rtc

type Config struct {
	// ICEServers is the static list every peer receives (STUN servers,
	// or TURN entries with long-lived credentials the host accepts).
	// Only stun:, stuns:, turn:, turns: URL schemes are allowed; New
	// refuses anything else.
	ICEServers []ICEServer

	// TURN, when set, appends a per-peer time-limited entry.
	TURN *TURN

	// Authorize decides who joins which room. Required for Mount and
	// ServeHTTP; Serve callers pass their own Join and may leave it nil.
	// A returned error refuses the upgrade with 403 (or the status
	// carried by a *HTTPError). The Join it returns is trusted.
	Authorize func(r *http.Request) (Join, error)

	// Path is the WebSocket endpoint Mount registers. Default
	// "/__gofastr/rtc". Validated like relay.Config.Path: absolute, no
	// trailing slash, no traversal, no percent-encoding.
	Path string

	// MaxPeers caps members per room, local plus remote; default 8. A
	// join past the cap is refused with 409 before the upgrade. Mesh
	// cost is O(n²) connections; an SFU is a different product.
	MaxPeers int

	// MaxSignalBytes caps one signaling payload (SDP, ICE candidate);
	// default 48 KiB. Larger frames are dropped and the peer closed.
	// A camera plus a data channel offers in 3-8 KiB; many codecs,
	// simulcast, and several tracks reach 15-25 KiB. The cap plus 1 KiB
	// of envelope must fit WS.ReadLimit (at most 64 KiB), or New panics
	// rather than accept a cap the socket would cut off first.
	MaxSignalBytes int

	// MaxStatusBytes caps a peer's status document; default 1 KiB.
	MaxStatusBytes int

	// MaxFramesPerSecond caps inbound frames per socket (token bucket,
	// burst = 2× rate); default 128. Over the cap the socket is closed.
	MaxFramesPerSecond int

	// MaxSocketsPerUser caps concurrent signaling sockets per principal
	// (Join.User) across every room; default 16, the core/stream seat
	// parity (SSE broker, CRUD event stream). A principal's next socket
	// past the cap displaces its oldest one — the replace-on-rejoin
	// policy, applied across rooms — so a reconnecting client always
	// wins and one principal can never park unbounded read loops and
	// per-room channel goroutines. Zero keeps the default; sockets whose
	// host derived no Join.User share one bucket.
	MaxSocketsPerUser int

	// RoomIdleTTL is how long an empty room's state survives before it
	// is dropped; default 1 minute. Rooms are created on first join.
	RoomIdleTTL time.Duration

	// WS is applied to every upgrade. ConnectionID and OnClose are
	// owned by the package and overwritten. Leave zero for defaults
	// (ReadLimit is forced to at most 64 KiB either way).
	WS stream.WSConfig

	Logger *slog.Logger // nil means slog.Default()
}

type Feature string

type HTTPError struct {
	Status  int
	Message string // plain, short; written as the response body
}

type ICEServer struct {
	URLs       []string `json:"urls"`
	Username   string   `json:"username,omitempty"`
	Credential string   `json:"credential,omitempty"`
}

type Join struct {
	Room        string // required; 1-128 bytes, printable ASCII, no whitespace
	Role        string // optional app label ("caller", "viewer"); 0-32 bytes, same charset
	PeerID      string // optional stable id; empty means the server mints one per socket
	User        string // optional identity shown to the room (a user id); empty = anonymous
	DisplayName string // optional; 0-64 bytes; control bytes refused
}

type PeerInfo struct {
	ID          string          `json:"id"`
	Role        string          `json:"role,omitempty"`
	User        string          `json:"user,omitempty"`
	DisplayName string          `json:"name,omitempty"`
	Order       int64           `json:"order"`
	Status      json.RawMessage `json:"status,omitempty"`
}

type Signaler struct {
	// contains filtered or unexported fields
}

type TURN struct {
	URLs   []string      // "turn:host:3478?transport=udp", "turns:host:5349"
	Secret string        // static-auth-secret configured on the TURN server
	TTL    time.Duration // credential lifetime; 0 means 1h; minimum 1m
}