#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct BrokerConfig {
/// Server configuration

#[serde(default)]
pub server: ServerConfig,
/// TLS configuration

#[serde(default)]
pub tls: TlsConfig,
/// Token configuration

#[serde(default)]
pub token: TokenConfig,
/// Rate limiting configuration

#[serde(default)]
pub rate_limit: RateLimitConfig,
/// Authentication / trust boundary configuration

#[serde(default)]
pub auth: AuthConfig,
/// Audit configuration

#[serde(default)]
pub audit: AuditConfig,
/// Revocation storage configuration

#[serde(default)]
pub revocation: RevocationConfig,
/// Credential proxy configuration

#[serde(default)]
pub proxy: ProxyConfig,
/// Consent service configuration

#[serde(default)]
pub consent: ConsentConfig,
/// Issuer identifier

#[serde(default = "default_issuer")]
pub issuer: String
}

#[must_use]
pub fn listen_addr(&self) -> &str;

#[must_use]
pub fn default_token_ttl(&self) -> i64;

#[must_use]
pub fn max_token_ttl(&self) -> i64;

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AuthConfig {
/// Require a verified client identity on protected endpoints.

///

/// Protected endpoints include:

/// - `/v1/capabilities`

/// - `/v1/secrets`

/// - `/v1/tokens/revoke`

#[serde(default = "default_require_verified_client_identity")]
pub require_verified_client_identity: bool,
/// Trust `X-Client-Cert-Fingerprint` header **only** when requests come from an explicitly

/// allowlisted internal proxy.

///

/// This is intended for deployments where TLS is terminated by an internal, verified proxy

/// that injects the fingerprint header after mutual authentication.

#[serde(default)]
pub trust_fingerprint_header: bool,
/// Allowlisted proxy IPs permitted to inject `X-Client-Cert-Fingerprint`.

///

/// When `trust_fingerprint_header` is `true`, requests with a remote IP in this list may

/// supply `X-Client-Cert-Fingerprint`. Requests from other IPs will have the header ignored.

#[serde(default)]
pub trusted_proxy_ips: Vec<String>
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ServerConfig {
/// Listen address

#[serde(default = "default_listen_addr")]
pub listen_addr: String,
/// Request timeout

#[serde(default = "default_request_timeout")]
pub request_timeout_secs: u64,
/// Maximum request body size

#[serde(default = "default_max_body_size")]
pub max_body_size: usize,
/// Enable CORS

#[serde(default)]
pub enable_cors: bool,
/// Allowed CORS origins

#[serde(default)]
pub cors_origins: Vec<String>,
/// Graceful shutdown timeout

#[serde(default = "default_shutdown_timeout")]
pub shutdown_timeout_secs: u64
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct TlsConfig {
/// Enable TLS

#[serde(default = "default_tls_enabled")]
pub enabled: bool,
/// TLS certificate path

#[serde(default = "default_cert_path")]
pub cert_path: PathBuf,
/// TLS key path

#[serde(default = "default_key_path")]
pub key_path: PathBuf,
/// CA certificate path for client verification

#[serde(default = "default_ca_path")]
pub ca_cert_path: PathBuf,
/// Require client certificates (mTLS)

#[serde(default = "default_require_client_cert")]
pub require_client_cert: bool,
/// Minimum TLS version (1.2 or 1.3)

#[serde(default = "default_min_tls_version")]
pub min_tls_version: String
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct TokenConfig {
/// Default token seconds

#[serde(default = "default_token_ttl")]
pub default_ttl_seconds: i64,
/// Maximum token TTL in seconds

#[serde(default = "default_max_token_ttl")]
pub max_ttl_seconds: i64,
/// Minimum token TTL in seconds

#[serde(default = "default_min_token_ttl")]
pub min_ttl_seconds: i64,
/// Require proof-of-possession by default

#[serde(default)]
pub require_pop_by_default: bool,
/// Token signing algorithm

#[serde(default = "default_signing_algorithm")]
pub signing_algorithm: String
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct RateLimitConfig {
/// Enable rate limiting

#[serde(default = "default_rate_limit_enabled")]
pub enabled: bool,
/// Requests per second per agent

#[serde(default = "default_requests_per_second")]
pub requests_per_second: u64,
/// Burst size

#[serde(default = "default_burst_size")]
pub burst_size: u64,
/// Capability request rate limit

#[serde(default = "default_capability_rate")]
pub capability_requests_per_minute: u64,
/// Secret request rate limit

