config

type AuthSecrets struct {
	SharedSecrets

	OAuthHMACSecret secret.Secret
	OAuthSigningKey secret.Secret
	OAuthProviders  map[string]OAuthClientCredentials
}

type CORSConfig struct {
	AllowedOrigins []string `mapstructure:"allowed_origins"`

	AllowedMethods []string `mapstructure:"allowed_methods"`

	AllowedHeaders []string `mapstructure:"allowed_headers"`

	MaxAge int `mapstructure:"max_age" default:"300"`

	AllowCredentials bool `mapstructure:"allow_credentials" default:"false"`
}

type DataAccessSecrets struct {
	SharedSecrets
}

type DatabaseSecrets struct {
	Username          string
	Password          secret.Secret
	MigrationUsername string
	MigrationPassword secret.Secret
}

type GRPCConfig struct {
	// EnableReflection registers the gRPC server reflection service, which lets
	// clients (grpcurl, grpcui) enumerate services, methods, and message
	// schemas at runtime. Reflection is exposed as a stream RPC and is NOT
	// covered by the unary service-token interceptors, so it is unauthenticated
	// wherever it is on. Keep it off in production (the zero value): it leaks the
	// full API surface of the auth services to anyone who can reach the port.
	// Enabled in development/CI/staging config for debugging.
	EnableReflection bool `mapstructure:"enable_reflection" default:"false"`
}

type GRPCService interface {
	GRPCAddr() string
}

type HTTPDefaults struct {
	ReadTimeout  time.Duration `mapstructure:"read_timeout" default:"30s"`
	WriteTimeout time.Duration `mapstructure:"write_timeout" default:"30s"`
	IdleTimeout  time.Duration `mapstructure:"idle_timeout" default:"60s"`
}

type HTTPService interface {
	HTTPAddr() string
}

type ListenConfig struct {
	// GRPCAddress serves every gRPC service, grpc.health.v1 and reflection.
	GRPCAddress string `mapstructure:"grpc_address"`
	// HTTPAddress serves every HTTP route.
	HTTPAddress string `mapstructure:"http_address"`
	// MetricsAddress serves labkit's /-/metrics, /-/liveness and /-/readiness.
	MetricsAddress string `mapstructure:"metrics_address"`
}

type Loaded[T ServiceRoot, S ServiceSecrets] struct {
	Config  T
	Secrets S
}

type MetricsService interface {
	MetricsAddr() string
}

type MigrationSecrets struct {
	Database DatabaseSecrets
}

type OAuthClientCredentials struct {
	ClientID     string
	ClientSecret secret.Secret
}

type PlatformConfig struct {
	Database platformConfig.DatabaseConfig `mapstructure:"database"`
	CORS     CORSConfig                    `mapstructure:"cors"`
	HTTP     HTTPDefaults                  `mapstructure:"http"`
	GRPC     GRPCConfig                    `mapstructure:"grpc"`
}

type RuntimeConfig[T ServiceConfig] struct {
	Platform PlatformConfig
	Service  T
}

type ServiceConfig interface {
	Validate() error
}

type ServiceRoot interface {
	proto.Message
	GetPlatform() *configpb.Platform
	GetSecretsFile() string
}

type ServiceSecrets interface {
	*AuthSecrets | *DataAccessSecrets | *MigrationSecrets
	DatabaseSecrets() DatabaseSecrets
}

type SharedSecrets struct {
	Database         DatabaseSecrets
	ServiceToken     secret.Secret
	NextServiceToken secret.Secret
}

type Source int