configv2

type AccessProxy struct {
	ProxyFile string `json:"proxy_file,omitempty"`

	HTTP       *AuthProxyHTTP `json:"http,omitempty"`
	RPCServer  string         `json:"rpc_server,omitempty"`
	Credential *Credential    `json:"credential,omitempty"`

	Backends []*Backend `json:"-"`

	AuthEndpoint   string `json:"-"`
	TokenEndpoint  string `json:"-"`
	ServerNameHost string `json:"-"`
	// contains filtered or unexported fields
}

type AuthProxyHTTP struct {
	Bind            string       `json:"bind,omitempty"`
	BindHttp        string       `json:"bind_http,omitempty"`
	BindInternalApi string       `json:"bind_internal_api,omitempty"`
	ServerName      string       `json:"server_name,omitempty"`
	Certificate     *Certificate `json:"certificate,omitempty"`
	Session         *Session     `json:"session,omitempty"`
	// Deprecated.
	ExpectCT bool `json:"expect_ct,omitempty"`
}

type AuthorizationEngine struct {
	RoleFile          string   `json:"role_file,omitempty"`
	RPCPermissionFile string   `json:"rpc_permission_file,omitempty"`
	RootUsers         []string `json:"root_users,omitempty"`

	Roles          []*Role          `json:"-"`
	RPCPermissions []*RPCPermission `json:"-"`
	// contains filtered or unexported fields
}

type Backend struct {
	Name        string         `json:"name"` // Name is an identifier
	Description string         `json:"description,omitempty"`
	FQDN        string         `json:"fqdn,omitempty"`
	HTTP        []*HTTPBackend `json:"http,omitempty"`

	Permissions   []*Permission `json:"permissions"`
	AllowRootUser bool          `json:"allow_root_user,omitempty"`
	DisableAuthn  bool          `json:"disable_authn,omitempty"`
	// MaxSessionDuration is a maximum duration before session expire for specify backend.
	// When MaxSessionDuration is not empty, OIDC authentication is required even if the user submits a client certificate.
	MaxSessionDuration *Duration `json:"max_session_duration,omitempty"`

	AllowHttp bool           `json:"allow_http,omitempty"`
	Socket    *SocketBackend `json:"socket,omitempty"`

	BackendSelector *HTTPBackendSelector `json:"-"`
	Host            string               `json:"-"`
	// contains filtered or unexported fields
}

type Binding struct {
	RPC        string `json:"rpc,omitempty"`
	Backend    string `json:"backend,omitempty"`    // Backend is Backend.Name
	Permission string `json:"permission,omitempty"` // Permission is Permission.Name
}

type Certificate struct {
	CertFile string `json:"cert_file"`
	KeyFile  string `json:"key_file"`
	// contains filtered or unexported fields
}

type CertificateAuthority struct {
	Local *CertificateAuthorityLocal `json:"local,omitempty"`
	Vault *CertificateAuthorityVault `json:"vault,omitempty"`

	CertPool    *x509.CertPool    `json:"-"`
	Certificate *x509.Certificate `json:"-"`
}

type CertificateAuthorityLocal struct {
	CertFile         string `json:"cert_file"`
	KeyFile          string `json:"key_file"`
	Organization     string `json:"organization"`
	OrganizationUnit string `json:"organization_unit"`
	Country          string `json:"country"`

	Subject    pkix.Name         `json:"-"`
	PrivateKey crypto.PrivateKey `json:"-"`
}

type CertificateAuthorityVault struct {
	Addr  string `json:"addr"`
	Token string `json:"token"`
	Role  string `json:"role"`

	Dir string `json:"-"`
}

type Config struct {
	AccessProxy          *AccessProxy          `json:"access_proxy,omitempty"`
	AuthorizationEngine  *AuthorizationEngine  `json:"authorization_engine,omitempty"`
	RPCServer            *RPCServer            `json:"rpc_server,omitempty"`
	Dashboard            *Dashboard            `json:"dashboard,omitempty"`
	IdentityProvider     *IdentityProvider     `json:"identity_provider,omitempty"`
	Datastore            *Datastore            `json:"datastore,omitempty"`
	CertificateAuthority *CertificateAuthority `json:"certificate_authority,omitempty"`
	Logger               *Logger               `json:"logger,omitempty"`
}

type Credential struct {
	SigningPrivateKeyFile   string `json:"signing_private_key_file,omitempty"`
	InternalTokenFile       string `json:"internal_token_file,omitempty"`
	GithubWebHookSecretFile string `json:"github_webhook_secret_file,omitempty"`

