config

type APIKeyConfig struct {
	APIKeysPerUserPerAPI int    `koanf:"api_keys_per_user_per_api"` // Number of API keys allowed per user per API
	Algorithm            string `koanf:"algorithm"`                 // Hashing algorithm to use
	MinKeyLength         int    `koanf:"min_key_length"`            // Minimum length for external API key values
	MaxKeyLength         int    `koanf:"max_key_length"`            // Maximum length for external API key values
	// Issuer identifies this gateway's portal; when non-empty, only API keys whose
	// issuer field matches (or is null) will be accepted by the api-key-auth policy.
	Issuer string `koanf:"issuer"`
}

type APIValidator struct {
	// contains filtered or unexported fields
}

type AccessLogsConfig struct {
	Enabled    bool              `koanf:"enabled"`
	Format     string            `koanf:"format"`      // "json" or "text"
	JSONFields map[string]string `koanf:"json_fields"` // JSON log format fields
	TextFormat string            `koanf:"text_format"` // Text log format template
}

type AdminServerConfig struct {
	Enabled    bool             `koanf:"enabled"`
	Port       int              `koanf:"port"`
	AllowedIPs []string         `koanf:"allowed_ips"`
	Pprof      PprofConfig      `koanf:"pprof"`
	ConfigDump ConfigDumpConfig `koanf:"config_dump"`
}

type AnalyticsConfig struct {
	Enabled           bool                      `koanf:"enabled"`
	EnabledPublishers []string                  `koanf:"enabled_publishers"`
	Publishers        AnalyticsPublishersConfig `koanf:"publishers"`
	// GRPCEventServerCfg is a deprecated alias. ALS transport tuning moved to
	// [collector.server]; when set here it is migrated onto the collector during
	// validation (with a warning). Prefer [collector.server].
	GRPCEventServerCfg GRPCEventServerConfig `koanf:"grpc_event_server"`
	// AllowPayloads, SendRequestBody and SendResponseBody are deprecated aliases.
	// Body/header capture now lives under [collector]. When set, these are mapped
	// onto collector.request_body / collector.response_body during
	// validation (with a warning) for backward compatibility. Prefer the
	// [collector] fields directly.
	AllowPayloads    bool `koanf:"allow_payloads"`
	SendRequestBody  bool `koanf:"send_request_body"`
	SendResponseBody bool `koanf:"send_response_body"`
}

type AnalyticsPublishersConfig struct {
	Moesif MoesifPublisherConfig `koanf:"moesif"`
}

type AuthConfig struct {
	Basic BasicAuth `koanf:"basic"`
	IDP   IDPConfig `koanf:"idp"`
}

type AuthUser struct {
	Username       string   `koanf:"username"`
	Password       string   `koanf:"password"`        // plain or hashed value depending on PasswordHashed
	PasswordHashed bool     `koanf:"password_hashed"` // true when Password is a bcrypt hash
	Roles          []string `koanf:"roles"`
}

type BasicAuth struct {
	Enabled bool       `koanf:"enabled"`
	Users   []AuthUser `koanf:"users"`
}

type CollectorConfig struct {
	// RequestBody / ResponseBody capture request/response bodies into the
	// collected event.
	RequestBody  bool `koanf:"request_body"`
	ResponseBody bool `koanf:"response_body"`
	// RequestHeaders / ResponseHeaders, when true, make the collector
	// capture ALL request / response headers, so every API's headers flow into
	// the collected event without attaching a per-API header policy.
	RequestHeaders  bool `koanf:"request_headers"`
	ResponseHeaders bool `koanf:"response_headers"`
	// IgnorePathPrefixes lists request path prefixes for which the collector
	// produces no analytics event and no traffic-log line at all, as if the
	// collector were disabled for that one request (e.g. health-check or
	// metrics-scrape endpoints). Enforced by attaching an Envoy AccessLogFilter
	// to the ALS access log (see xds.buildIgnorePathsAccessLogFilter) — Envoy
	// itself never emits the log entry for a matching path, so the policy-engine
	// never receives the request at all. Matched case-sensitively by prefix.
	IgnorePathPrefixes []string `koanf:"ignore_path_prefixes"`
	// Server tunes the Envoy→policy-engine gRPC access-log (ALS)
	// transport that ships collected data. It is part of the collector and is
	// configured under the shared [collector.server] section (the policy-engine reads
	// the same section to configure its receiving ALS server).
	Server GRPCEventServerConfig `koanf:"server"`
}

