config

type ACMEConfig struct {
	// Email for ACME registration
	Email string `toml:"email"`

	// Domain is the domain to obtain a certificate for
	Domain string `toml:"domain"`

	// Directory is the ACME server URL (default: Let's Encrypt production)
	Directory string `toml:"directory"`

	// StorageDir is where ACME certificates and account info are stored
	StorageDir string `toml:"storage_dir"`

	// UseStaging uses Let's Encrypt staging (for testing)
	UseStaging bool `toml:"use_staging"`
}

type BootstrapAdminConfig struct {
	// Username for the super admin. Default: "admin"
	Username string `toml:"username"`

	// Password for the super admin. If empty on first boot, a random password is generated.
	Password string `toml:"password"`

	// CredentialFile is where an auto-generated bootstrap password is written.
	// Relative paths resolve against the process working directory.
	CredentialFile string `toml:"password_file"`
}

type CacheConfig struct {
	// Driver is the cache driver name: "memory" (default). Other drivers may fail validation.
	Driver string `toml:"driver"`

	// Drivers holds per-driver configuration (Reva-style).
	// Example: [cache.drivers.memory] ...
	Drivers map[string]any `toml:"drivers"`
}

type CodeFlowConfig struct {
	IncludesTokenExchangeRequirement *bool `toml:"includes_token_exchange_requirement"`
	RequiresTokenExchangeRequirement *bool `toml:"requires_token_exchange_requirement"`
	RequiresHTTPRequestSignatures    *bool `toml:"requires_http_request_signatures"`
}

type CompatibilityScope string

type Config struct {
	// Mode selects a preset bundle: strict, dev, or validator.
	Mode string `toml:"mode"`

	// PublicOrigin is the public origin (scheme + host + port) for this instance.
	// Example: "https://localhost:9200"
	PublicOrigin string `toml:"public_origin"`

	// ExternalBasePath is the optional path prefix for app endpoints.
	// The root-only well-known discovery endpoint (/.well-known/ocm) is
	// never under this path; the local JWKS route (<endPoint>/jwks) is
	// mounted under the OCM service and does move with this path.
	// Example: "/ocm" or empty string
	ExternalBasePath string `toml:"external_base_path"`

	// ListenAddr is the address to listen on.
	// Example: ":9200"
	ListenAddr string `toml:"listen_addr"`

	// Server holds server-level settings.
	Server ServerConfig `toml:"server"`

	// TLS configuration
	TLS TLSConfig `toml:"tls"`

	// OutboundHTTP configuration
	OutboundHTTP OutboundHTTPConfig `toml:"outbound_http"`

	// Signature configuration
	Signature SignatureConfig `toml:"signature"`

	// Cache configuration
	Cache CacheConfig `toml:"cache"`

	// Peer trust configuration
	PeerTrust PeerTrustConfig `toml:"peer_trust"`

	// Logging configuration
	Logging LoggingConfig `toml:"logging"`

	// TokenExchange configuration
	TokenExchange TokenExchangeConfig `toml:"token_exchange"`

	// HTTP holds per-service HTTP configuration (Reva-style).
	HTTP HTTPConfig `toml:"http"`

	// Persistence holds persistence backend settings.
	Persistence PersistenceConfig `toml:"persistence"`

	// OCM holds OCM-specific settings.
	OCM OCMConfig `toml:"ocm"`

	// Statistics holds federation validator statistics settings.
	Statistics StatisticsConfig `toml:"statistics"`

	// Validator holds federation validator session, probe, and active settings.
	Validator ValidatorSection `toml:"validator"`
}

type DiscoveryConfig struct {
	// PeerAPIVersionPolicy selects accept policy: accept-any, exact, at-least-1.4.
	PeerAPIVersionPolicy string `toml:"peer_api_version_policy"`

	// PeerAPIVersionWarn selects warning behavior: any-diff, lower-only, none.
	PeerAPIVersionWarn string `toml:"peer_api_version_warn"`
}

type FlagOverrides struct {
	ListenAddr        *string
	PublicOrigin      *string
	ExternalBasePath  *string
	AdminUsername     *string
	AdminPassword     *string
	LoggingLevel      *string
	TokenExchangePath *string
}

type HTTPConfig struct {
	// Services maps service names to their raw config maps.
	// Each service decodes its own config via cfg.Decode() with Setter interface.
	Services map[string]map[string]any `toml:"services"`

