v1alpha2

type AccessApplication struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AccessApplicationSpec   `json:"spec,omitempty"`
	Status AccessApplicationStatus `json:"status,omitempty"`
}

type AccessApplicationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AccessApplication `json:"items"`
}

type AccessApplicationSpec struct {
	// Name of the Access Application in Cloudflare.
	// If not specified, the Kubernetes resource name will be used.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=255
	Name string `json:"name,omitempty"`

	// Domain is the primary domain/URL for the application.
	// +kubebuilder:validation:Required
	Domain string `json:"domain"`

	// Type is the application type.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=self_hosted;saas;ssh;vnc;app_launcher;warp;biso;bookmark;dash_sso
	// +kubebuilder:default=self_hosted
	Type string `json:"type"`

	// SessionDuration is the amount of time that the token is valid for.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default="24h"
	SessionDuration string `json:"sessionDuration,omitempty"`

	// AllowedIdps is the list of identity provider IDs allowed for this application.
	// +kubebuilder:validation:Optional
	AllowedIdps []string `json:"allowedIdps,omitempty"`

	// AllowedIdpRefs references AccessIdentityProvider resources by name.
	// +kubebuilder:validation:Optional
	AllowedIdpRefs []AccessIdentityProviderRef `json:"allowedIdpRefs,omitempty"`

	// AutoRedirectToIdentity enables automatic redirect to the identity provider.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=false
	AutoRedirectToIdentity bool `json:"autoRedirectToIdentity,omitempty"`

	// EnableBindingCookie enables the binding cookie.
	// +kubebuilder:validation:Optional
	EnableBindingCookie *bool `json:"enableBindingCookie,omitempty"`

	// HttpOnlyCookieAttribute sets the HttpOnly attribute on the cookie.
	// +kubebuilder:validation:Optional
	HttpOnlyCookieAttribute *bool `json:"httpOnlyCookieAttribute,omitempty"`

	// SameSiteCookieAttribute sets the SameSite attribute on the cookie.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=strict;lax;none
	SameSiteCookieAttribute string `json:"sameSiteCookieAttribute,omitempty"`

	// LogoURL is the URL of the application logo.
	// +kubebuilder:validation:Optional
	LogoURL string `json:"logoUrl,omitempty"`

	// SkipInterstitial skips the interstitial page.
	// +kubebuilder:validation:Optional
	SkipInterstitial *bool `json:"skipInterstitial,omitempty"`

	// AppLauncherVisible shows the application in the App Launcher.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=true
	AppLauncherVisible *bool `json:"appLauncherVisible,omitempty"`

	// ServiceAuth401Redirect redirects unauthorized service auth requests.
	// +kubebuilder:validation:Optional
	ServiceAuth401Redirect *bool `json:"serviceAuth401Redirect,omitempty"`

	// CustomDenyMessage is a custom message shown when access is denied.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=1024
	CustomDenyMessage string `json:"customDenyMessage,omitempty"`

	// CustomDenyURL is a custom URL to redirect to when access is denied.
	// +kubebuilder:validation:Optional
	CustomDenyURL string `json:"customDenyUrl,omitempty"`

	// AllowAuthenticateViaWarp allows authentication via WARP.
	// +kubebuilder:validation:Optional
	AllowAuthenticateViaWarp *bool `json:"allowAuthenticateViaWarp,omitempty"`

	// Tags are custom tags for the application.
	// +kubebuilder:validation:Optional
	Tags []string `json:"tags,omitempty"`

	// Policies defines the access policies for this application.
	// +kubebuilder:validation:Optional
	Policies []AccessPolicyRef `json:"policies,omitempty"`

	// Cloudflare contains the Cloudflare API credentials and account information.
	// +kubebuilder:validation:Required
	Cloudflare CloudflareDetails `json:"cloudflare"`
}

type AccessApplicationStatus struct {
	// ApplicationID is the Cloudflare ID of the Access Application.
	// +kubebuilder:validation:Optional
	ApplicationID string `json:"applicationId,omitempty"`

	// AUD is the Application Audience (AUD) Tag.
	// +kubebuilder:validation:Optional
	AUD string `json:"aud,omitempty"`

	// AccountID is the Cloudflare Account ID.
	// +kubebuilder:validation:Optional
	AccountID string `json:"accountId,omitempty"`

	// Domain is the configured domain.
	// +kubebuilder:validation:Optional
	Domain string `json:"domain,omitempty"`

	// State indicates the current state of the application.
	// +kubebuilder:validation:Optional
	State string `json:"state,omitempty"`

	// ResolvedPolicies contains the resolved policy information for each policy.
	// This helps with debugging and understanding policy state.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=precedence
	ResolvedPolicies []ResolvedPolicyStatus `json:"resolvedPolicies,omitempty"`