type Config struct {
	Controller           Controller             `koanf:"controller"`
	Router               RouterConfig           `koanf:"router"`
	PolicyEngine         map[string]interface{} `koanf:"policy_engine"`
	PolicyConfigurations map[string]interface{} `koanf:"policy_configurations"`
	Collector            CollectorConfig        `koanf:"collector"`
	Analytics            AnalyticsConfig        `koanf:"analytics"`
	TrafficLogging       TrafficLoggingConfig   `koanf:"traffic_logging"`
	TracingConfig        TracingConfig          `koanf:"tracing"`
	APIKey               APIKeyConfig           `koanf:"api_key"`
	// Subscriptions controls application-level subscription behaviour for APIs.
	// When nil, subscription validation system policy remains disabled.
	Subscriptions    *SubscriptionsConfig   `koanf:"subscriptions"`
	ImmutableGateway ImmutableGatewayConfig `koanf:"immutable_gateway"`
	MCP              MCPConfig              `koanf:"mcp"`
}

type ConfigDumpConfig struct {
	Enabled bool `koanf:"enabled"`
}

type ControlPlaneConfig struct {
	Host                  string        `koanf:"host"`                    // Control plane hostname
	Token                 string        `koanf:"token"`                   // Registration token (api-key)
	ReconnectInitial      time.Duration `koanf:"reconnect_initial"`       // Initial retry delay
	ReconnectMax          time.Duration `koanf:"reconnect_max"`           // Maximum retry delay
	PollingInterval       time.Duration `koanf:"polling_interval"`        // Reconciliation polling interval
	InsecureSkipVerify    bool          `koanf:"insecure_skip_verify"`    // Skip TLS certificate verification (insecure, dev/test only)
	DeploymentSyncEnabled bool          `koanf:"deployment_sync_enabled"` // Enable two-way artifact/deployment sync with the control plane: DP->CP push and CP->DP pull (default: true)
	SyncBatchSize         int           `koanf:"sync_batch_size"`         // Number of deployments to fetch per batch request during startup sync (default: 50)
	// Optional worker pools that cap the concurrency of DP->CP sync work
	APIMSyncPoolSize         int `koanf:"apim_sync_pool_size"`          // Workers for on-prem APIM bottom-up sync (0/unset = unlimited)
	APIMSyncQueueSize        int `koanf:"apim_sync_queue_size"`         // Max pending APIM sync tasks when pool size > 0 (0/unset = unbounded)
	AIWorkspaceSyncPoolSize  int `koanf:"ai_workspace_sync_pool_size"`  // Workers for platform-API (AI Workspace) artifact push (0/unset = unlimited)
	AIWorkspaceSyncQueueSize int `koanf:"ai_workspace_sync_queue_size"` // Max pending artifact push tasks when pool size > 0 (0/unset = unbounded)
	// OAuth2 credentials for on-prem APIM API import (for bottom-up API deployment)
	ApimOAuth2ClientID     string `koanf:"apim_oauth2_client_id"`     // APIM OAuth2 client ID
	ApimOAuth2ClientSecret string `koanf:"apim_oauth2_client_secret"` // APIM OAuth2 client secret
	ApimOAuth2Username     string `koanf:"apim_oauth2_username"`      // APIM resource owner username
	ApimOAuth2Password     string `koanf:"apim_oauth2_password"`      // APIM resource owner password
	GatewayName            string `koanf:"gateway_name"`              // Name of the gateway for deployment configuration
}

type Controller struct {
	Server       ServerConfig       `koanf:"server"`
	AdminServer  AdminServerConfig  `koanf:"admin_server"`
	Storage      StorageConfig      `koanf:"storage"`
	Logging      LoggingConfig      `koanf:"logging"`
	ControlPlane ControlPlaneConfig `koanf:"controlplane"`
	HTTPClient   HTTPClientConfig   `koanf:"http_client"`
	PolicyServer PolicyServerConfig `koanf:"policy_server"`
	Policies     PoliciesConfig     `koanf:"policies"`
	LLM          LLMConfig          `koanf:"llm"`
	Auth         AuthConfig         `koanf:"auth"`
	Metrics      MetricsConfig      `koanf:"metrics"`
	Encryption   EncryptionConfig   `koanf:"encryption"`
	EventHub     EventHubConfig     `koanf:"event_hub"`
}

type DatabaseConfig struct {
	Driver          string            `koanf:"driver"`
	DSN             string            `koanf:"dsn"`
	Path            string            `koanf:"path"`
	Host            string            `koanf:"host"`
	Port            int               `koanf:"port"`
	Database        string            `koanf:"database"`
	User            string            `koanf:"user"`
	Password        string            `koanf:"password"`
	ConnectTimeout  time.Duration     `koanf:"connect_timeout"`
	MaxOpenConns    int               `koanf:"max_open_conns"`
	MaxIdleConns    int               `koanf:"max_idle_conns"`
	ConnMaxLifetime time.Duration     `koanf:"conn_max_lifetime"`
	ConnMaxIdleTime time.Duration     `koanf:"conn_max_idle_time"`
	ApplicationName string            `koanf:"application_name"`
	Options         map[string]string `koanf:"options"`
}

