config

type CellConfig struct {
	ID int `mapstructure:"id"`
}

type Config struct {
	GRPCAddress string `mapstructure:"grpc_address"`
	HttpAddress string `mapstructure:"http_address"`

	// MetricsAddress defaults to ":9090" when unset (see MetricsAddr).
	MetricsAddress string `mapstructure:"metrics_address"`

	BaseUrl url.URL `mapstructure:"base_url"`

	// GitlabURL is the single GitLab instance this deployment talks to: the
	// instance third-party identities are linked into (OAuthClient's sign-in
	// flow) and, fronted by gitlab-http-router, the entry point used to reach
	// every configured Cell (OAuth.Cells) via a routing-hint cookie rather
	// than a per-Cell address. One field, not two: in every real deployment
	// these are the same URL.
	GitlabURL string `mapstructure:"gitlab_url"`

	OAuth OAuthServerConfig `mapstructure:"oauth"`

	OAuthClient OAuthClientConfig `mapstructure:"oauth_client"`

	ServiceAuth serviceauth.Config `mapstructure:",squash"`
}

type OAuthClientConfig struct {
	Providers map[string]OAuthClientProviderConfig `mapstructure:"providers"`
}

type OAuthClientProviderConfig struct {
	// OIDC Discovery - if provided, auth_url, token_url, and user_info_url are fetched automatically
	Issuer string `mapstructure:"issuer"`

	// Manual OAuth configuration - required if issuer is not provided
	AuthURL     string `mapstructure:"auth_url"`
	TokenURL    string `mapstructure:"token_url"`
	UserInfoURL string `mapstructure:"user_info_url"`

	// Required for all providers
	ClientID     string   `mapstructure:"client_id"`
	ClientSecret string   `mapstructure:"client_secret"`
	Scopes       []string `mapstructure:"scopes"`
}

type OAuthServerConfig struct {
	Issuer     string `mapstructure:"issuer"`
	ConsentURL string `mapstructure:"consent_url"`
	LoginURL   string `mapstructure:"login_url"`
	HMACSecret string `mapstructure:"hmac_secret"`

	// SigningKey is a base64-encoded PKCS#8 PEM RSA private key.
	SigningKey string `mapstructure:"signing_key"`

	// AccessTokenAudience identifies the resource server that consumes
	// IAM-issued JWT access tokens; set as the `aud` claim per RFC 9068 §2.2.
	AccessTokenAudience string `mapstructure:"access_token_audience" default:"gitlab-rails"`

	JwksCacheDuration time.Duration `mapstructure:"jwks_cache_duration" default:"3600s"`

	// UserInfoURL is GitLab Rails' `/api/v4/iam/userinfo` endpoint, which
	// accepts only an IAM-issued OAuth JWT (unlike the OIDC `/oauth/userinfo`
	// endpoint, which accepts any Doorkeeper-recognized token).
	//
	// SECURITY-SENSITIVE: every openid-scoped token exchange sends a bearer
	// access token to this URL. Must resolve to a trusted gitlab-rails instance
	UserInfoURL string `mapstructure:"user_info_url"`

	// Cells whose OAuth discovery keys IAM aggregates at /oauth/discovery/keys.
	// Reached through the shared gitlab-http-router at Config.GitlabURL, not a
	// per-Cell address; see CellConfig.
	Cells []CellConfig `mapstructure:"cells"`

	DynamicClientOrganizationID string `mapstructure:"dynamic_client_organization_id"`
}