	// Interceptors maps interceptor names to their raw config maps.
	// Ratelimit profiles live at [http.interceptors.ratelimit.profiles.<name>].
	// Per-service opt-in is [http.services.<svc>.ratelimit] with profile = "<name>".
	Interceptors map[string]map[string]any `toml:"interceptors"`
}

type InviteConfig struct {
	// EnforceMustInvite requires an exchanged invite before accepting a share
	// creation notification (IETF-OCM:
	// https://github.com/cs3org/OCM-API/blob/6a0586183cbef10ecae9dedc42561806447eb2f5/IETF-OCM.md#L763-L765).
	// Nil means enabled (the default); explicit false is the legacy opt-out.
	EnforceMustInvite *bool `toml:"enforce_must_invite"`
}

type LoaderOptions struct {
	// ConfigPath is the path to a TOML config file (optional).
	// If provided but file is missing or invalid, loading fails.
	ConfigPath string

	// ModeFlag is the --mode flag value (overrides config file mode).
	ModeFlag string

	// FlagOverrides are CLI flag values that override config file values.
	FlagOverrides FlagOverrides

	// Logger is accepted but not read by Load.
	Logger *slog.Logger
}

type LoggingConfig struct {
	// Level is the minimum log level: trace, debug, info, warn, error.
	// Default: info in strict mode, debug in dev mode.
	Level string `toml:"level"`
}

type Mode string

type OCMConfig struct {
	// CompatibilityScope selects global vs scoped peer-compat leniency.
	// Default: global. This is ocmgo-internal policy, not an OCM spec field.
	CompatibilityScope CompatibilityScope `toml:"compatibility_scope"`

	Discovery   DiscoveryConfig   `toml:"discovery"`
	CodeFlow    CodeFlowConfig    `toml:"code_flow"`
	PeerMapping PeerMappingConfig `toml:"peer_compat"`
	Invite      *InviteConfig     `toml:"invite"`
}

type OutboundHTTPConfig struct {
	// SSRF holds SSRF protection settings.
	// Configure via [outbound_http.ssrf] in TOML.
	SSRF SSRFConfig `toml:"ssrf"`

	// TimeoutMS is the overall request timeout in milliseconds
	TimeoutMS int `toml:"timeout_ms"`

	// ConnectTimeoutMS is the connection timeout in milliseconds
	ConnectTimeoutMS int `toml:"connect_timeout_ms"`

	// MaxRedirects is the maximum number of redirects to follow
	MaxRedirects int `toml:"max_redirects"`

	// MaxResponseBytes is the maximum response body size
	MaxResponseBytes int64 `toml:"max_response_bytes"`

	// InsecureSkipVerify disables TLS verification (dev-only)
	InsecureSkipVerify bool `toml:"insecure_skip_verify"`

	// TLSRootCAFile is a PEM file of root CAs for outbound TLS verification.
	TLSRootCAFile string `toml:"tls_root_ca_file"`

	// TLSRootCADir is a directory of .pem/.crt files for outbound TLS root CAs.
	TLSRootCADir string `toml:"tls_root_ca_dir"`

	// ProxyURL is an optional HTTP/HTTPS proxy for all outbound requests.
	// Must be an absolute http or https URL with no userinfo.
	// When set, the proxy host is operator-trusted; private and loopback
	// addresses are permitted.
	// When set, proxy_url takes precedence over use_env_fallback; the
	// explicit URL is used and environment variables are not consulted.
	ProxyURL string `toml:"proxy_url"`

	// UseEnvFallback (config key use_env_fallback) enables reading
	// HTTP_PROXY/HTTPS_PROXY/NO_PROXY from the environment when proxy_url is
	// not set. Default: false in all presets. Set to true to opt in to
	// ambient proxy discovery, or set the
	// OCM_CONFIG_OUTBOUND_HTTP_USE_ENV_FALLBACK environment variable.
	UseEnvFallback bool `toml:"use_env_fallback"`
}

type PeerMappingConfig struct {
	IncludesTokenExchangeRequirement *bool `toml:"includes_token_exchange_requirement"`
	RequiresTokenExchangeRequirement *bool `toml:"requires_token_exchange_requirement"`
	RequiresHTTPRequestSignatures    *bool `toml:"requires_http_request_signatures"`