	// Conditions represent the latest available observations.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed.
	// +kubebuilder:validation:Optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type AccessGroup struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AccessGroupSpec   `json:"spec,omitempty"`
	Status AccessGroupStatus `json:"status,omitempty"`
}

type AccessGroupAzureRule struct {
	ID                 string `json:"id"`
	IdentityProviderID string `json:"identityProviderId"`
}

type AccessGroupCommonNameRule struct {
	CommonName string `json:"commonName"`
}

type AccessGroupCountryRule struct {
	Country []string `json:"country"`
}

type AccessGroupDevicePostureRule struct {
	IntegrationUID string `json:"integrationUid"`
}

type AccessGroupEmailDomainRule struct {
	Domain string `json:"domain"`
}

type AccessGroupEmailRule struct {
	Email string `json:"email"`
}

type AccessGroupExternalEvaluationRule struct {
	EvaluateURL string `json:"evaluateUrl"`
	KeysURL     string `json:"keysUrl"`
}

type AccessGroupGSuiteRule struct {
	Email              string `json:"email"`
	IdentityProviderID string `json:"identityProviderId"`
}

type AccessGroupGitHubRule struct {
	Name               string   `json:"name"`
	IdentityProviderID string   `json:"identityProviderId"`
	Teams              []string `json:"teams,omitempty"`
}

type AccessGroupGroupRule struct {
	ID string `json:"id"`
}

type AccessGroupIPRangesRule struct {
	IP []string `json:"ip"`
}

type AccessGroupList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AccessGroup `json:"items"`
}

type AccessGroupOIDCRule struct {
	ClaimName          string `json:"claimName"`
	ClaimValue         string `json:"claimValue"`
	IdentityProviderID string `json:"identityProviderId"`
}

type AccessGroupRule struct {
	// Email matches a specific email address.
	// +kubebuilder:validation:Optional
	Email *AccessGroupEmailRule `json:"email,omitempty"`

	// EmailDomain matches all emails from a domain.
	// +kubebuilder:validation:Optional
	EmailDomain *AccessGroupEmailDomainRule `json:"emailDomain,omitempty"`

	// Everyone matches all users.
	// +kubebuilder:validation:Optional
	Everyone bool `json:"everyone,omitempty"`

	// IPRanges matches users from specific IP ranges.
	// +kubebuilder:validation:Optional
	IPRanges *AccessGroupIPRangesRule `json:"ipRanges,omitempty"`

	// Country matches users from specific countries.
	// +kubebuilder:validation:Optional
	Country *AccessGroupCountryRule `json:"country,omitempty"`

	// Group matches users in a specific IdP group.
	// +kubebuilder:validation:Optional
	Group *AccessGroupGroupRule `json:"group,omitempty"`

	// ServiceToken matches requests with a specific service token.
	// +kubebuilder:validation:Optional
	ServiceToken *AccessGroupServiceTokenRule `json:"serviceToken,omitempty"`

	// AnyValidServiceToken matches any valid service token.
	// +kubebuilder:validation:Optional
	AnyValidServiceToken bool `json:"anyValidServiceToken,omitempty"`

	// Certificate matches requests with a valid mTLS certificate.
	// +kubebuilder:validation:Optional
	Certificate bool `json:"certificate,omitempty"`

	// CommonName matches mTLS certificates with a specific common name.
	// +kubebuilder:validation:Optional
	CommonName *AccessGroupCommonNameRule `json:"commonName,omitempty"`

	// DevicePosture matches devices that pass posture checks.
	// +kubebuilder:validation:Optional
	DevicePosture *AccessGroupDevicePostureRule `json:"devicePosture,omitempty"`

	// GSUITE matches users from Google Workspace.
	// +kubebuilder:validation:Optional
	GSuite *AccessGroupGSuiteRule `json:"gsuite,omitempty"`

	// GitHub matches users from GitHub organizations.
	// +kubebuilder:validation:Optional
	GitHub *AccessGroupGitHubRule `json:"github,omitempty"`

	// Azure matches users from Azure AD groups.
	// +kubebuilder:validation:Optional
	Azure *AccessGroupAzureRule `json:"azure,omitempty"`

	// OIDC matches users based on OIDC claims.
	// +kubebuilder:validation:Optional
	OIDC *AccessGroupOIDCRule `json:"oidc,omitempty"`

	// SAML matches users based on SAML attributes.
	// +kubebuilder:validation:Optional
	SAML *AccessGroupSAMLRule `json:"saml,omitempty"`

	// ExternalEvaluation calls an external endpoint for evaluation.
	// +kubebuilder:validation:Optional
	ExternalEvaluation *AccessGroupExternalEvaluationRule `json:"externalEvaluation,omitempty"`
}

type AccessGroupSAMLRule struct {
	AttributeName      string `json:"attributeName"`
	AttributeValue     string `json:"attributeValue"`
	IdentityProviderID string `json:"identityProviderId"`
}

type AccessGroupServiceTokenRule struct {
	TokenID string `json:"tokenId"`
}

type AccessGroupSpec struct {
	// Name of the Access Group in Cloudflare.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=255
	Name string `json:"name,omitempty"`

	// Include defines rules that users must match to be included.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinItems=1
	Include []AccessGroupRule `json:"include"`

	// Exclude defines rules that exclude users even if they match include rules.
	// +kubebuilder:validation:Optional
	Exclude []AccessGroupRule `json:"exclude,omitempty"`

	// Require defines rules that all users must match in addition to include rules.
	// +kubebuilder:validation:Optional
	Require []AccessGroupRule `json:"require,omitempty"`

