local typedefs = require "kong.db.schema.typedefs"

return {
  name = "o11y-proxy",
  fields = {
    { consumer = typedefs.no_consumer },
    { protocols = typedefs.protocols_http },
    { config = {
        type = "record",
        fields = {
          {
            router_service_url = {
              type = "string",
              required = true,
              description = "The full URL of the router service to query for target routing information (e.g., http://globalserver-svc.observability:8080/internal/v1/routes).",
            }
          },
          {
            authn_service_url = {
              type = "string",
              required = false,
              description = "The full URL of the authentication service to validate Auth0 tokens (e.g., http://account-svc:11000/inner/account-provider/api/v1/user/authn). If not configured, authentication will be skipped.",
            }
          },
          {
            authz_service_url = {
              type = "string",
              required = false,
              description = "The full URL of the authorization service to check user permissions (e.g., http://account-svc:11000/inner/account-provider/api/v1/user/authz). If not configured, authorization will be skipped.",
            }
          },
          {
            token_header = typedefs.header_name {
              default = "Authorization",
              required = true,
              description = "The header name where the Auth0 token will be retrieved from the client request.",
            }
          },
          {
            region = {
              type = "string",
              required = false,
              default = "us-west-2",
              description = "AWS region to use when signing requests.",
            }
          },
          {
            router_timeout = {
              type = "number",
              required = false,
              default = 5000,
              description = "Timeout in milliseconds for router service queries (internal service, typically fast).",
            }
          },
          {
            authn_timeout = {
              type = "number",
              required = false,
              default = 10000,
              description = "Timeout in milliseconds for authentication service queries.",
            }
          },
          {
            authz_timeout = {
              type = "number",
              required = false,
              default = 10000,
              description = "Timeout in milliseconds for authorization service queries.",
            }
          },
          {
            aws_sts_timeout = {
              type = "number",
              required = false,
              default = 10000,
              description = "Timeout in milliseconds for AWS STS API calls (IRSA and AssumeRole operations).",
            }
          },
          {
            router_cache_ttl = {
              type = "number",
              required = false,
              default = 300,
              description = "TTL in seconds for router service response cache. Routing configuration is relatively stable. Set to 0 to disable caching.",
            }
          },
          {
            authn_cache_ttl = {
              type = "number",
              required = false,
              default = 1800,
              description = "TTL in seconds for authentication service response cache. Set to 0 to disable caching.",
            }
          },
          {
            authz_cache_ttl = {
              type = "number",
              required = false,
              default = 60,
              description = "TTL in seconds for authorization service response cache. Set to 0 to disable caching.",
            }
          },
        }
      }
    }
  },
}