config

type APIKeyConfig struct {
	Length     int             `yaml:"length"`
	ExpiryTime time.Duration   `yaml:"expiryTime"`
	AllowedIPs []string        `yaml:"allowedIPs"`
	RateLimit  RateLimitConfig `yaml:"rateLimit"`
}

type AuthorizationConfig struct {
	// Source selects where casbin policy (p) and grouping (g) rows live:
	// "database" (gorm-adapter, reading/writing through the host app's own
	// DB — the historical default behavior, kept as the zero-value default
	// for full backward compatibility) or "file" (casbin's built-in
	// file-adapter, reading/writing PolicyPath).
	Source string `yaml:"source" validate:"omitempty,oneof=database file"`

	// ModelPath, if set, loads the casbin RBAC model from this file instead
	// of the package's embedded default (rbacModelConf). Most hosts should
	// leave this empty.
	ModelPath string `yaml:"modelPath"`

	// PolicyPath is the casbin policy CSV path, required only when
	// Source == "file".
	PolicyPath string `yaml:"policyPath" validate:"required_if=Source file"`

	// MiddlewareEnabled preserves the old no-op-if-disabled behavior of
	// AuthMiddleware.RequireRole/RequirePermission — when false (the
	// default), those two middlewares are no-ops regardless of what's in
	// the enforcer, exactly like the old MiddlewareConfig.AuthorizationEnabled
	// flag. The enforcer itself is always constructed now (AuthorizationManager
	// needs it unconditionally for role/permission management), so this only
	// gates the two HTTP middlewares, not enforcer construction.
	MiddlewareEnabled bool `yaml:"middlewareEnabled"`

	// ExposeManagementAPI opts a host app into registering the generic
	// /auth/roles, /auth/roles/:name/permissions, etc. HTTP routes (see
	// handlers.NewAuthorizationHandler). Default false — this is a
	// privileged CRUD surface over roles/permissions, not every host wants
	// it registered by default.
	ExposeManagementAPI bool `yaml:"exposeManagementAPI"`
}

type ClerkConfig struct {
	APIKey      string `yaml:"apiKey"`
	APIEndpoint string `yaml:"apiEndpoint"`
	FrontendAPI string `yaml:"frontendAPI"`
}

type Config struct {
	JWT                     JWTConfig                    `yaml:"jwt"`
	Backends                []string                     `yaml:"backends" validate:"required"`
	PasswordPolicy          PasswordPolicyConfig         `yaml:"passwordPolicy"`
	APIKey                  APIKeyConfig                 `yaml:"apiKey"`
	Social                  SocialConfig                 `yaml:"social"`
	Clerk                   ClerkConfig                  `yaml:"clerk"`
	Authorization           AuthorizationConfig          `yaml:"authorization"`
	Providers               map[string]map[string]string `yaml:"providers"`
	UserMigrationScriptPath string                       `yaml:"userMigrationScriptPath"`

	// EventsTopic is the Kafka topic auth lifecycle events (login,
	// password reset/changed, user created/updated/deleted — see
	// emitter.AuthEventData.EventType for the specific values) are
	// published to. Left empty, EmitAuthEvent is a no-op: the same
	// "not configured yet" posture other optional Kafka producers in
	// this codebase use, rather than publishing to a topic named after
	// the event type itself (which no broker provisions and fails with
	// "topic or partition does not exist").
	EventsTopic string `yaml:"eventsTopic"`
}

type ErrInvalidSocialConfig struct {
	Provider string
}

type JWTConfig struct {
	Algorithm          string        `yaml:"algorithm"`
	AccessTokenSecret  string        `yaml:"accessTokenSecret"`
	RefreshTokenSecret string        `yaml:"refreshTokenSecret"`
	PrivateKeyPEM      string        `yaml:"privateKeyPEM"`
	PublicKeyPEM       string        `yaml:"publicKeyPEM"`
	KeyID              string        `yaml:"keyId"`
	AccessTokenExpiry  time.Duration `yaml:"accessTokenExpiry"`
	RefreshTokenExpiry time.Duration `yaml:"refreshTokenExpiry"`
}

type PasswordPolicyConfig struct {
	MinLength      int  `yaml:"minLength"`
	RequireUpper   bool `yaml:"requireUpper"`
	RequireLower   bool `yaml:"requireLower"`
	RequireNumber  bool `yaml:"requireNumber"`
	RequireSpecial bool `yaml:"requireSpecial"`
}

type RateLimitConfig struct {
	Enabled  bool          `yaml:"enabled"`
	Requests int           `yaml:"requests"`
	Period   time.Duration `yaml:"period"`
}

type SocialConfig struct {
	Enabled   bool                            `yaml:"enabled"`
	Providers map[string]SocialProviderConfig `yaml:"providers" validate:"omit_empty,dive"`
}

type SocialProviderConfig struct {
	ClientID     string   `yaml:"clientID" validate:"required"`
	ClientSecret string   `yaml:"clientSecret" validate:"required"`
	RedirectURL  string   `yaml:"redirectURL" validate:"required"`
	Scopes       []string `yaml:"scopes" validate:"required"`
}