type DownstreamTLS struct {
	CertPath               string `koanf:"cert_path"`
	KeyPath                string `koanf:"key_path"`
	MinimumProtocolVersion string `koanf:"minimum_protocol_version"`
	MaximumProtocolVersion string `koanf:"maximum_protocol_version"`
	Ciphers                string `koanf:"ciphers"`
	// EcdhCurves is a comma-separated list of ECDH curves (e.g. "X25519,P-256"), most preferred
	// first. Defaults to classical curves only — a hybrid post-quantum group (e.g.
	// "X25519MLKEM768") can be added as the first preference, but only as an explicit opt-in per
	// deployment: an already-running Envoy instance that doesn't recognize the curve name will
	// NACK the xDS update and keep serving its last-known-good config, silently freezing that
	// instance out of any further config changes until the operator fixes it. Confirm the
	// deployed Envoy/BoringSSL build supports the group before enabling it.
	EcdhCurves string `koanf:"ecdh_curves"`
}

type EncryptionConfig struct {
	Providers []ProviderConfig `koanf:"providers"`
}

type EncryptionKeyConfig struct {
	Version  string `koanf:"version"` // Key identifier (e.g., "key-v1")
	FilePath string `koanf:"file"`    // Path to raw binary key file
}

type EventHubConfig struct {
	PollInterval    time.Duration          `koanf:"poll_interval"`
	CleanupInterval time.Duration          `koanf:"cleanup_interval"`
	RetentionPeriod time.Duration          `koanf:"retention_period"`
	Database        EventHubDatabaseConfig `koanf:"database"`
}

type EventHubDatabaseConfig struct {
	MaxOpenConns    int           `koanf:"max_open_conns"`
	MaxIdleConns    int           `koanf:"max_idle_conns"`
	ConnMaxLifetime time.Duration `koanf:"conn_max_lifetime"`
	ConnMaxIdleTime time.Duration `koanf:"conn_max_idle_time"`
}

type GRPCEventServerConfig struct {
	Mode string `koanf:"mode"` // Connection mode: "uds" (default) or "tcp"
	// Port overrides the fixed Envoy→policy-engine ALS dial port (collector.ServerPort,
	// 18090), used only in "tcp" mode. Deprecated: no longer defaulted here or documented
	// in config-template.toml/Helm charts, so new deployments have no way to discover or
	// set it. Kept solely so a config that already sets it explicitly keeps working;
	// leave unset (0) to use the fixed port. Must match the policy-engine's
	// collector.server.server_port override, or the two sides will fail to connect.
	Port                int           `koanf:"port"`
	BufferFlushInterval int           `koanf:"buffer_flush_interval"` // Envoy buffer flush interval (nanoseconds)
	BufferSizeBytes     int           `koanf:"buffer_size_bytes"`     // Envoy buffer size
	GRPCRequestTimeout  int           `koanf:"grpc_request_timeout"`  // Envoy gRPC timeout (nanoseconds)
	ShutdownTimeout     time.Duration `koanf:"shutdown_timeout"`      // ALS server shutdown timeout
	PublicKeyPath       string        `koanf:"public_key_path"`       // TLS public key path
	PrivateKeyPath      string        `koanf:"private_key_path"`      // TLS private key path
	ALSPlainText        bool          `koanf:"als_plain_text"`        // Use plaintext gRPC
	MaxMessageSize      int           `koanf:"max_message_size"`      // Max gRPC message size
	MaxHeaderLimit      int           `koanf:"max_header_limit"`      // Max header size
}

type HCMTimeouts struct {
	RequestTimeout        time.Duration `koanf:"request_timeout"`         // HCM request_timeout (default 0s = disabled)
	RequestHeadersTimeout time.Duration `koanf:"request_headers_timeout"` // HCM request_headers_timeout (default 0s = disabled)
	StreamIdleTimeout     time.Duration `koanf:"stream_idle_timeout"`     // HCM stream_idle_timeout (default 5m)
	IdleTimeout           time.Duration `koanf:"idle_timeout"`            // common_http_protocol_options.idle_timeout (default 1h)
}

type HTTPClientConfig struct {
	Pooling  HTTPClientPoolingConfig  `koanf:"pooling"`
	Timeouts HTTPClientTimeoutsConfig `koanf:"timeouts"`
	TLS      HTTPClientTLSConfig      `koanf:"tls"`
	Proxy    HTTPClientProxyConfig    `koanf:"proxy"`
	SSRF     HTTPClientSSRFConfig     `koanf:"ssrf"`
}

type HTTPClientPoolingConfig struct {
	MaxIdleConns        int           `koanf:"max_idle_conns"`
	MaxIdleConnsPerHost int           `koanf:"max_idle_conns_per_host"`
	MaxConnsPerHost     int           `koanf:"max_conns_per_host"`
	IdleConnTimeout     time.Duration `koanf:"idle_conn_timeout"`
	KeepAlive           time.Duration `koanf:"keep_alive"`
	DisableKeepAlives   bool          `koanf:"disable_keep_alives"`
	// EnableHTTP2 opts into HTTP/2. See httpclient.PoolingConfig.EnableHTTP2's doc comment
	// on the HTTP/2 connection-coalescing caveat before enabling.
	EnableHTTP2 bool `koanf:"enable_http2"`
}

