v1alpha1

type CloudflareAccountIdentifier struct {
	// ID is the Cloudflare Account ID.
	// If both ID and Name are provided, ID takes precedence.
	// +kubebuilder:validation:Optional
	ID string `json:"id,omitempty"`

	// Name is the Cloudflare Account Name.
	// Used as a fallback if ID is not provided.
	// +kubebuilder:validation:Optional
	Name string `json:"name,omitempty"`
}

type CloudflareAccountRef struct {
	// Credentials for accessing the Cloudflare API.
	// +kubebuilder:validation:Required
	Credentials CloudflareCredentials `json:"credentials"`

	// AccountID is the Cloudflare Account ID.
	// If both AccountID and AccountName are provided, AccountID takes precedence.
	// +kubebuilder:validation:Optional
	AccountID string `json:"accountId,omitempty"`

	// AccountName is the Cloudflare Account Name.
	// Used as a fallback if AccountID is not provided.
	// +kubebuilder:validation:Optional
	AccountName string `json:"accountName,omitempty"`
}

type CloudflareCredentials struct {
	// SecretRef references a Secret containing API credentials.
	// The Secret should contain either:
	// - CLOUDFLARE_API_TOKEN: An API Token with appropriate permissions
	// - CLOUDFLARE_API_KEY and CLOUDFLARE_API_EMAIL: Global API Key and email
	// +kubebuilder:validation:Required
	SecretRef SecretRef `json:"secretRef"`

	// APITokenKey is the key in the Secret containing the API Token.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=CLOUDFLARE_API_TOKEN
	APITokenKey string `json:"apiTokenKey,omitempty"`

	// APIKeyKey is the key in the Secret containing the API Key.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=CLOUDFLARE_API_KEY
	APIKeyKey string `json:"apiKeyKey,omitempty"`

	// APIEmailKey is the key in the Secret containing the account email (for API Key auth).
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=CLOUDFLARE_API_EMAIL
	APIEmailKey string `json:"apiEmailKey,omitempty"`
}

type CloudflareRef struct {
	// Credentials for accessing the Cloudflare API.
	// +kubebuilder:validation:Required
	Credentials CloudflareCredentials `json:"credentials"`

	// Account references the Cloudflare account.
	// +kubebuilder:validation:Required
	Account CloudflareAccountIdentifier `json:"account"`

	// Zone references the Cloudflare zone (optional, only for zone-scoped resources).
	// +kubebuilder:validation:Optional
	Zone *CloudflareZoneIdentifier `json:"zone,omitempty"`
}

type CloudflareZoneIdentifier struct {
	// ID is the Cloudflare Zone ID.
	// If both ID and Name are provided, ID takes precedence.
	// +kubebuilder:validation:Optional
	ID string `json:"id,omitempty"`

	// Name is the Cloudflare Zone domain name.
	// Used as a fallback if ID is not provided.
	// +kubebuilder:validation:Optional
	Name string `json:"name,omitempty"`
}

type CloudflareZoneRef struct {
	// ZoneID is the Cloudflare Zone ID.
	// If both ZoneID and Domain are provided, ZoneID takes precedence.
	// +kubebuilder:validation:Optional
	ZoneID string `json:"zoneId,omitempty"`

	// Domain is the Cloudflare Zone domain name.
	// Used as a fallback if ZoneID is not provided.
	// +kubebuilder:validation:Optional
	Domain string `json:"domain,omitempty"`
}

type CommonStatus struct {
	// ObservedGeneration is the most recent generation observed by the controller.
	// +kubebuilder:validation:Optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions represent the latest available observations of the resource's state.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// LastReconcileTime is the last time the resource was reconciled.
	// +kubebuilder:validation:Optional
	LastReconcileTime *metav1.Time `json:"lastReconcileTime,omitempty"`
}

type ExistingTunnelRef struct {
	// ID is the Cloudflare Tunnel ID.
	// If both ID and Name are provided, ID takes precedence.
	// +kubebuilder:validation:Optional
	ID string `json:"id,omitempty"`