	// Cloudflare contains the Cloudflare API credentials.
	// +kubebuilder:validation:Required
	Cloudflare CloudflareDetails `json:"cloudflare"`
}

type AccessGroupStatus struct {
	// GroupID is the Cloudflare ID of the Access Group.
	// +kubebuilder:validation:Optional
	GroupID string `json:"groupId,omitempty"`

	// AccountID is the Cloudflare Account ID.
	// +kubebuilder:validation:Optional
	AccountID string `json:"accountId,omitempty"`

	// State indicates the current state.
	// +kubebuilder:validation:Optional
	State string `json:"state,omitempty"`

	// Conditions represent the latest available observations.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed.
	// +kubebuilder:validation:Optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type AccessIdentityProvider struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AccessIdentityProviderSpec   `json:"spec,omitempty"`
	Status AccessIdentityProviderStatus `json:"status,omitempty"`
}

type AccessIdentityProviderList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AccessIdentityProvider `json:"items"`
}

type AccessIdentityProviderRef struct {
	// Name is the name of the AccessIdentityProvider resource.
	// +kubebuilder:validation:Required
	Name string `json:"name"`
}

type AccessIdentityProviderSpec struct {
	// Name of the Identity Provider in Cloudflare.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=255
	Name string `json:"name,omitempty"`

	// Type is the identity provider type.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=onetimepin;azureAD;saml;centrify;facebook;github;google-apps;google;linkedin;oidc;okta;onelogin;pingone;yandex
	Type string `json:"type"`

	// Config contains provider-specific configuration.
	// +kubebuilder:validation:Optional
	Config *IdentityProviderConfig `json:"config,omitempty"`

	// ConfigSecretRef references a Secret containing sensitive config values.
	// +kubebuilder:validation:Optional
	ConfigSecretRef *SecretKeySelector `json:"configSecretRef,omitempty"`

	// Cloudflare contains the Cloudflare API credentials.
	// +kubebuilder:validation:Required
	Cloudflare CloudflareDetails `json:"cloudflare"`
}

type AccessIdentityProviderStatus struct {
	// ProviderID is the Cloudflare ID.
	// +kubebuilder:validation:Optional
	ProviderID string `json:"providerId,omitempty"`

	// AccountID is the Cloudflare Account ID.
	// +kubebuilder:validation:Optional
	AccountID string `json:"accountId,omitempty"`

	// State indicates the current state.
	// +kubebuilder:validation:Optional
	State string `json:"state,omitempty"`

	// Conditions represent the latest available observations.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed.
	// +kubebuilder:validation:Optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type AccessPolicyRef struct {
	// Name is the name of an AccessGroup resource (Kubernetes) to use as a policy.
	// If specified, the controller will look up the AccessGroup CR and use its GroupID.
	// Mutually exclusive with groupId and cloudflareGroupName.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=253
	Name string `json:"name,omitempty"`

	// GroupID is the UUID of an existing Cloudflare Access Group.
	// Use this to directly reference a Cloudflare-managed Access Group
	// without creating a corresponding Kubernetes AccessGroup resource.
	// Mutually exclusive with name and cloudflareGroupName.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Pattern=`^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$`
	GroupID string `json:"groupId,omitempty"`

	// CloudflareGroupName is the display name of an existing Cloudflare Access Group.
	// The controller will resolve this name to a GroupID via the Cloudflare API.
	// Use this when you want to reference a Cloudflare Access Group by name
	// (e.g., groups created via Terraform or the Cloudflare dashboard).
	// Mutually exclusive with name and groupId.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=255
	CloudflareGroupName string `json:"cloudflareGroupName,omitempty"`

	// Decision is the policy decision (allow, deny, bypass, non_identity).
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=allow;deny;bypass;non_identity
	// +kubebuilder:default=allow
	Decision string `json:"decision,omitempty"`

	// Precedence is the order of evaluation. Lower numbers are evaluated first.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Minimum=1
	Precedence int `json:"precedence,omitempty"`

	// PolicyName is the name for this policy in Cloudflare.
	// If not specified, a name will be auto-generated based on the AccessApplication name and precedence.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=255
	PolicyName string `json:"policyName,omitempty"`

	// SessionDuration overrides the application's session duration for this policy.
	// +kubebuilder:validation:Optional
	SessionDuration string `json:"sessionDuration,omitempty"`
}

type AccessServiceToken struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AccessServiceTokenSpec   `json:"spec,omitempty"`
	Status AccessServiceTokenStatus `json:"status,omitempty"`
}

type AccessServiceTokenList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AccessServiceToken `json:"items"`
}

type AccessServiceTokenSpec struct {
	// Name of the Service Token in Cloudflare.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=255
	Name string `json:"name,omitempty"`

	// Duration is the validity duration (e.g., "8760h" for 1 year, "forever").
	// +kubebuilder:validation:Optional
	// +kubebuilder:default="8760h"
	Duration string `json:"duration,omitempty"`

	// SecretRef is where to store the generated token credentials.
	// +kubebuilder:validation:Required
	SecretRef ServiceTokenSecretRef `json:"secretRef"`

	// Cloudflare contains the Cloudflare API credentials.
	// +kubebuilder:validation:Required
	Cloudflare CloudflareDetails `json:"cloudflare"`
}

type AccessServiceTokenStatus struct {
	// TokenID is the Cloudflare Service Token ID.
	// +kubebuilder:validation:Optional
	TokenID string `json:"tokenId,omitempty"`

