/*
 * Artifact Keeper API
 *
 * Enterprise artifact registry supporting 45+ package formats.  ## Authentication  The JSON management API under `/api/v1/_*` accepts **API tokens only as `Authorization: Bearer <token>`**. This is the canonical scheme for programmatic access; JWTs issued by the login flow also use `Bearer`. HTTP Basic credentials on `/api/v1/_*` are validated *only* as a real `username:password` login — the password half is **not** retried as an API token. A request to `/api/v1/_*` that sends an API token in the password field of Basic auth therefore returns `401 AUTH_ERROR`; switch to `Authorization: Bearer <token>`.  Format (package-manager) endpoints such as `/v2/_*` (OCI), `/incus/_*`, `/debian/_*`, and the language registries are intentionally more permissive for client compatibility: in addition to Bearer, they accept HTTP **Basic** auth with the API token supplied in the *password* field (any username), matching the `pip` netrc / Artifactory-style `token:<api_token>` convention used by package managers that cannot send a Bearer header. This Basic-with-token fallback applies to format endpoints only, never to `/api/v1/_*`.
 *
 * The version of the OpenAPI document: 1.4.1
 * 
 * Generated by: https://openapi-generator.tech
 */

use crate::models;
use serde::{Deserialize, Serialize};

/// SystemConfigResponse : Runtime configuration values.  This response intentionally omits all secrets, credentials, and internal connection strings.  Disclosure is tiered (see `get_system_config`):  * **Public-safe fields** are always present — they only describe UI/client   affordances a caller needs *before* authenticating (upload limit, demo   mode, whether guest access and which login providers are available). * **Security-posture fields** (`scanners`, `search_engine`,   `storage_backend`, `permissions`, `plugin_signing`) describe the   instance's defensive configuration. They are returned **only to   authenticated admins** and are omitted for anonymous / non-admin callers,   so the deployment's security posture cannot be fingerprinted by an   unauthenticated attacker.
#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
pub struct SystemConfigResponse {
    /// Authentication provider availability. Needed by the login UI before the user authenticates, so this is public-safe.
    #[serde(rename = "auth")]
    pub auth: Box<models::AuthConfig>,
    /// Whether the instance is running in demo mode (writes blocked).
    #[serde(rename = "demo_mode")]
    pub demo_mode: bool,
    /// Whether anonymous (unauthenticated) access is permitted at all (issue #850). When `false`, the server rejects all unauthenticated requests except for the login, setup, health, and OCI challenge endpoints. Frontends should hide UI affordances that imply public access (e.g. the \"public repo\" toggle) and redirect unauthenticated users to the login page.
    #[serde(rename = "guest_access_enabled")]
    pub guest_access_enabled: bool,
    /// Maximum upload size in bytes (0 means no limit).
    #[serde(rename = "max_upload_size_bytes")]
    pub max_upload_size_bytes: i64,
    /// OIDC issuer URL, if configured. This is public information needed by clients to initiate the OIDC flow.
    #[serde(rename = "oidc_issuer", default, with = "::serde_with::rust::double_option", skip_serializing_if = "Option::is_none")]
    pub oidc_issuer: Option<Option<String>>,
    /// Fine-grained permissions enforcement status. Permission rules can be managed via /api/v1/permissions and are actively enforced. Admin-only (security posture).
    #[serde(rename = "permissions", default, with = "::serde_with::rust::double_option", skip_serializing_if = "Option::is_none")]
    pub permissions: Option<Option<Box<models::PermissionsConfig>>>,
    /// Plugin signature-verification (supply-chain) policy status. Admin-only (security posture).
    #[serde(rename = "plugin_signing", default, with = "::serde_with::rust::double_option", skip_serializing_if = "Option::is_none")]
    pub plugin_signing: Option<Option<Box<models::PluginSigningConfig>>>,
    /// Scanner availability. Admin-only (security posture).
    #[serde(rename = "scanners", default, with = "::serde_with::rust::double_option", skip_serializing_if = "Option::is_none")]
    pub scanners: Option<Option<Box<models::ScannersConfig>>>,
    /// Search engine type: \"opensearch\" when configured, \"database\" otherwise. Admin-only (security posture).
    #[serde(rename = "search_engine", default, with = "::serde_with::rust::double_option", skip_serializing_if = "Option::is_none")]
    pub search_engine: Option<Option<String>>,
    /// Storage backend type (e.g. \"filesystem\", \"s3\", \"gcs\", \"azure\"). Admin-only (security posture).
    #[serde(rename = "storage_backend", default, with = "::serde_with::rust::double_option", skip_serializing_if = "Option::is_none")]
    pub storage_backend: Option<Option<String>>,
}

impl SystemConfigResponse {
    /// Runtime configuration values.  This response intentionally omits all secrets, credentials, and internal connection strings.  Disclosure is tiered (see `get_system_config`):  * **Public-safe fields** are always present — they only describe UI/client   affordances a caller needs *before* authenticating (upload limit, demo   mode, whether guest access and which login providers are available). * **Security-posture fields** (`scanners`, `search_engine`,   `storage_backend`, `permissions`, `plugin_signing`) describe the   instance's defensive configuration. They are returned **only to   authenticated admins** and are omitted for anonymous / non-admin callers,   so the deployment's security posture cannot be fingerprinted by an   unauthenticated attacker.
    pub fn new(auth: models::AuthConfig, demo_mode: bool, guest_access_enabled: bool, max_upload_size_bytes: i64) -> SystemConfigResponse {
        SystemConfigResponse {
            auth: Box::new(auth),
            demo_mode,
            guest_access_enabled,
            max_upload_size_bytes,
            oidc_issuer: None,
            permissions: None,
            plugin_signing: None,
            scanners: None,
            search_engine: None,
            storage_backend: None,
        }
    }
}