type HTTPClientProxyConfig struct {
	// Mode selects how the proxy is determined: "none" (default), "environment"
	// (HTTP_PROXY/HTTPS_PROXY/NO_PROXY), or "url" (URL/Username/Password/NoProxy below).
	Mode     string   `koanf:"mode"`
	URL      string   `koanf:"url"`
	Username string   `koanf:"username"`
	Password string   `koanf:"password"`
	NoProxy  []string `koanf:"no_proxy"` // exact host, ".suffix", or CIDR entries; only used when mode == "url"

	TLS HTTPClientProxyTLSConfig `koanf:"tls"`

	// Egress states how origin-destination SSRF risk is handled when a forward proxy is
	// also configured: "delegated" (trust the proxy's own egress controls) or
	// "manual_connect" (validate the origin locally before ever issuing CONNECT). Must be
	// set explicitly whenever Mode != "none" and SSRF.Enabled — httpclient.New fails
	// closed at startup otherwise rather than silently choosing one.
	Egress string `koanf:"egress"`
}

type HTTPClientProxyTLSConfig struct {
	RootCAFile     string `koanf:"root_ca_file"`
	ClientCertFile string `koanf:"client_cert_file"`
	ClientKeyFile  string `koanf:"client_key_file"`
	// InsecureSkipVerify and InsecureSkipVerifyAcknowledged are deliberately separate
	// fields: httpkit's own acknowledgement gate (httpclient.ProxyTLSConfig) requires an
	// operator to opt into disabling verification twice, once per field, so a single
	// "insecure_skip_verify = true" in TOML can't silently satisfy its own gate. Both must
	// be explicitly set to true for InsecureSkipVerify to take effect.
	InsecureSkipVerify             bool `koanf:"insecure_skip_verify"`
	InsecureSkipVerifyAcknowledged bool `koanf:"insecure_skip_verify_acknowledged"`
}

type HTTPClientSSRFConfig struct {
	Enabled bool `koanf:"enabled"`
	// Preset selects a built-in netguard policy: "permit_private_block_metadata" (a
	// backend that is normally private — a ClusterIP, a service-DNS name, localhost —
	// stays reachable; only link-local/metadata/unspecified/multicast are refused) or
	// "public_only" (stricter: every private/loopback/link-local/CGNAT address is
	// refused, for a URL expected to point at the public internet). Required when Enabled
	// is true. Custom CIDR allow/deny lists have no natural TOML shape and are not
	// exposed here — use the httpclient/netguard packages directly in code for that.
	Preset         string   `koanf:"preset"`
	MaxRedirects   int      `koanf:"max_redirects"`
	AllowedSchemes []string `koanf:"allowed_schemes"` // empty defaults to {"https"}
}

type HTTPClientTLSConfig struct {
	MinVersion       string `koanf:"min_version"`       // one of "TLS1_0".."TLS1_3"
	MaxVersion       string `koanf:"max_version"`       // one of "TLS1_0".."TLS1_3"
	CipherSuites     string `koanf:"cipher_suites"`     // comma-separated Go crypto/tls cipher suite names; TLS 1.2 and below only
	CurvePreferences string `koanf:"curve_preferences"` // comma-separated, e.g. "X25519MLKEM768,X25519,P-256"
	RootCAFile       string `koanf:"root_ca_file"`      // PEM CA bundle; empty uses the system root pool
	ClientCertFile   string `koanf:"client_cert_file"`  // mTLS to the origin; both cert and key must be set together
	ClientKeyFile    string `koanf:"client_key_file"`
}

type HTTPClientTimeoutsConfig struct {
	Overall        time.Duration `koanf:"overall"` // safety-net only; see HTTPClientConfig's doc comment
	Dial           time.Duration `koanf:"dial"`
	TLSHandshake   time.Duration `koanf:"tls_handshake"`
	ResponseHeader time.Duration `koanf:"response_header"`
	ExpectContinue time.Duration `koanf:"expect_continue"`
	// MaxResponseBytes bounds a response body. 0 = package default (10MiB). A negative
	// value is rejected by BuildHTTPClientConfig rather than disabling the bound.
	MaxResponseBytes int64 `koanf:"max_response_bytes"`
}