	// ClientID is the Service Token Client ID.
	// +kubebuilder:validation:Optional
	ClientID string `json:"clientId,omitempty"`

	// AccountID is the Cloudflare Account ID.
	// +kubebuilder:validation:Optional
	AccountID string `json:"accountId,omitempty"`

	// ExpiresAt is when the token expires.
	// +kubebuilder:validation:Optional
	ExpiresAt string `json:"expiresAt,omitempty"`

	// SecretName is the name of the Secret containing credentials.
	// +kubebuilder:validation:Optional
	SecretName string `json:"secretName,omitempty"`

	// State indicates the current state.
	// +kubebuilder:validation:Optional
	State string `json:"state,omitempty"`

	// Conditions represent the latest available observations.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed.
	// +kubebuilder:validation:Optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type ActivityLogSettings struct {
	Enabled bool `json:"enabled"`
}

type AntiVirusSettings struct {
	Enabled              bool                  `json:"enabled"`
	EnabledDownloadPhase bool                  `json:"enabledDownloadPhase,omitempty"`
	EnabledUploadPhase   bool                  `json:"enabledUploadPhase,omitempty"`
	FailClosed           bool                  `json:"failClosed,omitempty"`
	NotificationSettings *NotificationSettings `json:"notificationSettings,omitempty"`
}

type AuditSSHSettings struct {
	CommandLogging bool `json:"commandLogging"`
}

type AuthenticatedOriginPullConfig struct {
	// Enabled enables authenticated origin pulls (mTLS)
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=false
	Enabled bool `json:"enabled,omitempty"`

	// CertificateSecretRef references a Secret containing custom client certificate
	// If not specified, Cloudflare's default certificate will be used
	// +kubebuilder:validation:Optional
	CertificateSecretRef *SecretReference `json:"certificateSecretRef,omitempty"`
}

type AutoPopulateConfig struct {
	// Enabled enables automatic population from NetworkRoute resources.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=false
	Enabled bool `json:"enabled,omitempty"`

	// LabelSelector selects which NetworkRoute resources to include.
	// If empty, all NetworkRoute resources are included.
	// +kubebuilder:validation:Optional
	LabelSelector *metav1.LabelSelector `json:"labelSelector,omitempty"`

	// DescriptionPrefix is prepended to auto-generated descriptions.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default="Auto-populated from NetworkRoute: "
	DescriptionPrefix string `json:"descriptionPrefix,omitempty"`
}

type BISOAdminControls struct {
	DisablePrinting             *bool `json:"disablePrinting,omitempty"`
	DisableCopyPaste            *bool `json:"disableCopyPaste,omitempty"`
	DisableDownload             *bool `json:"disableDownload,omitempty"`
	DisableUpload               *bool `json:"disableUpload,omitempty"`
	DisableKeyboard             *bool `json:"disableKeyboard,omitempty"`
	DisableClipboardRedirection *bool `json:"disableClipboardRedirection,omitempty"`
}

type BlockPageSettings struct {
	Enabled         bool   `json:"enabled"`
	Name            string `json:"name,omitempty"`
	FooterText      string `json:"footerText,omitempty"`
	HeaderText      string `json:"headerText,omitempty"`
	LogoPath        string `json:"logoPath,omitempty"`
	BackgroundColor string `json:"backgroundColor,omitempty"`
	MailtoAddress   string `json:"mailtoAddress,omitempty"`
	MailtoSubject   string `json:"mailtoSubject,omitempty"`
	SuppressFooter  bool   `json:"suppressFooter,omitempty"`
}

type BodyScanningSettings struct {
	InspectionMode string `json:"inspectionMode,omitempty"` // deep, shallow
}

type BrowserIsolationSettings struct {
	URLBrowserIsolationEnabled bool `json:"urlBrowserIsolationEnabled,omitempty"`
	NonIdentityEnabled         bool `json:"nonIdentityEnabled,omitempty"`
}

type CacheConfig struct {
	// BrowserTTL sets the browser cache TTL in seconds
	// Minimum: 0 (respect origin), Maximum: 31536000 (1 year)
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=31536000
	BrowserTTL *int `json:"browserTTL,omitempty"`

	// DevelopmentMode temporarily bypasses cache for development
	// Automatically disables after 3 hours
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=false
	DevelopmentMode bool `json:"developmentMode,omitempty"`

	// CacheLevel sets the cache level
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=aggressive
	CacheLevel CacheLevel `json:"cacheLevel,omitempty"`

	// TieredCache configures tiered caching
	// +kubebuilder:validation:Optional
	TieredCache *TieredCacheConfig `json:"tieredCache,omitempty"`

	// CacheReserve configures persistent cache storage
	// +kubebuilder:validation:Optional
	CacheReserve *CacheReserveConfig `json:"cacheReserve,omitempty"`

	// AlwaysOnline serves stale content when origin is unavailable
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=true
	AlwaysOnline *bool `json:"alwaysOnline,omitempty"`

	// CacheByDeviceType caches content separately for mobile/desktop
	// Requires Enterprise plan
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=false
	CacheByDeviceType bool `json:"cacheByDeviceType,omitempty"`

