config

type AdminConfig struct {
	// SetupCode is HATAMOTO_SETUP_CODE: the code the first-run wizard asks
	// for, when you cannot read the logs (empty = generate one per boot).
	SetupCode string
	// TrustedProxies is HATAMOTO_TRUSTED_PROXIES: comma-separated CIDRs whose
	// X-Forwarded-* headers are believed (client IP, scheme, host). Empty means
	// loopback only.
	TrustedProxies []string
	// Dev is HATAMOTO_DEV=1: development-only admin pages (the component
	// styleguide at /admin/_styleguide). Never set it in production.
	Dev bool
	// Path is HATAMOTO_ADMIN_PATH: the admin address pinned by the operator
	// ("" = not pinned), lower-cased when it is well formed. It wins over the
	// stored address. A malformed value is kept as typed and fails Validate.
	Path string
	// Resolved is the address the server mounts the admin at. App boot sets it
	// after reading the environment and the database; empty means /admin.
	Resolved string
	// NotFoundPerMin is HATAMOTO_NOTFOUND_PER_MIN: how many not-found
	// responses one client IP may cause per minute before it is blocked from
	// the admin address (default 60, 0 disables the throttle).
	NotFoundPerMin int
	// NotFoundBlock is HATAMOTO_NOTFOUND_BLOCK: how long that block lasts
	// (default 2m, at least 1s).
	NotFoundBlock time.Duration
	// contains filtered or unexported fields
}

type AgentAnalyticsConfig struct {
	// LogIngestEnabled (AGENT_LOG_INGEST) turns on log ingest. It only takes
	// effect together with LogIngestSecret (see LogIngestActive).
	LogIngestEnabled bool
	// LogIngestSecret (AGENT_LOG_INGEST_SECRET) authenticates POST
	// /api/v1/public/agent-logs via X-Agent-Log-Secret. No dev default.
	LogIngestSecret string
	// CaddyLogPath (AGENT_LOG_CADDY_PATH), when set with the flag on, makes
	// the backend tail that Caddy JSON access log (read-only).
	CaddyLogPath string
}

type Config struct {
	// Server configuration
	Server ServerConfig

	// Database configuration
	Database DatabaseConfig

	// Secret is the server secret (HATAMOTO_SECRET, or JWT_SECRET as older
	// deployments name it). Flash cookies, theme-preview links and stored
	// import credentials are keyed from it.
	Secret string

	// PublicSite configuration (canonical public origin)
	PublicSite PublicSiteConfig

	// PageCacheTTL is how long a rendered public page stays in the HTML cache
	// (HATAMOTO_PAGE_CACHE_TTL, default 5m, 30s..30d).
	PageCacheTTL time.Duration
	// PageCacheTTLFromEnv is true when PageCacheTTL came from a valid
	// HATAMOTO_PAGE_CACHE_TTL, false when it is the built-in default.
	PageCacheTTLFromEnv bool

	// Warnings are non-fatal configuration problems found by Load (an invalid
	// value fell back to its default); the caller logs them at boot.
	Warnings []string

	// MCPAllowedOrigins are extra browser origins allowed to call /mcp
	// (HATAMOTO_MCP_ALLOWED_ORIGINS, comma-separated). The public origin is
	// always allowed; requests without an Origin header are not affected.
	MCPAllowedOrigins []string

	// AgentAnalytics configures the optional access-log ingest (default off)
	AgentAnalytics AgentAnalyticsConfig

	// SMTP configuration for email notifications
	SMTP SMTPConfig

	// Feature flags
	Features FeaturesConfig

	// Hatamoto-specific brand / identity config (single-tenant)
	Hatamoto HatamotoConfig

	// Security header toggles (CSP enforce mode, disable switch)
	Security SecurityConfig

	// Packages controls plugin and theme packages (registry, trusted keys).
	Packages PackageConfig

	// Plugins controls the WASM plugin runtime.
	Plugins PluginConfig

	// Admin controls the Go admin UI.
	Admin AdminConfig

	// Demo is the public demo mode (HATAMOTO_DEMO=1); see demo.go.
	Demo DemoConfig

	// Environment
	Environment string

	// AdminCookieSecure controls the Secure attribute on the admin session
	// cookie. Defaults to true in production; set false for local HTTP dev.
	AdminCookieSecure bool

