v1alpha1

type FerrFlowConnection struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   FerrFlowConnectionSpec   `json:"spec,omitempty"`
	Status FerrFlowConnectionStatus `json:"status,omitempty"`
}

type FerrFlowConnectionList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []FerrFlowConnection `json:"items"`
}

type FerrFlowConnectionSpec struct {
	// URL is the base of the FerrFlow API — e.g. `https://ferrflow.example.com`.
	// The operator appends `/api/v1/…` paths itself.
	//
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Pattern=`^https?://`
	URL string `json:"url"`

	// Organization is the FerrFlow org slug this connection targets. Every
	// `FerrFlowSecret` referencing this connection resolves `project` and
	// `vault` inside this org.
	//
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Organization string `json:"organization"`

	// TokenSecretRef points at a Kubernetes Secret holding a FerrFlow
	// authentication token — `ffclust_...` (cluster identity) or `fft_...`
	// (user API token, org-scoped, discouraged).
	//
	// Kept for **air-gapped clusters** where FerrFlow cannot reach the
	// cluster's OIDC JWKS endpoint, and for **non-Kubernetes callers**.
	// When FerrFlow can reach the cluster, prefer `oidc` — no secret at
	// rest, short-lived tokens, automatic rotation.
	//
	// +optional
	TokenSecretRef *SecretKeyRef `json:"tokenSecretRef,omitempty"`

	// OIDC enables workload-identity authentication: the operator presents
	// its projected ServiceAccount token to FerrFlow, which validates it
	// against the cluster's registered OIDC config and mints a short-lived
	// bearer. No long-lived secret on the cluster side, revocation is
	// instant on the FerrFlow side.
	//
	// Requires the FerrFlow cluster resource to be pre-configured with
	// OIDC (`PUT /orgs/:org/clusters/:id/oidc` on the FerrFlow API), and
	// the operator pod to have a projected SA token volume mounted at
	// `oidc.tokenPath` with audience matching `oidc.audience`.
	//
	// +optional
	OIDC *OIDCAuth `json:"oidc,omitempty"`
}

type FerrFlowConnectionStatus struct {
	// Conditions follows the upstream `metav1.Condition` convention. The
	// primary condition is `Ready` — `True` when the token authenticates and
	// the `secrets:read` scope is present.
	//
	// +optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// LastCheckedAt is the timestamp of the most recent auth probe.
	//
	// +optional
	LastCheckedAt *metav1.Time `json:"lastCheckedAt,omitempty"`
}

type FerrFlowSecret struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   FerrFlowSecretSpec   `json:"spec,omitempty"`
	Status FerrFlowSecretStatus `json:"status,omitempty"`
}

type FerrFlowSecretList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []FerrFlowSecret `json:"items"`
}

type FerrFlowSecretSpec struct {
	// ConnectionRef points at a FerrFlowConnection in the same namespace.
	//
	// +kubebuilder:validation:Required
	ConnectionRef LocalObjectReference `json:"connectionRef"`

	// Project is the FerrFlow project slug.
	//
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Project string `json:"project"`

	// Vault is the FerrFlow vault name inside the project (often used as the
	// environment identifier: `production`, `staging`, …).
	//
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Vault string `json:"vault"`

	// Selector chooses which secrets to sync.
	//
	// +optional
	Selector SecretSelector `json:"selector,omitempty"`

	// Target controls the generated Secret.
	//
	// +optional
	Target SecretTarget `json:"target,omitempty"`

	// RefreshInterval is the cadence at which the operator polls FerrFlow for
	// value changes, expressed in Go's `time.Duration` syntax (`30m`, `1h`).
	// Defaults to `1h`. Set to `0s` to disable scheduled refreshes (the
	// operator still reacts to spec changes).
	//
	// +optional
	// +kubebuilder:default="1h"
	RefreshInterval string `json:"refreshInterval,omitempty"`

	// RolloutRestart lists workloads whose pods should be rolled when secret
	// values change. Pattern: the operator patches the pod template's
	// `ferrflow.io/restartedAt` annotation to force a rolling update.
	//
	// +optional
	RolloutRestart []WorkloadRef `json:"rolloutRestart,omitempty"`