	// Name is the Cloudflare Tunnel name.
	// Used as a fallback if ID is not provided.
	// +kubebuilder:validation:Optional
	Name string `json:"name,omitempty"`
}

type FallbackDomainEntry struct {
	// Suffix is the domain suffix (e.g., "internal.company.com").
	// +kubebuilder:validation:Required
	Suffix string `json:"suffix"`

	// DNSServer is the DNS server to use for this domain.
	// +kubebuilder:validation:Optional
	DNSServer []string `json:"dnsServer,omitempty"`

	// Description for the entry.
	// +kubebuilder:validation:Optional
	Description string `json:"description,omitempty"`
}

type NewTunnelSpec struct {
	// Name for the new tunnel.
	// +kubebuilder:validation:Required
	Name string `json:"name"`
}

type SecretKeyRef struct {
	// Name of the Secret.
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// Key within the Secret.
	// +kubebuilder:validation:Required
	Key string `json:"key"`

	// Namespace of the Secret. If empty, defaults to the namespace of the resource.
	// +kubebuilder:validation:Optional
	Namespace string `json:"namespace,omitempty"`
}

type SecretRef struct {
	// Name of the Secret.
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// Namespace of the Secret. If empty, defaults to the namespace of the resource.
	// +kubebuilder:validation:Optional
	Namespace string `json:"namespace,omitempty"`
}

type ServiceReference struct {
	// Name of the Service.
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// Namespace of the Service. If empty, defaults to the namespace of the referencing resource.
	// +kubebuilder:validation:Optional
	Namespace string `json:"namespace,omitempty"`

	// Port of the Service to use.
	// +kubebuilder:validation:Optional
	Port *int32 `json:"port,omitempty"`
}

type SplitTunnelEntry struct {
	// Address is the IP address or CIDR range.
	// +kubebuilder:validation:Optional
	Address string `json:"address,omitempty"`

	// Host is the hostname or domain.
	// +kubebuilder:validation:Optional
	Host string `json:"host,omitempty"`

	// Description for the entry.
	// +kubebuilder:validation:Optional
	Description string `json:"description,omitempty"`
}

type TunnelReference struct {
	// Kind of the tunnel resource (Tunnel or ClusterTunnel).
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=Tunnel;ClusterTunnel
	// +kubebuilder:default=ClusterTunnel
	Kind string `json:"kind"`

	// Name of the Tunnel or ClusterTunnel resource.
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// Namespace of the Tunnel resource. Only applicable when Kind is Tunnel.
	// If empty, defaults to the namespace of the referencing resource.
	// +kubebuilder:validation:Optional
	Namespace string `json:"namespace,omitempty"`
}

type TunnelSource struct {
	// ExistingTunnel references an existing tunnel by ID or name.
	// Mutually exclusive with NewTunnel.
	// +kubebuilder:validation:Optional
	ExistingTunnel *ExistingTunnelRef `json:"existingTunnel,omitempty"`

	// NewTunnel creates a new tunnel with the given name.
	// Mutually exclusive with ExistingTunnel.
	// +kubebuilder:validation:Optional
	NewTunnel *NewTunnelSpec `json:"newTunnel,omitempty"`

	// CredentialSecretRef references a Secret containing tunnel credentials.
	// Required for ExistingTunnel, optional for NewTunnel (will be created).
	// +kubebuilder:validation:Optional
	CredentialSecretRef *SecretKeyRef `json:"credentialSecretRef,omitempty"`
}

type VirtualNetworkReference struct {
	// Name of the VirtualNetwork resource.
	// +kubebuilder:validation:Required
	Name string `json:"name"`
}

type WARPRoutingConfig struct {
	// Enabled enables or disables WARP routing for the tunnel.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=false
	Enabled bool `json:"enabled,omitempty"`
}