type HTTPListenerConfig struct {
	ServerHeaderTransformation    string      `koanf:"server_header_transformation"`      // Options: "APPEND_IF_ABSENT", "OVERWRITE", "PASS_THROUGH"
	ServerHeaderValue             string      `koanf:"server_header_value"`               // Custom value for the Server header
	Timeouts                      HCMTimeouts `koanf:"timeouts"`                          // HTTP Connection Manager (downstream) timeouts
	PerConnectionBufferLimitBytes uint32      `koanf:"per_connection_buffer_limit_bytes"` // Downstream per-connection buffer limit in bytes
	DisablePathNormalization      bool        `koanf:"disable_path_normalization"`
	PathWithEscapedSlashesAction  string      `koanf:"path_with_escaped_slashes_action"` // Options: "KEEP_UNCHANGED", "REJECT_REQUEST", "UNESCAPE_AND_REDIRECT", "UNESCAPE_AND_FORWARD"
}

type IDPConfig struct {
	Enabled     bool                `koanf:"enabled"`
	JWKSURL     string              `koanf:"jwks_url"`
	Issuer      string              `koanf:"issuer"`
	RolesClaim  string              `koanf:"roles_claim"`
	RoleMapping map[string][]string `koanf:"role_mapping"` // local role -> idp roles
	Audience    []string            `koanf:"audience"`
}

type ImmutableGatewayConfig struct {
	Enabled      bool   `koanf:"enabled"`
	ArtifactsDir string `koanf:"artifacts_dir"`
}

type LLMConfig struct {
	TemplateDefinitionsPath string `koanf:"template_definitions_path"`
}

type LLMValidator struct {
	// contains filtered or unexported fields
}

type LoggingConfig struct {
	Level  string `koanf:"level"`  // "debug", "info", "warn", "error"
	Format string `koanf:"format"` // "json" (default) or "text"
}

type LuaScriptConfig struct {
	ScriptPath string `koanf:"script_path"`
}

type MCPConfig struct {
	// AppendResourcePathToBackend preserves the legacy behaviour where the "/mcp"
	// gateway resource path is appended to the MCP backend upstream path. Older
	// gateway versions forwarded a request for "<context>/mcp" to "<upstream>/mcp".
	// The current default forwards to exactly the configured upstream path (the
	// upstream is expected to be the full MCP endpoint URL). Enable this only if
	// existing MCP API definitions rely on the "/mcp" suffix being appended to the
	// backend.
	AppendResourcePathToBackend bool `koanf:"append_resource_path_to_backend"`
}

type MCPValidator struct {
	// contains filtered or unexported fields
}

type MetricsConfig struct {
	// Enabled indicates whether the metrics server should be started
	Enabled bool `koanf:"enabled"`

	// Port is the port for the metrics HTTP server
	Port int `koanf:"port"`
}

type MoesifPublisherConfig struct {
	ApplicationID      string `koanf:"application_id"`
	BaseURL            string `koanf:"moesif_base_url"`
	PublishInterval    int    `koanf:"publish_interval"`
	EventQueueSize     int    `koanf:"event_queue_size"`
	BatchSize          int    `koanf:"batch_size"`
	TimerWakeupSeconds int    `koanf:"timer_wakeup_seconds"`
}

type Parser struct{}

type PoliciesConfig struct {
	DefinitionsPath   string `koanf:"definitions_path"`    // Directory containing policy definitions
	BuildManifestPath string `koanf:"build_manifest_path"` // Path to build-manifest.yaml for custom policy detection
}

type PolicyEngineConfig struct {
	Mode             string          `koanf:"mode"` // Connection mode: "uds" (default) or "tcp"
	Host             string          `koanf:"host"` // Policy engine hostname/IP (TCP mode only)
	Port             uint32          `koanf:"port"` // Policy engine ext_proc port (TCP mode only)
	TimeoutMs        uint32          `koanf:"timeout_ms"`
	MessageTimeoutMs uint32          `koanf:"message_timeout_ms"`
	TLS              PolicyEngineTLS `koanf:"tls"` // TLS configuration (TCP mode only)
}

type PolicyEngineTLS struct {
	Enabled    bool   `koanf:"enabled"`     // Enable TLS for policy engine connection
	CertPath   string `koanf:"cert_path"`   // Path to client certificate (mTLS)
	KeyPath    string `koanf:"key_path"`    // Path to client private key (mTLS)
	CAPath     string `koanf:"ca_path"`     // Path to CA certificate for server validation
	ServerName string `koanf:"server_name"` // SNI server name (optional, defaults to host)
	SkipVerify bool   `koanf:"skip_verify"` // Skip server certificate verification (insecure, dev only)
}

type PolicyServerConfig struct {
	Port int                `koanf:"port"`
	TLS  XDSServerTLSConfig `koanf:"tls"`
}

