trafficpolicy

type CORSPreset struct {
	Origins       []string `json:"origins"`
	Methods       []string `json:"methods,omitempty"`
	Headers       []string `json:"headers,omitempty"`
	ExposeHeaders []string `json:"expose_headers,omitempty"`
	Credentials   bool     `json:"credentials,omitempty"`
	MaxAgeSeconds int      `json:"max_age_seconds,omitempty"`
	// Preflight answers OPTIONS preflight requests at the ingress instead of
	// passing them to the app.
	Preflight bool `json:"preflight"`
}

type Cache struct {
	Enabled        bool        `json:"enabled"`
	Rules          []CacheRule `json:"rules"`
	MaxObjectBytes int64       `json:"max_object_bytes,omitempty"`
}

type CacheRule struct {
	Match Match `json:"match"`
	// TTLSeconds applies when the app sends no max-age or s-maxage, or
	// always when OverrideUpstream is set.
	TTLSeconds       int  `json:"ttl_seconds"`
	OverrideUpstream bool `json:"override_upstream,omitempty"`
	// StaleWhileRevalidateSeconds serves an expired entry while one
	// background request refreshes it.
	StaleWhileRevalidateSeconds int `json:"stale_while_revalidate_seconds,omitempty"`
	// StatusCodes cached; empty means 200 only.
	StatusCodes []int `json:"status_codes,omitempty"`
	// Vary lists request headers that split the cache key.
	Vary []string `json:"vary,omitempty"`
	// CacheWithCookies keeps caching when the request carries a Cookie.
	// Off by default: a cookie usually means a personalised page.
	CacheWithCookies bool `json:"cache_with_cookies,omitempty"`
}

type Context struct {
	// Domain is the host the policy belongs to, lower case.
	Domain string
	// TLSReal is true when browsers see a publicly trusted certificate for
	// Domain (ACME, an uploaded certificate, or TLS terminated upstream).
	TLSReal bool
	// AppExists reports whether a forwarder's target app exists. Nil skips
	// the check.
	AppExists func(name string) bool
}

type EgressGuard struct {
	AllowPrivate  bool
	AllowLoopback bool
}

type FieldError struct {
	Field   string `json:"field"`
	Message string `json:"message"`
}

type Forwarder struct {
	Name           string `json:"name,omitempty"`
	Match          Match  `json:"match"`
	Action         string `json:"action"`
	App            string `json:"app,omitempty"`
	URL            string `json:"url,omitempty"`
	RedirectStatus int    `json:"redirect_status,omitempty"`
	// StripPrefix removes Match.Path before forwarding (prefix rules only).
	StripPrefix bool `json:"strip_prefix,omitempty"`
	// RewritePrefix is prepended to the (possibly stripped) path.
	RewritePrefix string `json:"rewrite_prefix,omitempty"`
	Host          string `json:"host,omitempty"`
	HostValue     string `json:"host_value,omitempty"`
	// WebSocket nil or true passes Upgrade requests through.
	WebSocket      *bool `json:"websocket,omitempty"`
	TimeoutSeconds int   `json:"timeout_seconds,omitempty"`
}

type Forwarders struct {
	Rules []Forwarder `json:"rules"`
}

type Geo struct {
	Mode        string   `json:"mode"`
	Countries   []string `json:"countries"`
	Action      string   `json:"action"`
	RedirectURL string   `json:"redirect_url,omitempty"`
	StatusCode  int      `json:"status_code,omitempty"`
	Body        string   `json:"body,omitempty"`
	// Exempt addresses and ranges are never blocked by country.
	Exempt []string `json:"exempt,omitempty"`
	// Unknown decides requests whose country cannot be determined.
	Unknown string `json:"unknown,omitempty"`
}

type GeoDecision struct {
	Blocked bool
	Reason  string
}

type HeaderRule struct {
	Side  string `json:"side"`
	Op    string `json:"op"`
	Name  string `json:"name"`
	Value string `json:"value,omitempty"`
}

