extension

type AuthConfig struct {
	// Provider is the name of a forge auth provider registered in the auth
	// extension's registry. Empty means no authentication.
	Provider string `json:"provider" mapstructure:"provider" yaml:"provider"`

	// ReadScopes are required to observe: list and fetch events, stats, reports,
	// policies and archives, and verify a chain.
	ReadScopes []string `json:"read_scopes" mapstructure:"read_scopes" yaml:"read_scopes"`

	// WriteScopes are required to create records that destroy nothing: saving a
	// retention policy, generating a compliance report.
	WriteScopes []string `json:"write_scopes" mapstructure:"write_scopes" yaml:"write_scopes"`

	// AdminScopes are required for the irreversible operations: enforcing
	// retention, deleting a policy, and requesting an erasure.
	AdminScopes []string `json:"admin_scopes" mapstructure:"admin_scopes" yaml:"admin_scopes"`

	// AllowUnauthenticated mounts the API with no authentication at all.
	//
	// Only appropriate when something in front of Chronicle already
	// authenticates every request, or in local development. Setting it is an
	// explicit acknowledgement that any caller reaching these routes can purge
	// audit history.
	AllowUnauthenticated bool `json:"allow_unauthenticated" mapstructure:"allow_unauthenticated" yaml:"allow_unauthenticated"`
}

type CheckpointConfig struct {
	// Enabled turns on periodic checkpointing.
	Enabled bool `json:"enabled" mapstructure:"enabled" yaml:"enabled"`

	// EveryEvents takes a checkpoint once a stream has gained this many events.
	EveryEvents int `json:"every_events" mapstructure:"every_events" yaml:"every_events"`

	// EveryInterval takes one at least this often, whatever the volume.
	//
	// The interval matters more than it looks: the window between checkpoints
	// is exactly the span an attacker can still rewrite, so a quiet stream that
	// never reaches EveryEvents would otherwise sit unprotected indefinitely.
	EveryInterval time.Duration `json:"every_interval" mapstructure:"every_interval" yaml:"every_interval"`

	// Signer configures where the ed25519 signing key comes from.
	Signer KeyConfig `json:"signer" mapstructure:"signer" yaml:"signer"`
}

type Config struct {
	// DisableRoutes prevents HTTP route registration.
	DisableRoutes bool `json:"disable_routes" mapstructure:"disable_routes" yaml:"disable_routes"`

	// DisableMigrate prevents auto-migration on start.
	DisableMigrate bool `json:"disable_migrate" mapstructure:"disable_migrate" yaml:"disable_migrate"`

	// BasePath is the URL prefix for chronicle routes (default: "/chronicle").
	BasePath string `json:"base_path" mapstructure:"base_path" yaml:"base_path"`

	// BatchSize is the event batch size for the Chronicle emitter.
	BatchSize int `json:"batch_size" mapstructure:"batch_size" yaml:"batch_size"`

	// FlushInterval is the batch flush interval.
	FlushInterval time.Duration `json:"flush_interval" mapstructure:"flush_interval" yaml:"flush_interval"`

	// RetentionInterval sets how often retention policies are enforced.
	// Set to 0 to disable automatic retention.
	RetentionInterval time.Duration `json:"retention_interval" mapstructure:"retention_interval" yaml:"retention_interval"`

	// EnableCryptoErasure enables GDPR crypto-erasure support. Requires a key
	// store; see [WithKeyStore] and [ErrKeyStoreRequired].
	EnableCryptoErasure bool `json:"enable_crypto_erasure" mapstructure:"enable_crypto_erasure" yaml:"enable_crypto_erasure"`

	// GroveDatabase is the name of a grove.DB registered in the DI container.
	// When set, the extension resolves this named database and auto-constructs
	// the appropriate store based on the driver type (pg/sqlite/mongo).
	// When empty and WithGroveDatabase was called, the default (unnamed) DB is used.
	GroveDatabase string `json:"grove_database" mapstructure:"grove_database" yaml:"grove_database"`

	// GroveKV is the name of a grove/kv.Store registered in the DI container.
	// When set, the extension resolves this named KV store and constructs
	// a Redis-backed Chronicle store. When empty and WithGroveKV was called,
	// the default (unnamed) KV store is used.
	GroveKV string `json:"grove_kv" mapstructure:"grove_kv" yaml:"grove_kv"`

	// Auth controls who may call the admin API.
	Auth AuthConfig `json:"auth" mapstructure:"auth" yaml:"auth"`

	// TamperEvidence selects how the hash chain resists rewriting: plain
	// (default) or HMAC-keyed. See [TamperEvidenceConfig].
	TamperEvidence TamperEvidenceConfig `json:"tamper_evidence" mapstructure:"tamper_evidence" yaml:"tamper_evidence"`

	// Checkpoints controls periodic signed checkpoints over each stream's
	// chain. See [CheckpointConfig]. Leaving this unset (the default) records
	// none: nothing about a keyed digest replaces the need for a checkpoint,
	// since an attacker with write access to the store can rewrite both the
	// event and its stream's pin.
	Checkpoints CheckpointConfig `json:"checkpoints" mapstructure:"checkpoints" yaml:"checkpoints"`

	// Dashboard configures how the contract dashboard scopes a session that
	// arrives with no app or tenant claims. See [DashboardConfig].
	Dashboard DashboardConfig `json:"dashboard" mapstructure:"dashboard" yaml:"dashboard"`

	// DashboardMutations has no effect.
	//
	// Deprecated: dashboard writes are governed by the scopes the contract
	// declares on each command, chronicle.write and chronicle.admin, held by
	// the signed-in user. The field stays so a config file that still sets
	// dashboard_mutations loads. It will be removed in a later release.
	DashboardMutations bool `json:"dashboard_mutations" mapstructure:"dashboard_mutations" yaml:"dashboard_mutations"`

	// RequireConfig requires config to be present in YAML files.
	// If true and no config is found, Register returns an error.
	RequireConfig bool `json:"-" yaml:"-"`
}

type DashboardConfig struct {
	// AppID is the app a session belongs to when its claims name none
	// (chronicle.dashboard.app_id).
	AppID string `json:"app_id" mapstructure:"app_id" yaml:"app_id"`

	// TenantID is the tenant a session is narrowed to when its app came from
	// AppID and its claims name no tenant (chronicle.dashboard.tenant_id). It
	// applies to that config session only: a session that claims its app, even
	// this one, never takes it. It cannot be set without AppID. Empty leaves
	// the config session app-wide.
	TenantID string `json:"tenant_id" mapstructure:"tenant_id" yaml:"tenant_id"`
}

type Extension struct {
	*forge.BaseExtension
	// contains filtered or unexported fields
}

type KeyConfig struct {
	// Provider is "file", or empty to take a keys.Provider from [WithKeyProvider].
	Provider string `json:"provider" mapstructure:"provider" yaml:"provider"`

	// Path is the keyset file, for the file provider.
	Path string `json:"path" mapstructure:"path" yaml:"path"`
}

type Option func(*Extension)

type TamperEvidenceConfig struct {
	// Digest is "plain" (default) or "hmac".
	Digest string `json:"digest" mapstructure:"digest" yaml:"digest"`

	// Keys configures where the HMAC key comes from.
	Keys KeyConfig `json:"keys" mapstructure:"keys" yaml:"keys"`
}