	HostPlatform map[string]string              `toml:"host_platform"`
	Platform     map[string]PeerPlatformOverlay `toml:"platform"`
	// contains filtered or unexported fields
}

type PeerMappingInstanceOverlay struct {
	IncludesTokenExchangeRequirement *bool `toml:"includes_token_exchange_requirement"`
	RequiresTokenExchangeRequirement *bool `toml:"requires_token_exchange_requirement"`
}

type PeerPlatformOverlay struct {
	IncludesTokenExchangeRequirement *bool `toml:"includes_token_exchange_requirement"`
	RequiresTokenExchangeRequirement *bool `toml:"requires_token_exchange_requirement"`

	Instance map[string]PeerMappingInstanceOverlay `toml:"instance"`
}

type PeerTrustConfig struct {
	// Enabled enables peer trust features. Default: false.
	Enabled bool `toml:"enabled"`

	// ConfigPaths is a list of paths to JSON trust group config files.
	// Required when enabled.
	ConfigPaths []string `toml:"config_paths"`

	// Policy contains trust policy settings.
	Policy PeerTrustPolicyConfig `toml:"policy"`

	// MembershipCache contains membership cache settings.
	MembershipCache PeerTrustMembershipCacheConfig `toml:"membership_cache"`
}

type PeerTrustMembershipCacheConfig struct {
	// TTLSeconds is the cache TTL in seconds. Default: 21600 (6 hours).
	TTLSeconds int `toml:"ttl_seconds"`

	// MaxStaleSeconds is the max staleness before treating as unavailable. Default: 604800 (7 days).
	MaxStaleSeconds int `toml:"max_stale_seconds"`
}

type PeerTrustPolicyConfig struct {
	// AllowList is a list of always-allowed hosts.
	AllowList []string `toml:"allow_list"`

	// DenyList is a list of always-denied hosts.
	DenyList []string `toml:"deny_list"`
}

type PersistenceConfig struct {
	// Backend selects the persistence backend: memory, json, sqlite, mirror.
	// Preset default: strict uses sqlite; dev uses memory (see presets.go).
	Backend string `toml:"backend"`

	// DataDir is the data directory for durable backends (json, sqlite, mirror).
	// Required when backend is json, sqlite, or mirror.
	DataDir string `toml:"data_dir"`

	// ContentDir is the managed local content root for demo shares.
	ContentDir string `toml:"content_dir"`
}

type SSRFConfig struct {
	// Mode is one of: strict, off.
	Mode string `toml:"mode"`

	// RoutePolicy names the active route policy from RoutePolicies.
	// When set the named policy must exist in RoutePolicies.
	RoutePolicy string `toml:"route_policy"`

	// RoutePolicies maps policy names to their definitions.
	RoutePolicies map[string]SSRFRoutePolicyConfig `toml:"route_policies"`
}

type SSRFRoutePolicyConfig struct {
	// AllowPrivateHostSuffixes lists host suffixes permitted for private routing.
	AllowPrivateHostSuffixes []string `toml:"allow_private_host_suffixes"`

	// AllowPrivateCIDRs lists CIDR ranges permitted for private routing.
	// Catch-all CIDRs (0.0.0.0/0, ::/0) are rejected by route-policy validation.
	AllowPrivateCIDRs []string `toml:"allow_private_cidrs"`

	// AllowedPorts restricts which destination ports are permitted.
	AllowedPorts []int `toml:"allowed_ports"`

	// AllowIPLiterals permits direct IP address targets when true.
	AllowIPLiterals bool `toml:"allow_ip_literals"`
}

type ServerConfig struct {
	// TrustedProxies is a list of CIDR ranges for trusted reverse proxies.
	// X-Forwarded-* headers are only honored from these addresses.
	// Default: ["127.0.0.0/8", "::1/128"]
	TrustedProxies []string `toml:"trusted_proxies"`

	// BootstrapAdmin holds super admin bootstrap configuration.
	BootstrapAdmin BootstrapAdminConfig `toml:"bootstrap_admin"`
}

type SignatureConfig struct {
	// KeyPath is where the signing private key is stored
	KeyPath string `toml:"key_path"`