type PolicyValidator struct {
	// contains filtered or unexported fields
}

type PostgresConfig struct {
	DSN             string        `koanf:"dsn"`
	Host            string        `koanf:"host"`
	Port            int           `koanf:"port"`
	Database        string        `koanf:"database"`
	User            string        `koanf:"user"`
	Password        string        `koanf:"password"`
	SSLMode         string        `koanf:"sslmode"`
	ConnectTimeout  time.Duration `koanf:"connect_timeout"`
	MaxOpenConns    int           `koanf:"max_open_conns"`
	MaxIdleConns    int           `koanf:"max_idle_conns"`
	ConnMaxLifetime time.Duration `koanf:"conn_max_lifetime"`
	ConnMaxIdleTime time.Duration `koanf:"conn_max_idle_time"`
	ApplicationName string        `koanf:"application_name"`
}

type PprofConfig struct {
	// Enabled registers the /debug/pprof/* handlers on the admin server.
	Enabled bool `koanf:"enabled"`
	// BlockProfileRate is passed to runtime.SetBlockProfileRate (0 = block profiling off).
	BlockProfileRate int `koanf:"block_profile_rate"`
	// MutexProfileFraction is passed to runtime.SetMutexProfileFraction (0 = mutex profiling off).
	MutexProfileFraction int `koanf:"mutex_profile_fraction"`
}

type ProviderConfig struct {
	Type string                `koanf:"type"` // "aesgcm"
	Keys []EncryptionKeyConfig `koanf:"keys"`
}

type RouterConfig struct {
	AccessLogs    AccessLogsConfig `koanf:"access_logs"`
	ListenerPort  int              `koanf:"listener_port"`
	HTTPSEnabled  bool             `koanf:"https_enabled"`
	HTTPSPort     int              `koanf:"https_port"`
	GatewayHost   string           `koanf:"gateway_host"`
	Lua           RouterLuaConfig  `koanf:"lua"`
	LuaScriptPath string           `koanf:"lua_script_path"` // Deprecated: use router.lua.request_transformation.script_path
	// Upstream holds upstream-side configuration (TLS and timeouts: route, idle, connect)
	Upstream           RouterUpstream     `koanf:"upstream"`
	PolicyEngine       PolicyEngineConfig `koanf:"policy_engine"`
	DownstreamTLS      DownstreamTLS      `koanf:"downstream_tls"`
	VHosts             VHostsConfig       `koanf:"vhosts"`
	TracingServiceName string             `koanf:"tracing_service_name"`

	// HTTPListener configuration
	HTTPListener HTTPListenerConfig `koanf:"http_listener"`
}

type RouterLuaConfig struct {
	RequestTransformation LuaScriptConfig `koanf:"request_transformation"`
}

type RouterUpstream struct {
	TLS      UpstreamTLS      `koanf:"tls"`
	Timeouts UpstreamTimeouts `koanf:"timeouts"`
}

type SQLiteConfig struct {
	Path string `koanf:"path"` // Path to SQLite database file
}

type SecretValidator struct {
	// contains filtered or unexported fields
}

type ServerConfig struct {
	APIPort                         int           `koanf:"api_port"`
	XDSPort                         int           `koanf:"xds_port"`
	ShutdownTimeout                 time.Duration `koanf:"shutdown_timeout"`
	GatewayID                       string        `koanf:"gateway_id"`
	SkipInvalidDeploymentsOnStartup bool          `koanf:"skip_invalid_deployments_on_startup"`

	// TLS starts a second, TLS-only listener on TLS.Port serving the same
	// REST management API as the plaintext listener on APIPort. Off by
	// default.
	TLS ServerTLSConfig `koanf:"tls"`

	// XDSTLS switches the main xDS gRPC server (serving Envoy, on XDSPort)
	// from plaintext to mutual TLS. Unlike TLS above, this does not add a
	// second listener -- XDSPort itself starts speaking mTLS. Off by
	// default; see XDSServerTLSConfig for why xDS has no server-only mode.
	XDSTLS XDSServerTLSConfig `koanf:"xds_tls"`

	// ReadTimeout, ReadHeaderTimeout, WriteTimeout, and IdleTimeout bound the
	// REST management API's http.Server (both the plaintext listener on
	// APIPort and the TLS listener on TLS.Port) so a slow or malicious
	// client can't hold a connection open indefinitely (Slowloris-style
	// resource exhaustion). MaxHeaderBytes bounds header size the same way.
	// All five must be non-zero -- defaultConfig supplies safe defaults.
	ReadTimeout       time.Duration `koanf:"read_timeout"`
	ReadHeaderTimeout time.Duration `koanf:"read_header_timeout"`
	WriteTimeout      time.Duration `koanf:"write_timeout"`
	IdleTimeout       time.Duration `koanf:"idle_timeout"`
	MaxHeaderBytes    int           `koanf:"max_header_bytes"`
}

type ServerTLSConfig struct {
	// Enabled starts the TLS listener on Port. Off by default: no
	// certificate is provisioned by default, and the plaintext listener
	// keeps working either way.
	Enabled bool `koanf:"enabled"`