	// EnableCookieAuth lets the /api/v1 session also travel as an HttpOnly
	// cookie (with CSRF enforcement). Default FALSE: /api/v1 clients send the
	// session token as a bearer. The Go admin always uses its own cookie.
	EnableCookieAuth bool
	LogLevel         string
}

type DatabaseConfig struct {
	URL             string
	MaxConnections  int
	MinConnections  int
	MaxConnLifetime time.Duration
	MaxConnIdleTime time.Duration
}

type DemoConfig struct {
	// Enabled is HATAMOTO_DEMO=1 (or true).
	Enabled bool
	// LoginEmail and LoginPassword are HATAMOTO_DEMO_LOGIN_EMAIL and
	// HATAMOTO_DEMO_LOGIN_PASSWORD: the public owner login shown on the sign-in
	// page. They come from the environment only; nothing is built in.
	LoginEmail, LoginPassword string
	// MediaQuotaMB caps the total size of the media directory (originals and
	// variants): HATAMOTO_DEMO_MEDIA_QUOTA_MB, default 200.
	MediaQuotaMB int
	// WriteBudgetMB caps the request bodies of all write requests (content,
	// uploads, API) between two restarts, so a visitor cannot grow the database
	// without bound: HATAMOTO_DEMO_WRITE_BUDGET_MB, default 150.
	WriteBudgetMB int
	// WritesPerSecond and WriteBurst are the per-address rate of write requests
	// (every non-GET): HATAMOTO_DEMO_WRITES_PER_SECOND (default 2), burst 20.
	WritesPerSecond float64
	WriteBurst      int
}

type FeaturesConfig struct{}

type HatamotoConfig struct {
	// CanonicalSlug is the stable site slug stamped into API responses. Each
	// deployment sets its own. Required — validated in Validate().
	CanonicalSlug string

	// SiteName is the human-readable brand name rendered into outbound
	// transactional emails (the shared base.html <title>, header, and
	// footer attribution + form-submission footer line). Config-time
	// stable on purpose — siteconfig is mutable runtime state and the
	// email brand identity should not silently drift if an admin edits
	// the company name in the UI. Required —
	// validated in Validate().
	SiteName string
}

type PackageConfig struct {
	// RegistryURL is HATAMOTO_REGISTRY_URL: the signed registry index. "off"
	// disables browsing (upload still works).
	RegistryURL string
	// TrustedKeys is HATAMOTO_TRUSTED_KEYS: base64 ed25519 public keys of the
	// signers whose packages and registry indexes are accepted, separated by
	// commas or spaces.
	TrustedKeys string
	// AllowInsecureRegistry is HATAMOTO_REGISTRY_ALLOW_HTTP=true: accept an
	// http:// registry (development and tests only; the default is https only).
	AllowInsecureRegistry bool
	// NoFirstParty is HATAMOTO_TRUST_FIRST_PARTY=false: do not trust the
	// built-in first-party key, only HATAMOTO_TRUSTED_KEYS. The first-party
	// plugins then install only from a registry you sign yourself.
	NoFirstParty bool
}

type PluginConfig struct {
	// Dir is HATAMOTO_PLUGIN_DIR, a development override: one <name>/plugin.json
	// + plugin.wasm per plugin, loaded after the installed packages and
	// replacing a package of the same name. Empty (the default) loads none.
	Dir string
	// CacheDir is where compiled wasm is cached across restarts:
	// HATAMOTO_PLUGIN_CACHE_DIR, else <HATAMOTO_DATA>/cache/wasm. The cache
	// is rebuildable and created private (0700). "off" keeps it in memory.
	CacheDir string
	// AllowPublicDBObjects is HATAMOTO_PLUGIN_DB_ALLOW_PUBLIC_OBJECTS=1: grant
	// db.* although objects the application role does not own are open to
	// PUBLIC (otherwise db.* is refused until their owner closes them).
	AllowPublicDBObjects bool
	// FetchPerMinute is HATAMOTO_PLUGIN_FETCH_PER_MINUTE: the most outbound
	// http.fetch requests one plugin may make per minute (0: the built-in
	// default of 600).
	FetchPerMinute int
}

type PublicSiteConfig struct {
	BaseURL string
	// APIPrefix (PUBLIC_API_PREFIX) is an extra mount point for the public API
	// (forms and track), served in addition to /api/v1/public. Empty means only
	// the default. Pages written by the theme call this prefix.
	APIPrefix string
}

type SMTPConfig struct {
	Host     string
	Port     int
	Username string
	Password string
	From     string
	FromName string
	// FromNameFromSite is true when SMTP_FROM_NAME is unset: the admin's own
	// emails then use the site name as it is in the database at send time.
	FromNameFromSite bool
}

type SecurityConfig struct {
	CSPEnforce      bool
	HeadersDisabled bool
}

type ServerConfig struct {
	Host            string
	Port            int
	ReadTimeout     time.Duration
	WriteTimeout    time.Duration
	IdleTimeout     time.Duration
	ReportOutputDir string
	EnableWorker    bool
	// Media settings
	MediaUploadDir string
	MediaBaseURL   string
	MediaMaxSizeMB int
}