api

type AccessPolicy struct {
	meta.TypeMeta   `json:",inline"`
	meta.ObjectMeta `json:"metadata"`

	Spec AccessPolicySpec `json:"spec"`
	// +kubebuilder:validation:Optional
	Status AccessPolicyStatus `json:"status,omitempty"`
}

type AccessPolicyList struct {
	meta.TypeMeta `json:",inline"`
	meta.ListMeta `json:"metadata"`

	Items []AccessPolicy `json:"items"`
}

type AccessPolicyOIDC struct {
	// +kubebuilder:validation:Pattern=`^([a-z-]+/)?[a-z-.]+$`
	Provider          string                            `json:"provider"`
	CredentialsSecret AccessPolicyOIDCCredentialsSecret `json:"credentialsSecretRef"`
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Pattern=`^\/[A-Za-z0-9\-._~!$&'()*+,;=:@\/%]*$|^$`
	CallbackPath string `json:"callbackPath"`
}

type AccessPolicyOIDCCredentialsSecret struct {
	Name string `json:"name"`
	// +kubebuilder:validation:Optional
	ClientIDKey string `json:"clientIDKey"`
	// +kubebuilder:validation:Optional
	ClientSecretKey string `json:"clientSecretKey"`
	// +kubebuilder:validation:Optional
	TokenSecretKey string `json:"tokenSecretKey"`
}

type AccessPolicyRoute struct {
	// +kubebuilder:validation:Optional
	Name string `json:"name,omitempty"`
	// +kubebuilder:validation:Optional
	Roles []string `json:"roles,omitempty"`
	// +kubebuilder:validation:Optional
	Headers []AccessPolicyRouteHeader `json:"headers,omitempty"`
	// +kubebuilder:validation:Optional
	DisableEnforcement bool `json:"disableEnforcement,omitempty"`
}

type AccessPolicyRouteHeader struct {
	Name  string   `json:"name"`
	Roles []string `json:"roles"`
	// +kubebuilder:validation:Optional
	Value string `json:"value,omitempty"`
}

type AccessPolicySpec struct {
	Gateway string           `json:"gateway"`
	OIDC    AccessPolicyOIDC `json:"oidc"`

	// +kubebuilder:validation:Optional
	Routes []AccessPolicyRoute `json:"routes,omitempty"`
}

type AccessPolicyStatus struct {
	// +kubebuilder:validation:Optional
	Ingress AccessPolicyStatusIngress `json:"ingress,omitempty"`
	// +kubebuilder:validation:Optional
	VirtualHosts []string `json:"virtualHosts,omitempty"`
}

type AccessPolicyStatusIngress struct {
	Selector map[string]string `json:"selector"`
}

type OpenIDProvider struct {
	meta.TypeMeta   `json:",inline"`
	meta.ObjectMeta `json:"metadata"`

	Spec OpenIDProviderSpec `json:"spec"`
}

type OpenIDProviderList struct {
	meta.TypeMeta `json:",inline"`
	meta.ListMeta `json:"metadata"`

	Items []OpenIDProvider `json:"items"`
}

type OpenIDProviderRoleMapping struct {
	// +kubebuilder:validation:Optional
	From string `json:"from"`
	// +kubebuilder:validation:Optional
	Prefix string `json:"prefix"`
	Path   string `json:"path"`
}

type OpenIDProviderSpec struct {
	Issuer string `json:"issuer"`
	// +kubebuilder:validation:Optional
	RoleMappings []OpenIDProviderRoleMapping `json:"roleMappings"`
}