	// Port is the port for the TLS REST API listener. Must differ from every
	// other configured controller port (server.api_port, server.xds_port,
	// admin_server.port, metrics.port).
	Port int `koanf:"port"`

	// CertPath and KeyPath are the PEM-encoded server certificate and
	// private key for the TLS listener. Required when Enabled.
	CertPath string `koanf:"cert_path"`
	KeyPath  string `koanf:"key_path"`

	// MinimumProtocolVersion and MaximumProtocolVersion bound the negotiated
	// TLS version: one of "TLS1_0", "TLS1_1", "TLS1_2", "TLS1_3". Same
	// vocabulary as router.downstream_tls/upstream_tls for consistency
	// within the shared config file.
	MinimumProtocolVersion string `koanf:"minimum_protocol_version"`
	MaximumProtocolVersion string `koanf:"maximum_protocol_version"`

	// Ciphers is a comma-separated list of Go crypto/tls cipher suite names
	// (e.g. "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"), restricting which
	// suites this listener will negotiate. Empty by default, meaning Go's
	// own secure default set/order applies. Only affects TLS 1.2 and below —
	// TLS 1.3 suite selection is not configurable in Go's crypto/tls.
	//
	// Note this is a different naming scheme than router.downstream_tls's
	// ciphers field (OpenSSL/BoringSSL names like
	// "ECDHE-ECDSA-AES128-GCM-SHA256"): this listener is served by Go's own
	// crypto/tls, not Envoy, so it uses Go's canonical cipher suite names —
	// see crypto/tls.CipherSuites for the supported list.
	Ciphers string `koanf:"ciphers"`

	// EcdhCurves is a comma-separated list of TLS 1.3 key-exchange groups,
	// most preferred first. Defaults to the hybrid post-quantum group
	// ("X25519MLKEM768", FIPS 203 ML-KEM-768 + X25519) first, with classical
	// fallbacks after (e.g. "X25519MLKEM768,X25519,P-256").
	//
	// Unlike router.downstream_tls/upstream_tls's EcdhCurves (classical-only
	// by default), this listener is served directly by this process's own Go
	// crypto/tls (1.23+ implements X25519MLKEM768 natively) rather than
	// pushed as xDS config to a separate Envoy process, so defaulting to the
	// hybrid group here carries none of the "already-running peer NACKs the
	// update" risk documented on those fields — TLS 1.3 negotiation simply
	// falls back to a later classical entry in this same list for a client
	// that doesn't offer the hybrid group.
	EcdhCurves string `koanf:"ecdh_curves"`
}

type StorageConfig struct {
	Type     string          `koanf:"type"`     // "sqlite", "postgres", or "sqlserver"
	Database *DatabaseConfig `koanf:"database"` // Global database configuration
	SQLite   SQLiteConfig    `koanf:"sqlite"`   // Legacy SQLite configuration (backward compatibility)
	Postgres PostgresConfig  `koanf:"postgres"` // Legacy PostgreSQL configuration (backward compatibility)
}

type SubscriptionsConfig struct {
	// EnableValidation toggles automatic injection of the subscriptionValidation
	// system policy into API policy chains.
	EnableValidation bool `koanf:"enable_validation"`
}

type TracingConfig struct {
	// Enabled toggles tracing on/off
	Enabled bool `koanf:"enabled"`

	// Endpoint is the OTLP gRPC endpoint (host:port)
	Endpoint string `koanf:"endpoint"`

	// Insecure indicates whether to use an insecure connection (no TLS)
	Insecure bool `koanf:"insecure"`

	// ServiceVersion is the service version reported to the tracing backend
	ServiceVersion string `koanf:"service_version"`

	// BatchTimeout is the export batch timeout
	BatchTimeout time.Duration `koanf:"batch_timeout"`

	// MaxExportBatchSize is the maximum batch size for exports
	MaxExportBatchSize int `koanf:"max_export_batch_size"`

	// SamplingRate is the ratio of requests to sample (0.0 to 1.0)
	// 1.0 = sample all requests, 0.1 = sample 10% of requests
	// If set to 0 or not specified, defaults to 1.0 (sample all)
	SamplingRate float64 `koanf:"sampling_rate"`