	// SortQueryStringForCache treats query strings with same parameters
	// but different order as the same for caching purposes
	// Requires Enterprise plan
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=false
	SortQueryStringForCache bool `json:"sortQueryStringForCache,omitempty"`
}

type CacheLevel string

type CacheReserveConfig struct {
	// Enabled enables Cache Reserve
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=false
	Enabled bool `json:"enabled,omitempty"`
}

type CertificateRequestType string

type CertificateValidity int

type CloudflareAuthType string

type CloudflareCredentials struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   CloudflareCredentialsSpec   `json:"spec,omitempty"`
	Status CloudflareCredentialsStatus `json:"status,omitempty"`
}

type CloudflareCredentialsList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []CloudflareCredentials `json:"items"`
}

type CloudflareCredentialsRef struct {
	// Name of the CloudflareCredentials resource to use
	// +kubebuilder:validation:Required
	Name string `json:"name"`
}

type CloudflareCredentialsSpec struct {
	// AccountID is the Cloudflare Account ID
	// +kubebuilder:validation:Required
	AccountID string `json:"accountId"`

	// AccountName is an optional human-readable account name (for reference only)
	// +kubebuilder:validation:Optional
	AccountName string `json:"accountName,omitempty"`

	// AuthType specifies the authentication method
	// +kubebuilder:validation:Required
	// +kubebuilder:default:="apiToken"
	AuthType CloudflareAuthType `json:"authType"`

	// SecretRef references the secret containing the API credentials
	// +kubebuilder:validation:Required
	SecretRef SecretReference `json:"secretRef"`

	// DefaultDomain is the default domain for resources using these credentials
	// +kubebuilder:validation:Optional
	DefaultDomain string `json:"defaultDomain,omitempty"`

	// IsDefault marks this as the default credentials for resources that don't specify credentials
	// Only one CloudflareCredentials can be marked as default
	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=false
	IsDefault bool `json:"isDefault,omitempty"`
}

type CloudflareCredentialsStatus struct {
	// Conditions represent the latest available observations
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// State represents the current state of the credentials
	// +optional
	State string `json:"state,omitempty"`

	// Validated indicates whether the credentials have been validated
	// +optional
	Validated bool `json:"validated,omitempty"`

	// LastValidatedTime is the last time credentials were validated
	// +optional
	LastValidatedTime *metav1.Time `json:"lastValidatedTime,omitempty"`

	// AccountName is the account name retrieved from Cloudflare API
	// +optional
	AccountName string `json:"accountName,omitempty"`
}

type CloudflareDetails struct {
	// +kubebuilder:validation:Optional
	// CredentialsRef references a CloudflareCredentials resource for API authentication.
	// When specified, this takes precedence over inline credential fields.
	// This is the recommended way to configure credentials.
	CredentialsRef *CloudflareCredentialsRef `json:"credentialsRef,omitempty"`

	// +kubebuilder:validation:Optional
	// Cloudflare Domain to which this tunnel belongs to.
	// Required if not using credentialsRef with a defaultDomain.
	Domain string `json:"domain,omitempty"`

	// +kubebuilder:validation:Optional
	// ZoneId is the Cloudflare Zone ID for DNS operations.
	// If not specified, it will be looked up via CloudflareDomain or the domain field.
	// Specifying this directly is useful for multi-zone scenarios.
	ZoneId string `json:"zoneId,omitempty"`

	// +kubebuilder:validation:Optional
	// Secret containing Cloudflare API key/token (legacy, use credentialsRef instead)
	Secret string `json:"secret,omitempty"`

	// +kubebuilder:validation:Optional
	// Account Name in Cloudflare. AccountName and AccountId cannot be both empty. If both are provided, Account ID is used if valid, else falls back to Account Name.
	AccountName string `json:"accountName,omitempty"`

	// +kubebuilder:validation:Optional
	// Account ID in Cloudflare. AccountId and AccountName cannot be both empty. If both are provided, Account ID is used if valid, else falls back to Account Name.
	AccountId string `json:"accountId,omitempty"`

	// +kubebuilder:validation:Optional
	// Email to use along with API Key for Delete operations for new tunnels only, or as an alternate to API Token
	Email string `json:"email,omitempty"`

	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=CLOUDFLARE_API_KEY
	// Key in the secret to use for Cloudflare API Key, defaults to CLOUDFLARE_API_KEY. Needs Email also to be provided.
	// For Delete operations for new tunnels only, or as an alternate to API Token
	CLOUDFLARE_API_KEY string `json:"CLOUDFLARE_API_KEY,omitempty"`

	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=CLOUDFLARE_API_TOKEN
	// Key in the secret to use for Cloudflare API token, defaults to CLOUDFLARE_API_TOKEN
	CLOUDFLARE_API_TOKEN string `json:"CLOUDFLARE_API_TOKEN,omitempty"`

	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=CLOUDFLARE_TUNNEL_CREDENTIAL_FILE
	// Key in the secret to use as credentials.json for an existing tunnel, defaults to CLOUDFLARE_TUNNEL_CREDENTIAL_FILE
	CLOUDFLARE_TUNNEL_CREDENTIAL_FILE string `json:"CLOUDFLARE_TUNNEL_CREDENTIAL_FILE,omitempty"`

