api

type Authorizer interface {
	// Authorize returns nil if the subject is permitted, or an error with a
	// human-readable message explaining the denial otherwise. The error is
	// surfaced as the 403 body; callers must not include sensitive data.
	Authorize(subjectCN string) error
}

type FilterPolicyHandler struct {
	// Client is used to read and mutate FilterPolicy objects. All write
	// verbs go through this interface so tests can drive them with a fake
	// client.
	Client client.Client
}

type Readiness interface {
	// Ready returns nil if the component is ready to serve traffic, and a
	// non-nil error describing why it is not otherwise.
	Ready(ctx context.Context) error
}

type Server struct {
	// Client is a read-capable Kubernetes client. The handlers only use
	// List/Get so the implementation may be a cached controller-runtime
	// client or a direct one; the choice is a concern of the caller.
	Client client.Client

	// Config is the validated configuration used to construct the server.
	Config ServerConfig

	// Readiness, if set, is consulted by readyz_handler. If nil the
	// /readyz endpoint reports ready immediately.
	Readiness Readiness

	// Authorizer extracts client identity from the TLS connection and
	// consults the allowlist. It is pluggable so tests can inject a fake.
	Authorizer Authorizer
}

type ServerConfig struct {
	// Address is the TCP listen address (host:port). If empty,
	// DefaultListenAddress is used.
	Address string

	// CertDir is the directory holding tls.crt / tls.key / ca.crt as
	// written by cert-manager. When set it takes precedence over the
	// per-file ServerCertFile/ServerKeyFile/ClientCAFile fields and the
	// server picks up rotation via certificates.WatchAndReload. This is
	// the Sprint 31 / Ticket 49 path; the per-file fields remain for
	// backward-compatibility with overlays that point at custom paths.
	CertDir string

	// ServerCertFile is the path to the PEM-encoded server certificate.
	// cert-manager typically mounts it as tls.crt inside a Secret.
	// Ignored when CertDir is set.
	ServerCertFile string

	// ServerKeyFile is the path to the PEM-encoded server private key.
	// cert-manager typically mounts it as tls.key inside a Secret.
	// Ignored when CertDir is set.
	ServerKeyFile string

	// ClientCAFile is the path to the PEM-encoded CA bundle used to verify
	// client certificates. The bundle identifies the trust anchor for
	// accepted callers; every client presenting a cert chain rooted in this
	// bundle is authenticated at the TLS layer. Authorization still requires
	// the subject to appear in Allowlist. Ignored when CertDir is set —
	// in that case ca.crt under CertDir is used as the client CA bundle.
	ClientCAFile string

	// Allowlist is the set of client-cert Subject Common Names authorized to
	// call the API. A caller whose cert chains to ClientCAFile but whose CN
	// is not in this set receives a 403.
	Allowlist []string

	// ReadTimeout bounds request reads. Zero means DefaultReadTimeout.
	ReadTimeout time.Duration

	// WriteTimeout bounds response writes. Zero means DefaultWriteTimeout.
	WriteTimeout time.Duration
}

type StaticAllowlist struct {
	// contains filtered or unexported fields
}