server

type AggregatorConfig struct {
	// LockInterval is the interval for locking events in seconds.
	// This is the threshold between rule evaluations + actions.
	LockInterval int64 `mapstructure:"lock_interval" default:"30"`
}

type AuthConfig struct {
	// NoncePeriod is the period in seconds for which a nonce is valid
	NoncePeriod int64 `mapstructure:"nonce_period" default:"3600"`
	// TokenKey is the key used to store the provider's token in the database
	TokenKey string `mapstructure:"token_key" default:"./.ssh/token_key_passphrase"`
}

type AuthzConfig struct {
	// ApiUrl is the URL to the authorization server
	ApiUrl string `mapstructure:"api_url" validate:"required"`
	// StoreName is the name of the store to use for authorization
	StoreName string `mapstructure:"store_name" default:"minder" validate:"required_without=StoreID"`
	// StoreID is the ID of the store to use for authorization
	StoreID string `mapstructure:"store_id" default:"" validate:"required_without=StoreName"`
	// ModelID is the ID of the model to use for authorization
	ModelID string `mapstructure:"model_id" default:""`
	// Auth is the authentication configuration for the authorization server
	Auth OpenFGAAuth `mapstructure:"auth" validate:"required"`
}

type BundleSourceConfig struct {
	Type     string `mapstructure:"type"`
	Location string `mapstructure:"location"`
}

type CORSConfig struct {
	// Enabled is the flag to enable CORS
	Enabled bool `mapstructure:"enabled" default:"false"`
	// AllowOrigins is the list of allowed origins
	AllowOrigins []string `mapstructure:"allow_origins"`
	// AllowMethods is the list of allowed methods
	AllowMethods []string `mapstructure:"allow_methods"`
	// AllowHeaders is the list of allowed headers
	AllowHeaders []string `mapstructure:"allow_headers"`
	// ExposeHeaders is the list of exposed headers
	ExposeHeaders []string `mapstructure:"expose_headers"`
	// AllowCredentials is the flag to allow credentials
	AllowCredentials bool `mapstructure:"allow_credentials" default:"false"`
}

type Config struct {
	HTTPServer      HTTPServerConfig      `mapstructure:"http_server"`
	GRPCServer      GRPCServerConfig      `mapstructure:"grpc_server"`
	MetricServer    MetricServerConfig    `mapstructure:"metric_server"`
	LoggingConfig   LoggingConfig         `mapstructure:"logging"`
	Tracing         TracingConfig         `mapstructure:"tracing"`
	Metrics         MetricsConfig         `mapstructure:"metrics"`
	Database        config.DatabaseConfig `mapstructure:"database"`
	Identity        IdentityConfigWrapper `mapstructure:"identity"`
	Auth            AuthConfig            `mapstructure:"auth"`
	WebhookConfig   WebhookConfig         `mapstructure:"webhook-config"`
	Events          EventConfig           `mapstructure:"events"`
	Authz           AuthzConfig           `mapstructure:"authz"`
	Provider        ProviderConfig        `mapstructure:"provider"`
	Marketplace     MarketplaceConfig     `mapstructure:"marketplace"`
	DefaultProfiles DefaultProfilesConfig `mapstructure:"default_profiles"`
}

type ConfigBundleSource string

type DefaultProfilesConfig struct {
	Enabled bool `mapstructure:"enabled" default:"false"`
	// List of profile names to install
	Profiles []string `mapstructure:"profiles"`
	// The bundle to subscribe to
	Bundle IncludedBundleConfig `mapstructure:"bundle"`
}

type EventConfig struct {
	// Driver is the driver used to store events
	Driver string `mapstructure:"driver" default:"go-channel"`
	// RouterCloseTimeout is the timeout for closing the router in seconds
	RouterCloseTimeout int64 `mapstructure:"router_close_timeout" default:"10"`
	// GoChannel is the configuration for the go channel event driver
	GoChannel GoChannelEventConfig `mapstructure:"go-channel"`
	// SQLPubSub is the configuration for the database event driver
	SQLPubSub SQLEventConfig `mapstructure:"sql"`
	// Aggregator is the configuration for the event aggregator middleware
	Aggregator AggregatorConfig `mapstructure:"aggregator"`
}

type GRPCServerConfig struct {
	// Host is the host to bind to
	Host string `mapstructure:"host" default:"127.0.0.1"`
	// Port is the port to bind to
	Port int `mapstructure:"port" default:"8090"`
}

type GitHubAppConfig struct {
	// AppName is the name of the GitHub App
	AppName string `mapstructure:"app_name"`
	// AppID is the ID of the GitHub App
	AppID int64 `mapstructure:"app_id" default:"0"`
	// UserID is the ID of the GitHub App user
	UserID int64 `mapstructure:"user_id" default:"0"`
	// PrivateKey is the path to the GitHub App's private key in PEM format
	PrivateKey string `mapstructure:"private_key"`
	// WebhookSecret is the GitHub App's webhook secret
	WebhookSecret string `mapstructure:"webhook_secret"`
	// WebhookSecretFile is the location of the file containing the GitHub App's webhook secret
	WebhookSecretFile string `mapstructure:"webhook_secret_file"`
	// FallbackToken is the fallback token to use when listing packages
	FallbackToken string `mapstructure:"fallback_token"`
	// FallbackTokenFile is the location of the file containing the fallback token to use when listing packages
	FallbackTokenFile string `mapstructure:"fallback_token_file"`
}