	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=CLOUDFLARE_TUNNEL_CREDENTIAL_SECRET
	// Key in the secret to use as tunnel secret for an existing tunnel, defaults to CLOUDFLARE_TUNNEL_CREDENTIAL_SECRET
	CLOUDFLARE_TUNNEL_CREDENTIAL_SECRET string `json:"CLOUDFLARE_TUNNEL_CREDENTIAL_SECRET,omitempty"`
}

type CloudflareDomain struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   CloudflareDomainSpec   `json:"spec,omitempty"`
	Status CloudflareDomainStatus `json:"status,omitempty"`
}

type CloudflareDomainList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []CloudflareDomain `json:"items"`
}

type CloudflareDomainSpec struct {
	// Domain is the domain name (e.g., "example.com")
	// This should be the apex domain registered in Cloudflare
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Pattern=`^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?)*$`
	Domain string `json:"domain"`

	// CredentialsRef references a CloudflareCredentials resource for API access.
	// If not specified, the default CloudflareCredentials will be used.
	// +kubebuilder:validation:Optional
	CredentialsRef *CredentialsReference `json:"credentialsRef,omitempty"`

	// IsDefault marks this domain as the default for resources that don't specify a domain.
	// Only one CloudflareDomain can be marked as default.
	// When multiple hostnames need zone lookup, the longest suffix match is used.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=false
	IsDefault bool `json:"isDefault,omitempty"`

	// ZoneID allows manual specification of the Cloudflare Zone ID.
	// If provided, the controller will skip zone lookup and use this value directly.
	// This is useful for advanced scenarios or when automatic lookup fails.
	// +kubebuilder:validation:Optional
	ZoneID string `json:"zoneId,omitempty"`

	// SSL configures SSL/TLS settings for this domain
	// +kubebuilder:validation:Optional
	SSL *SSLConfig `json:"ssl,omitempty"`

	// Cache configures caching settings for this domain
	// +kubebuilder:validation:Optional
	Cache *CacheConfig `json:"cache,omitempty"`

	// Security configures security settings for this domain
	// +kubebuilder:validation:Optional
	Security *SecurityConfig `json:"security,omitempty"`

	// Performance configures performance settings for this domain
	// +kubebuilder:validation:Optional
	Performance *PerformanceConfig `json:"performance,omitempty"`
}

type CloudflareDomainState string

type CloudflareDomainStatus struct {
	// Conditions represent the latest available observations
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// State represents the current state of the domain
	// +optional
	State CloudflareDomainState `json:"state,omitempty"`

	// ZoneID is the Cloudflare Zone ID for this domain
	// +optional
	ZoneID string `json:"zoneId,omitempty"`

	// ZoneName is the zone name as returned by Cloudflare API
	// +optional
	ZoneName string `json:"zoneName,omitempty"`

	// AccountID is the Cloudflare Account ID associated with this zone
	// +optional
	AccountID string `json:"accountId,omitempty"`

	// NameServers are the Cloudflare name servers for this zone
	// +optional
	NameServers []string `json:"nameServers,omitempty"`

	// ZoneStatus is the status of the zone in Cloudflare (active, pending, etc.)
	// +optional
	ZoneStatus string `json:"zoneStatus,omitempty"`

	// LastVerifiedTime is the last time the zone was verified with Cloudflare API
	// +optional
	LastVerifiedTime *metav1.Time `json:"lastVerifiedTime,omitempty"`

	// Message provides additional information about the current state
	// +optional
	Message string `json:"message,omitempty"`

	// ConfigSyncStatus represents the sync status of zone settings
	// +optional
	ConfigSyncStatus *ConfigSyncStatus `json:"configSyncStatus,omitempty"`
}

type ClusterTunnel struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   TunnelSpec   `json:"spec,omitempty"`
	Status TunnelStatus `json:"status,omitempty"`
}

type ClusterTunnelList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterTunnel `json:"items"`
}

type ConfigMapKeyRef struct {
	// Name is the ConfigMap name.
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// Key is the key in the ConfigMap.
	// +kubebuilder:validation:Required
	Key string `json:"key"`

	// Namespace is the ConfigMap namespace.
	// +kubebuilder:validation:Optional
	Namespace string `json:"namespace,omitempty"`
}

type ConfigSyncState string

type ConfigSyncStatus struct {
	// SSL sync status
	// +kubebuilder:validation:Optional
	SSL ConfigSyncState `json:"ssl,omitempty"`

	// Cache sync status
	// +kubebuilder:validation:Optional
	Cache ConfigSyncState `json:"cache,omitempty"`

	// Security sync status
	// +kubebuilder:validation:Optional
	Security ConfigSyncState `json:"security,omitempty"`

	// Performance sync status
	// +kubebuilder:validation:Optional
	Performance ConfigSyncState `json:"performance,omitempty"`

	// LastSyncTime is the last time any configuration was synced
	// +kubebuilder:validation:Optional
	LastSyncTime *string `json:"lastSyncTime,omitempty"`

