AllowedOrigins is a comma-separated list of allowed CORS origins.
	// When empty, CORS is disabled (same-origin only).
	AllowedOrigins string

	// DevMode toggles development conveniences. Currently it controls demo-data
	// seeding on startup; future dev-only behaviors should hang off the same
	// flag so a single switch covers the "I'm running this locally" intent.
	DevMode bool

	// ErrorInjectionEnabled controls whether error injection is enabled.
	ErrorInjectionEnabled bool
}