	// Label is the RFC 9421 signature dictionary label (default: ocm).
	Label string `toml:"label"`

	// KidFragment is the host#fragment suffix for local JWKS kid (default: key1).
	KidFragment string `toml:"kid_fragment"`

	// CreatedMaxAgeSeconds is the maximum signature age verifiers accept.
	CreatedMaxAgeSeconds int `toml:"created_max_age_seconds"`

	// CreatedMaxSkewSeconds is the maximum clock skew into the future verifiers accept.
	CreatedMaxSkewSeconds int `toml:"created_max_skew_seconds"`

	// AllowedAlgorithms lists permitted asymmetric RFC 9421 algorithms for
	// inbound verification and outbound SignRequest. The local private key
	// (default Ed25519) still performs signing; this list must include that
	// key's algorithm or SignRequest fails before the request is sent.
	AllowedAlgorithms []string `toml:"allowed_algorithms"`

	// JwksURI optionally overrides the local JWKS URL advertised in
	// discovery. Empty derives it from the route inventory as
	// <endPoint>/jwks.
	JwksURI string `toml:"jwks_uri"`

	// MinRSAModulusBits is the local minimum RSA modulus size for inbound
	// signature verification. Zero means use the default (2048).
	MinRSAModulusBits int `toml:"min_rsa_modulus_bits"`
}

type StatisticsConfig struct {
	// Enabled turns on statistics host hashing and related exports.
	Enabled bool `toml:"enabled"`
}

type TLSConfig struct {
	// Mode is one of: off, static, selfsigned, acme
	Mode string `toml:"mode"`

	// CertFile and KeyFile for static mode
	CertFile string `toml:"cert_file"`
	KeyFile  string `toml:"key_file"`

	// HTTPPort for HTTP listener (used for ACME challenges and redirects)
	HTTPPort int `toml:"http_port"`

	// HTTPSPort for HTTPS listener
	HTTPSPort int `toml:"https_port"`

	// SelfSignedDir is where self-signed certs are stored
	SelfSignedDir string `toml:"self_signed_dir"`

	// TLSDir optionally re-roots default paths (self_signed_dir, acme.storage_dir, signature.key_path).
	// When set, paths are derived unless explicitly defined in TOML. Default: empty (unset).
	TLSDir string `toml:"tls_dir"`

	// ACME configuration
	ACME ACMEConfig `toml:"acme"`
}

type TokenExchangeConfig struct {
	// Path is the token exchange endpoint path (relative to /ocm/).
	// Default: "token"
	Path string `toml:"path"`
}

type ValidatorActiveConfig struct {
	// Enabled turns on active-session legs. Nil means enabled (the default);
	// explicit false is the passive-only opt-out.
	Enabled *bool `toml:"enabled"`
}

type ValidatorProbeConfig struct {
	Email       string `toml:"email"`
	DisplayName string `toml:"display_name"`
}

type ValidatorSection struct {
	Session ValidatorSessionConfig `toml:"session"`
	Probe   ValidatorProbeConfig   `toml:"probe"`
	Active  ValidatorActiveConfig  `toml:"active"`
}

type ValidatorSessionConfig struct {
	InFlightPassiveLimit       int `toml:"in_flight_passive_limit"`
	CreatedTTLSeconds          int `toml:"created_ttl_seconds"`
	PassiveRunningTTLSeconds   int `toml:"passive_running_ttl_seconds"`
	PassiveCompleteTTLSeconds  int `toml:"passive_complete_ttl_seconds"`
	TerminalRetentionDays      int `toml:"terminal_retention_days"`
	StallTimeoutSeconds        int `toml:"stall_timeout_seconds"`
	ReverseShareTimeoutSeconds int `toml:"reverse_share_timeout_seconds"`
	MaxDriveIdleSeconds        int `toml:"max_drive_idle_seconds"`
	ReapIntervalSeconds        int `toml:"reap_interval_seconds"`
	SessionLimit               int `toml:"session_limit"`
	MaxDispatchAttempts        int `toml:"max_dispatch_attempts"`
	BackoffBaseSeconds         int `toml:"backoff_base_seconds"`
	BackoffCapSeconds          int `toml:"backoff_cap_seconds"`
}