	SigningPrivateKey   *ecdsa.PrivateKey `json:"-"`
	SigningPublicKey    ecdsa.PublicKey   `json:"-"`
	InternalToken       string            `json:"-"`
	GithubWebhookSecret []byte            `json:"-"`
}

type Dashboard struct {
	Bind         string    `json:"bind,omitempty"`
	RPCServer    string    `json:"rpc_server,omitempty"`
	TokenFile    string    `json:"token_file,omitempty"`
	Template     *Template `json:"template,omitempty"`
	PublicKeyUrl string    `json:"publickey_url,omitempty"`

	InternalToken string `json:"-"`
}

type Datastore struct {
	*DatastoreEtcd  `json:"etcd,omitempty"`
	*DatastoreMySQL `json:"mysql,omitempty"`
}

type DatastoreEtcd struct {
	RawUrl     string `json:"url"`
	DataDir    string `json:"data_dir,omitempty"`  // use only embed etcd
	Namespace  string `json:"namespace,omitempty"` // use only etcd
	CACertFile string `json:"ca_cert_file,omitempty"`
	CertFile   string `json:"cert_file,omitempty"`
	KeyFile    string `json:"key_file,omitempty"`

	Url         *url.URL        `json:"-"`
	Embed       bool            `json:"-"`
	EtcdUrl     *url.URL        `json:"-"`
	Certificate tls.Certificate `json:"-"`
	CertPool    *x509.CertPool  `json:"-"`
	// contains filtered or unexported fields
}

type DatastoreMySQL struct {
	RawUrl string `json:"url"`

	DSN *mysql.Config `json:"-"`
}

type Duration struct {
	time.Duration
}

type HTTPBackend struct {
	Path     string `json:"path"`
	Default  bool   `json:"default,omitempty"`
	Upstream string `json:"upstream,omitempty"`
	Insecure bool   `json:"insecure,omitempty"`
	Agent    bool   `json:"agent,omitempty"`

	Name      string          `json:"-"`
	Url       *url.URL        `json:"-"`
	Transport *http.Transport `json:"-"`
}

type HTTPBackendSelector struct {
	// contains filtered or unexported fields
}

type IdentityProvider struct {
	Provider         string   `json:"provider"`         // "google", "okta", "azure" or "custom"
	Issuer           string   `json:"issuer,omitempty"` // for "custom"
	ClientId         string   `json:"client_id"`
	ClientSecretFile string   `json:"client_secret_file"`
	ExtraScopes      []string `json:"extra_scopes,omitempty"`
	Domain           string   `json:"domain,omitempty"` // for Okta and AzureAD
	RedirectUrl      string   `json:"redirect_url"`

	ClientSecret string `json:"-"`
}

type Location struct {
	Any     string `json:"any,omitempty"`
	Get     string `json:"get,omitempty"`
	Post    string `json:"post,omitempty"`
	Put     string `json:"put,omitempty"`
	Delete  string `json:"delete,omitempty"`
	Head    string `json:"head,omitempty"`
	Connect string `json:"connect,omitempty"`
	Options string `json:"options,omitempty"`
	Trace   string `json:"trace,omitempty"`
	Patch   string `json:"patch,omitempty"`
}

type Logger struct {
	Level    string `json:"level"`
	Encoding string `json:"encoding"` // json or console
}

type Permission struct {
	Name      string     `json:"name"`              // Name is an identifier
	WebHook   string     `json:"webhook,omitempty"` // name of webhook provider (e.g. github)
	Locations []Location `json:"locations"`
	// contains filtered or unexported fields
}

type RPCPermission struct {
	Name  string   `json:"name"`
	Allow []string `json:"allow"`
}

type RPCServer struct {
	Bind        string `json:"bind,omitempty"`
	MetricsBind string `json:"metrics_bind,omitempty"`
}

type Role struct {
	Name        string     `json:"name"`
	Title       string     `json:"title"`
	Description string     `json:"description,omitempty"`
	Bindings    []*Binding `json:"bindings"`

	RPCMethodMatcher *rpc.MethodMatcher `json:"-"`
	System           bool               `json:"-"`
}

type Session struct {
	Type    string   `json:"type"` // secure_cookie or memcached
	KeyFile string   `json:"key_file,omitempty"`
	Servers []string `json:"servers,omitempty"`

	HashKey  []byte `json:"-"`
	BlockKey []byte `json:"-"`
}

type SocketBackend struct {
	Upstream string    `json:"upstream,omitempty"`
	Timeout  *Duration `json:"timeout,omitempty"`
	Agent    bool      `json:"agent,omitempty"`

	Url *url.URL `json:"-"`
}

type Template struct {
	Loader string `json:"loader"` // shotgun or embed
	Dir    string `json:"dir"`
}