	// ResourceAttributes are OpenTelemetry resource attributes attached to every
	// exported span, e.g. {"deployment.environment": "prod"}. The controller
	// translates these into the router's (Envoy's) static_config resource
	// detector; the policy-engine applies the same map to its own spans, so one
	// block covers both components. Attributes discovered from the environment
	// (OTEL_RESOURCE_ATTRIBUTES) are still honoured, but these take precedence.
	ResourceAttributes map[string]string `koanf:"resource_attributes"`
}

type TrafficLoggingConfig struct {
	// Enabled turns stdout JSON traffic logging on. Enabling it implicitly activates
	// the collector (see Config.IsCollectorEnabled).
	Enabled bool `koanf:"enabled"`
}

type UpstreamTLS struct {
	MinimumProtocolVersion string `koanf:"minimum_protocol_version"`
	MaximumProtocolVersion string `koanf:"maximum_protocol_version"`
	Ciphers                string `koanf:"ciphers"`
	// EcdhCurves is a comma-separated list of ECDH curves (e.g. "X25519,P-256"), most preferred
	// first. Defaults to classical curves only — a hybrid post-quantum group (e.g.
	// "X25519MLKEM768") can be added as the first preference, but only as an explicit opt-in per
	// deployment: an already-running Envoy instance that doesn't recognize the curve name will
	// NACK the xDS update and keep serving its last-known-good config, silently freezing that
	// instance out of any further config changes until the operator fixes it. Confirm the
	// deployed Envoy/BoringSSL build supports the group before enabling it.
	EcdhCurves             string `koanf:"ecdh_curves"`
	TrustedCertPath        string `koanf:"trusted_cert_path"`
	CustomCertsPath        string `koanf:"custom_certs_path"` // Directory containing custom trusted certificates
	VerifyHostName         bool   `koanf:"verify_host_name"`
	DisableSslVerification bool   `koanf:"disable_ssl_verification"`
}

type UpstreamTimeouts struct {
	RouteTimeoutMs     uint32 `koanf:"route_timeout_ms"`
	RouteIdleTimeoutMs uint32 `koanf:"route_idle_timeout_ms"`
	ConnectTimeoutMs   uint32 `koanf:"connect_timeout_ms"`
}

type VHostEntry struct {
	// Optional explicit domain list for the vhost (examples: "*.wso2.com", "api.example.com").
	// If empty, the router will rely on the default pattern.
	Domains []string `koanf:"domains"`
	Default string   `koanf:"default"`
}

type VHostsConfig struct {
	Main    VHostEntry `koanf:"main"`
	Sandbox VHostEntry `koanf:"sandbox"`
}

type ValidationError struct {
	Field   string `json:"field"`
	Message string `json:"message"`
}

type Validator interface {
	Validate(config interface{}) []ValidationError
}

type XDSServerTLSConfig struct {
	// Enabled switches the xDS server from plaintext to mutual TLS on its
	// existing port (server.xds_port or policy_server.port) -- there is no
	// second listener the way ServerTLSConfig adds one for the REST API,
	// since a gRPC server serves one credential type per port.
	Enabled bool `koanf:"enabled"`

	// CertFile and KeyFile are the PEM-encoded server certificate and
	// private key this xDS server presents to connecting clients. Required
	// when Enabled.
	CertFile string `koanf:"cert_file"`
	KeyFile  string `koanf:"key_file"`

	// ClientCAFile is a PEM bundle of CA certificates trusted to sign a
	// connecting client's certificate (Envoy's or the policy-engine's).
	// Required when Enabled -- this is what makes the handshake mutual
	// rather than server-only.
	ClientCAFile string `koanf:"client_ca_file"`

	// AllowedClientIdentities is an explicit allowlist of accepted peer
	// certificate identities: a certificate's first SAN URI (e.g. a SPIFFE
	// ID) if present, otherwise its Subject CommonName -- see
	// pkg/tlsauth.PeerIdentity. A client certificate that chains to a
	// trusted CA is not by itself authorization to reach this snapshot; at
	// least one identity is required when Enabled, so this can't be
	// silently left as a no-op allowlist (go-control-plane-xds-security.md
	// directive 2).
	AllowedClientIdentities []string `koanf:"allowed_client_identities"`

	// MinimumProtocolVersion and MaximumProtocolVersion bound the
	// negotiated TLS version: one of "TLS1_0", "TLS1_1", "TLS1_2", "TLS1_3".
	// Same vocabulary as ServerTLSConfig/router.downstream_tls for
	// consistency within this file.
	MinimumProtocolVersion string `koanf:"minimum_protocol_version"`
	MaximumProtocolVersion string `koanf:"maximum_protocol_version"`

	// Ciphers is a comma-separated list of Go crypto/tls cipher suite names
	// restricting which suites this server negotiates. Empty by default --
	// Go's own secure default set/order applies. Only affects TLS 1.2 and
	// below; TLS 1.3 suite selection is not configurable in Go's crypto/tls.
	Ciphers string `koanf:"ciphers"`

	// EcdhCurves is a comma-separated list of TLS 1.3 key-exchange groups,
	// most preferred first. Defaults to the hybrid post-quantum group
	// ("X25519MLKEM768", FIPS 203 ML-KEM-768 + X25519) first, with classical
	// fallbacks after -- this server is Go's own crypto/tls (1.23+
	// implements X25519MLKEM768 natively), so an Envoy/policy-engine peer
	// that doesn't support the group simply falls back to a later classical
	// entry in this same list.
	EcdhCurves string `koanf:"ecdh_curves"`
}