	// ErrorMessage contains error details if any sync failed
	// +kubebuilder:validation:Optional
	ErrorMessage string `json:"errorMessage,omitempty"`
}

type CredentialsReference struct {
	// Name of the CloudflareCredentials resource
	// +kubebuilder:validation:Required
	Name string `json:"name"`
}

type CustomCertificateSettings struct {
	Enabled bool   `json:"enabled"`
	ID      string `json:"id,omitempty"`
}

type DNSManagementMode string

type DNSRecord struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DNSRecordSpec   `json:"spec,omitempty"`
	Status DNSRecordStatus `json:"status,omitempty"`
}

type DNSRecordData struct {
	// For SRV records
	// +kubebuilder:validation:Optional
	Service string `json:"service,omitempty"`

	// +kubebuilder:validation:Optional
	Proto string `json:"proto,omitempty"`

	// +kubebuilder:validation:Optional
	Weight int `json:"weight,omitempty"`

	// +kubebuilder:validation:Optional
	Port int `json:"port,omitempty"`

	// +kubebuilder:validation:Optional
	Target string `json:"target,omitempty"`

	// For CAA records
	// +kubebuilder:validation:Optional
	Flags int `json:"flags,omitempty"`

	// +kubebuilder:validation:Optional
	Tag string `json:"tag,omitempty"`

	// +kubebuilder:validation:Optional
	Value string `json:"value,omitempty"`

	// For CERT/SSHFP/TLSA records
	// +kubebuilder:validation:Optional
	Algorithm int `json:"algorithm,omitempty"`

	// +kubebuilder:validation:Optional
	Certificate string `json:"certificate,omitempty"`

	// +kubebuilder:validation:Optional
	KeyTag int `json:"keyTag,omitempty"`

	// +kubebuilder:validation:Optional
	Usage int `json:"usage,omitempty"`

	// +kubebuilder:validation:Optional
	Selector int `json:"selector,omitempty"`

	// +kubebuilder:validation:Optional
	MatchingType int `json:"matchingType,omitempty"`

	// For LOC records
	// +kubebuilder:validation:Optional
	LatDegrees int `json:"latDegrees,omitempty"`

	// +kubebuilder:validation:Optional
	LatMinutes int `json:"latMinutes,omitempty"`

	// +kubebuilder:validation:Optional
	LatSeconds string `json:"latSeconds,omitempty"`

	// +kubebuilder:validation:Optional
	LatDirection string `json:"latDirection,omitempty"`

	// +kubebuilder:validation:Optional
	LongDegrees int `json:"longDegrees,omitempty"`

	// +kubebuilder:validation:Optional
	LongMinutes int `json:"longMinutes,omitempty"`

	// +kubebuilder:validation:Optional
	LongSeconds string `json:"longSeconds,omitempty"`

	// +kubebuilder:validation:Optional
	LongDirection string `json:"longDirection,omitempty"`

	// +kubebuilder:validation:Optional
	Altitude string `json:"altitude,omitempty"`

	// +kubebuilder:validation:Optional
	Size string `json:"size,omitempty"`

	// +kubebuilder:validation:Optional
	PrecisionHorz string `json:"precisionHorz,omitempty"`

	// +kubebuilder:validation:Optional
	PrecisionVert string `json:"precisionVert,omitempty"`

	// For URI records
	// +kubebuilder:validation:Optional
	ContentURI string `json:"content,omitempty"`
}

type DNSRecordList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DNSRecord `json:"items"`
}

type DNSRecordSpec struct {
	// Name is the DNS record name (e.g., "www" or "www.example.com").
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MaxLength=255
	Name string `json:"name"`

	// Type is the DNS record type.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=A;AAAA;CNAME;TXT;MX;NS;SRV;CAA;CERT;DNSKEY;DS;HTTPS;LOC;NAPTR;SMIMEA;SSHFP;SVCB;TLSA;URI
	Type string `json:"type"`

	// Content is the record content/value.
	// +kubebuilder:validation:Required
	Content string `json:"content"`

	// TTL is the Time To Live (1 = automatic).
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:default=1
	TTL int `json:"ttl,omitempty"`

	// Proxied enables Cloudflare proxy for this record.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=false
	Proxied bool `json:"proxied,omitempty"`

	// Priority for MX/SRV records.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=65535
	Priority *int `json:"priority,omitempty"`

	// Comment is an optional comment.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=100
	Comment string `json:"comment,omitempty"`

	// Tags for the record.
	// +kubebuilder:validation:Optional
	Tags []string `json:"tags,omitempty"`

	// Data contains additional record-specific data (for SRV, CAA, etc.).
	// +kubebuilder:validation:Optional
	Data *DNSRecordData `json:"data,omitempty"`

	// Cloudflare contains the Cloudflare API credentials.
	// +kubebuilder:validation:Required
	Cloudflare CloudflareDetails `json:"cloudflare"`
}

type DNSRecordStatus struct {
	// RecordID is the Cloudflare DNS Record ID.
	// +kubebuilder:validation:Optional
	RecordID string `json:"recordId,omitempty"`

	// ZoneID is the Cloudflare Zone ID.
	// +kubebuilder:validation:Optional
	ZoneID string `json:"zoneId,omitempty"`

	// FQDN is the fully qualified domain name.
	// +kubebuilder:validation:Optional
	FQDN string `json:"fqdn,omitempty"`

	// State indicates the current state.
	// +kubebuilder:validation:Optional
	State string `json:"state,omitempty"`