type GoChannelEventConfig struct {
	// BufferSize is the size of the buffer for the go channel
	BufferSize int64 `mapstructure:"buffer_size" default:"0"`
	// PersistEvents is whether or not to persist events to the channel
	PersistEvents bool `mapstructure:"persist_events" default:"false"`
	// BlockPublishUntilSubscriberAck is whether or not to block publishing until
	// the subscriber acks the message. This is useful for testing.
	BlockPublishUntilSubscriberAck bool `mapstructure:"block_publish_until_subscriber_ack" default:"false"`
}

type HTTPServerConfig struct {
	// Host is the host to bind to
	Host string `mapstructure:"host" default:"127.0.0.1"`
	// Port is the port to bind to
	Port int `mapstructure:"port" default:"8080"`

	// CORS is the configuration for CORS
	CORS CORSConfig `mapstructure:"cors"`
}

type IdentityConfig struct {
	// IssuerUrl is the base URL where the identity server is running
	IssuerUrl string `mapstructure:"issuer_url" default:"http://localhost:8081"`
	// ClientId is the client ID that identifies the minder server
	ClientId string `mapstructure:"client_id" default:"minder-server"`
	// ClientSecret is the client secret for the minder server
	ClientSecret string `mapstructure:"client_secret" default:"secret"`
	// ClientSecretFile is the location of a file containing the client secret for the minder server (optional)
	ClientSecretFile string `mapstructure:"client_secret_file"`
}

type IdentityConfigWrapper struct {
	Server IdentityConfig `mapstructure:"server"`
}

type IncludedBundleConfig struct {
	Namespace string `mapstructure:"namespace"`
	Name      string `mapstructure:"name"`
}

type LoggingConfig struct {
	Level   string `mapstructure:"level" default:"debug"`
	Format  string `mapstructure:"format" default:"json"`
	LogFile string `mapstructure:"logFile" default:""`

	// LogPayloads controls whether or not message payloads are ever logged.
	// For debugging purposes, it may be useful to log the payloads that result
	// in error conditions, but could also leak PII.
	LogPayloads bool `mapstructure:"logPayloads" default:"false"`
}

type MarketplaceConfig struct {
	Enabled bool                 `mapstructure:"enabled" default:"false"`
	Sources []BundleSourceConfig `mapstructure:"sources"`
}

type MetricServerConfig struct {
	// Host is the host to bind to
	Host string `mapstructure:"host" default:"127.0.0.1"`
	// Port is the port to bind to
	Port int `mapstructure:"port" default:"9090"`
}

type MetricsConfig struct {
	Enabled bool `mapstructure:"enabled" default:"true"`
}

type OpenFGAAuth struct {
	// Method is the authentication method to use
	Method string `mapstructure:"method" default:"none" validate:"oneof=token none"`

	// Token is the configuration for OpenID Connect authentication
	Token TokenAuth `mapstructure:"token"`
}

type ProviderConfig struct {
	GitHubApp *GitHubAppConfig `mapstructure:"github-app"`
}

type SQLEventConfig struct {
	// InitSchema is whether or not to initialize the schema
	InitSchema bool                  `mapstructure:"init_schema" default:"true"`
	Connection config.DatabaseConfig `mapstructure:"connection" default:"{\"dbname\":\"watermill\"}"`
}

type TokenAuth struct {
	// TokenPath is the path to the token to use for authentication.
	// defaults to the kubernetes service account token
	//nolint:lll
	TokenPath string `mapstructure:"token_path" default:"/var/run/secrets/kubernetes.io/serviceaccount/token"`
}

type TracingConfig struct {
	Enabled bool `mapstructure:"enabled" default:"false"`
	// for the demonstration, we use AlwaysSmaple sampler to take all spans.
	// do not use this option in production.
	SampleRatio float64 `mapstructure:"sample_ratio" default:"0.1"`
}

type WebhookConfig struct {
	// ExternalWebhookURL is the URL that we will send our webhook to
	ExternalWebhookURL string `mapstructure:"external_webhook_url"`
	// ExternalPingURL is the URL that we will send our ping to
	ExternalPingURL string `mapstructure:"external_ping_url"`
	// WebhookSecret is the secret that we will use to sign our webhook
	WebhookSecret string `mapstructure:"webhook_secret"`
	// PreviousWebhookSecretFile is a reference to a file that contains previous webhook secrets. This is used
	// in case we are rotating secrets and the external service is still using the old secret. These will not
	// be used when creating new webhooks.
	PreviousWebhookSecretFile string `mapstructure:"previous_webhook_secret_file"`
}