#[serde(default = "default_secret_rate")]
pub secret_requests_per_minute: u64
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AuditConfig {
/// Enable audit logging

#[serde(default = "default_audit_enabled")]
pub enabled: bool,
/// Audit log file path

#[serde(default)]
pub log_path: Option<PathBuf>,
/// Enable hash chain for audit integrity

#[serde(default = "default_hash_chain")]
pub enable_hash_chain: bool,
/// Webhook URL for audit events

#[serde(default)]
pub webhook_url: Option<String>,
/// Webhook authorization header

#[serde(default)]
pub webhook_auth: Option<String>,
/// Buffer size for async

#[serde(default = "default_audit_buffer")]
pub buffer_size: usize
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct RevocationConfig {
/// Storage backend for revocations

#[serde(default)]
pub backend: RevocationBackend,
/// File path for the file backend (JSONL log + snapshots)

#[serde(default)]
pub file_path: Option<PathBuf>,
/// SQL backend configuration

#[serde(default)]
pub sql: RevocationSqlConfig,
/// HTTP backend configuration

#[serde(default)]
pub http: RevocationHttpConfig,
/// Compaction interval in seconds (0 disables)

#[serde(default = "default_revocation_compaction_interval_secs")]
pub compaction_interval_secs: u64,
/// Max entries to retain in memory before forcing cleanup

#[serde(default = "default_revocation_max_entries")]
pub max_entries: usize,
/// fsync on revoke/unrevoke writes (stronger durability, higher latency)

#[serde(default = "default_revocation_fsync_on_write")]
pub fsync_on_write: bool
}

#[derive(Debug, Clone, Copy, Default, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "snake_case")]
pub enum RevocationBackend {
    /// In-memory only (restart loses revocations)
    #[default]
    Memory,
    /// File-backed (restart-safe on the same node)
    File,
    /// SQL-backed (Postgres/SQLite) revocation store
    Sql,
    /// HTTP-backed revocation store (external service)
    Http,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct RevocationSqlConfig {
/// Database URL (e.g. `postgres://...` or `sqlite:///...`)

#[serde(default)]
pub database_url: Option<String>,
/// Table name to use for revocations

#[serde(default = "default_revocation_sql_table")]
pub table: String,
/// Max database connections in the pool

#[serde(default = "default_revocation_sql_max_connections")]
pub max_connections: u32,
/// Connection timeout (seconds)

#[serde(default = "default_revocation_sql_connect_timeout_secs")]
pub connect_timeout_secs: u64
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct RevocationHttpConfig {
/// Base URL of the revocation service (e.g. `https://revocations.internal`)

#[serde(default)]
pub base_url: Option<String>,
/// Allow insecure `http://` base URLs (default: false).

///

/// Production deployments should prefer mTLS/HTTPS for this integration.

#[serde(default = "default_revocation_http_allow_insecure")]
pub allow_insecure: bool,
/// Optional Authorization header value to include (e.g. `Bearer ...`)

#[serde(default)]
pub auth_header: Option<String>,
/// Request timeout (seconds)

#[serde(default = "default_revocation_http_timeout_secs")]
pub timeout_secs: u64,
/// Positive cache TTL (seconds) for `is_revoked`/`get` results

#[serde(default = "default_revocation_http_cache_ttl_secs")]
pub cache_ttl_secs: u64,
/// Negative cache TTL (seconds) for not-revoked results

#[serde(default = "default_revocation_http_negative_cache_ttl_secs")]
pub negative_cache_ttl_secs: u64,
/// Maximum TTL (seconds) for positive cache entries when token expiry is known.

///

/// When the HTTP revocation service returns `original_expiry_ms`, the broker can safely cache

/// a *revoked* result until (expiry + grace), capped by this maximum.

#[serde(default = "default_revocation_http_positive_cache_max_ttl_secs")]
pub positive_cache_max_ttl_secs: u64
}

#[allow(clippy::too_many_lines)]
#[must_use]
pub fn from_env() -> Self;

pub fn from_file(path: impl AsRef<std::path::Path>) -> Result<Self, ConfigError>;

#[allow(clippy::too_many_lines)]
pub fn validate(&self) -> Result<(), ConfigError>;

#[derive(Debug, thiserror::Error)]
pub enum ConfigError {
    /// I/O error
    #[error("I/O error: {0}")]
    IoError(String),

    /// Parse error
    #[error("Parse error: {0}")]
    ParseError(String),

    /// Validation error
    #[error("Validation error: {0}")]
    ValidationError(String),
}