	// Conditions represent the latest available observations.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed.
	// +kubebuilder:validation:Optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type DNSResolver struct {
	IP                         string `json:"ip,omitempty"`
	Port                       int    `json:"port,omitempty"`
	VNetID                     string `json:"vnetId,omitempty"`
	RouteThroughPrivateNetwork bool   `json:"routeThroughPrivateNetwork,omitempty"`
}

type DevicePostureInput struct {
	// ID is a generic identifier for integrations.
	// +kubebuilder:validation:Optional
	ID string `json:"id,omitempty"`

	// Path is the file path to check.
	// +kubebuilder:validation:Optional
	Path string `json:"path,omitempty"`

	// Exists checks if file exists.
	// +kubebuilder:validation:Optional
	Exists *bool `json:"exists,omitempty"`

	// Sha256 is the expected file hash.
	// +kubebuilder:validation:Optional
	Sha256 string `json:"sha256,omitempty"`

	// Thumbprint is the certificate thumbprint.
	// +kubebuilder:validation:Optional
	Thumbprint string `json:"thumbprint,omitempty"`

	// Running checks if application is running.
	// +kubebuilder:validation:Optional
	Running *bool `json:"running,omitempty"`

	// RequireAll requires all conditions to match.
	// +kubebuilder:validation:Optional
	RequireAll *bool `json:"requireAll,omitempty"`

	// Enabled checks if feature is enabled.
	// +kubebuilder:validation:Optional
	Enabled *bool `json:"enabled,omitempty"`

	// Version is the minimum version.
	// +kubebuilder:validation:Optional
	Version string `json:"version,omitempty"`

	// Operator is the version comparison operator.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=<;<=;>;>=;==
	Operator string `json:"operator,omitempty"`

	// Domain is the expected domain for domain-joined checks.
	// +kubebuilder:validation:Optional
	Domain string `json:"domain,omitempty"`

	// ComplianceStatus is the Intune compliance status.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=compliant;noncompliant;unknown;notapplicable;ingraceperiod;error
	ComplianceStatus string `json:"complianceStatus,omitempty"`

	// ConnectionID is the third-party integration connection ID.
	// +kubebuilder:validation:Optional
	ConnectionID string `json:"connectionId,omitempty"`

	// LastSeen is the maximum time since device was last seen.
	// +kubebuilder:validation:Optional
	LastSeen string `json:"lastSeen,omitempty"`

	// ActiveThreats is the maximum active threat count.
	// +kubebuilder:validation:Optional
	ActiveThreats *int `json:"activeThreats,omitempty"`

	// NetworkStatus checks for network connection.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=connected;disconnected;disconnecting;connecting
	NetworkStatus string `json:"networkStatus,omitempty"`

	// SensorConfig checks sensor configuration.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=active;disabled;not_configured
	SensorConfig string `json:"sensorConfig,omitempty"`

	// VersionOperator for CrowdStrike version checks.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=<;<=;>;>=;==
	VersionOperator string `json:"versionOperator,omitempty"`

	// CountOperator for count comparisons.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=<;<=;>;>=;==
	CountOperator string `json:"countOperator,omitempty"`

	// IssueCount is the number of issues for SentinelOne.
	// +kubebuilder:validation:Optional
	IssueCount *int `json:"issueCount,omitempty"`

	// OSDistroName is the OS distribution name.
	// +kubebuilder:validation:Optional
	OSDistroName string `json:"osDistroName,omitempty"`

	// OSDistroRevision is the OS distribution revision.
	// +kubebuilder:validation:Optional
	OSDistroRevision string `json:"osDistroRevision,omitempty"`

	// CertificateID for client certificate checks.
	// +kubebuilder:validation:Optional
	CertificateID string `json:"certificateId,omitempty"`

	// CommonName for client certificate checks.
	// +kubebuilder:validation:Optional
	CommonName string `json:"commonName,omitempty"`

	// CheckDisks specifies which disks to check encryption.
	// +kubebuilder:validation:Optional
	CheckDisks []string `json:"checkDisks,omitempty"`
}

type DevicePostureMatch struct {
	// Platform is the OS platform.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=windows;mac;linux;android;ios;chromeos
	Platform string `json:"platform,omitempty"`
}

type DevicePostureRule struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DevicePostureRuleSpec   `json:"spec,omitempty"`
	Status DevicePostureRuleStatus `json:"status,omitempty"`
}

type DevicePostureRuleList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DevicePostureRule `json:"items"`
}

type DevicePostureRuleSpec struct {
	// Name of the Device Posture Rule in Cloudflare.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=255
	Name string `json:"name,omitempty"`

	// Type is the posture rule type.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=file;application;serial_number;tanium;gateway;warp;disk_encryption;sentinelone;carbonblack;firewall;os_version;domain_joined;client_certificate;unique_client_id;kolide;tanium_s2s;crowdstrike_s2s;intune;workspace_one
	Type string `json:"type"`

	// Description is a human-readable description.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=1000
	Description string `json:"description,omitempty"`

	// Schedule determines how often the rule is evaluated.
	// +kubebuilder:validation:Optional
	Schedule string `json:"schedule,omitempty"`

	// Expiration is when the rule expires.
	// +kubebuilder:validation:Optional
	Expiration string `json:"expiration,omitempty"`

	// Match defines which devices this rule applies to.
	// +kubebuilder:validation:