type Headers struct {
	Rules    []HeaderRule    `json:"rules"`
	Security *SecurityPreset `json:"security,omitempty"`
	CORS     *CORSPreset     `json:"cors,omitempty"`
	// HideServer removes Server and X-Powered-By from every response.
	HideServer bool `json:"hide_server,omitempty"`
	// ForwardedPrefix sets X-Forwarded-Prefix on requests, the only
	// X-Forwarded-* header an operator may set.
	ForwardedPrefix string `json:"forwarded_prefix,omitempty"`
}

type Hop struct {
	URL      string `json:"url"`
	Status   int    `json:"status"`
	Location string `json:"location,omitempty"`
	Note     string `json:"note"`
}

type HopEnv struct {
	// Hosts routed by this instance, lower case.
	Hosts map[string]bool
	// Redirects maps a host to its normalisation settings.
	Redirects map[string]Redirects
	// HostRedirects maps a host to its whole-host redirect.
	HostRedirects map[string]HostRedirect
	// Maintenance hosts answer 503 before any redirect.
	Maintenance map[string]bool
	// AutoHTTPS is true when the ingress itself redirects every http
	// request to https (the HTTP listener is bound and TLS ends here).
	AutoHTTPS bool
	// Terminated is true when a proxy in front terminates TLS; force HTTPS
	// then trusts its X-Forwarded-Proto.
	Terminated bool
	// HTTPSPort is the public HTTPS port; 0 or 443 is omitted from URLs.
	HTTPSPort int
}

type HostRedirect struct {
	TargetURL  string `json:"target_url"`
	StatusCode int    `json:"status_code"`
}

type Limits struct {
	MaxHeaderRules     int
	MaxForwarders      int
	MaxCacheRules      int
	MaxRegexLen        int
	MaxHeaderValueLen  int
	MaxListEntries     int
	MaxExemptEntries   int
	MaxBodyBytes       int
	ForwardTimeout     time.Duration
	ForwardMaxTimeout  time.Duration
	ForwardDialTimeout time.Duration
	CacheMaxObject     int64
	CacheMaxTTL        time.Duration
}

type Match struct {
	Kind    string   `json:"kind"`
	Path    string   `json:"path"`
	Methods []string `json:"methods,omitempty"`
}

type Policy struct {
	Headers    *Headers    `json:"headers,omitempty"`
	Forwarders *Forwarders `json:"forwarders,omitempty"`
	Geo        *Geo        `json:"geo,omitempty"`
	Cache      *Cache      `json:"cache,omitempty"`
	Redirects  *Redirects  `json:"redirects,omitempty"`
}

type Redirects struct {
	ForceHTTPS bool `json:"force_https"`
	// ForceHTTPSStatus is 308 (default, keeps the method) or 301.
	ForceHTTPSStatus int    `json:"force_https_status,omitempty"`
	TrailingSlash    string `json:"trailing_slash,omitempty"`
	LowercaseHost    bool   `json:"lowercase_host,omitempty"`
}

type ResolvedTarget struct {
	Scheme     string
	Host       string
	Port       string
	Addr       netip.Addr
	BasePath   string
	ServerName string
}

type Resolver interface {
	LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error)
}

type SecurityPreset struct {
	// HSTS needs a publicly trusted certificate; validation refuses it otherwise.
	HSTS                  bool   `json:"hsts"`
	HSTSMaxAge            int    `json:"hsts_max_age,omitempty"`
	HSTSIncludeSubdomains bool   `json:"hsts_include_subdomains,omitempty"`
	ContentTypeOptions    bool   `json:"content_type_options"`
	FrameOptions          string `json:"frame_options,omitempty"`
	ReferrerPolicy        string `json:"referrer_policy,omitempty"`
	PermissionsPolicy     string `json:"permissions_policy,omitempty"`
}

type Step struct {
	Stage   string `json:"stage"`
	Outcome string `json:"outcome"`
	Final   bool   `json:"final,omitempty"`
}

type ValidationError struct {
	Kind   string       `json:"kind"`
	Fields []FieldError `json:"fields"`
}