	// Transforms rewrite the revealed key/value map before it's written to
	// the target Secret. Applied in order. See SecretTransform for the
	// supported operations.
	//
	// +optional
	Transforms []SecretTransform `json:"transforms,omitempty"`
}

type FerrFlowSecretStatus struct {
	// Conditions conveys the health of this sync. The primary condition is
	// `Ready` — `True` when the target Secret mirrors the desired keys.
	//
	// +optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// LastSyncedAt is the timestamp of the most recent successful reveal.
	//
	// +optional
	LastSyncedAt *metav1.Time `json:"lastSyncedAt,omitempty"`

	// SyncedKeys is the list of keys present in the target Secret after the
	// most recent reconciliation. Handy for `kubectl get` columns and for
	// diffing which keys disappeared upstream.
	//
	// +optional
	SyncedKeys []string `json:"syncedKeys,omitempty"`

	// MissingKeys lists keys that were requested in `spec.selector.names` but
	// were not present in the FerrFlow vault at last reveal. When non-empty,
	// `Ready` is set to `False`.
	//
	// +optional
	MissingKeys []string `json:"missingKeys,omitempty"`

	// ObservedGeneration is the generation of the CR the controller has
	// successfully applied.
	//
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type LocalObjectReference struct {
	// +kubebuilder:validation:Required
	Name string `json:"name"`
}

type OIDCAuth struct {
	// ClusterID is the UUID of the cluster resource registered in FerrFlow.
	// Admins retrieve it from the FerrFlow UI after creating the cluster.
	//
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Pattern=`^[0-9a-fA-F-]{36}$`
	ClusterID string `json:"clusterID"`

	// TokenPath is the filesystem location where kubelet mounts the
	// projected ServiceAccount token. Defaults to
	// `/var/run/secrets/ferrflow/token` — match this in the operator pod's
	// `volumeMounts` + `serviceAccountToken` projection.
	//
	// +optional
	TokenPath string `json:"tokenPath,omitempty"`

	// Audience the projected ServiceAccount token declares in its `aud`
	// claim. Must match `EXPECTED_AUDIENCE` on the FerrFlow side
	// (`https://ferrflow.com`). Defaults to that value when omitted.
	//
	// +optional
	Audience string `json:"audience,omitempty"`
}

type SecretKeyRef struct {
	// Name of the Secret. Must live in the same namespace as the
	// FerrFlowConnection object.
	//
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// Key within the Secret's `data` map.
	//
	// +kubebuilder:validation:Required
	Key string `json:"key"`
}

type SecretSelector struct {
	// Names is an explicit list of secret keys to sync. When empty, every
	// secret in the vault is synced.
	//
	// +optional
	Names []string `json:"names,omitempty"`
}

type SecretTarget struct {
	// Name of the `Secret` to create or update in the same namespace as the
	// CR. Defaults to `metadata.name` of the `FerrFlowSecret` itself when
	// omitted.
	//
	// +optional
	Name string `json:"name,omitempty"`

	// Type of the generated Secret (e.g. `Opaque`, `kubernetes.io/tls`).
	// Defaults to `Opaque`.
	//
	// +optional
	Type string `json:"type,omitempty"`
}

type SecretTransform struct {
	// Type identifies the transform kind.
	//
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=prefix;suffix;rename;base64Decode;jsonExpand
	Type string `json:"type"`

	// Value is the payload for `prefix` and `suffix`.
	//
	// +optional
	Value string `json:"value,omitempty"`

	// From is the source key for `rename`.
	//
	// +optional
	From string `json:"from,omitempty"`

	// To is the destination key for `rename`.
	//
	// +optional
	To string `json:"to,omitempty"`

	// Keys restricts `base64Decode` to a subset of keys. Empty = all keys.
	//
	// +optional
	Keys []string `json:"keys,omitempty"`

	// Key is the source key for `jsonExpand`.
	//
	// +optional
	Key string `json:"key,omitempty"`
}

type WorkloadRef struct {
	// Kind of the workload. One of: Deployment, StatefulSet, DaemonSet.
	//
	// +kubebuilder:validation:Enum=Deployment;StatefulSet;DaemonSet
	Kind string `json:"kind"`

	// Name of the workload within the same namespace as the CR.
	//
	// +kubebuilder:validation:Required
	Name string `json:"name"`
}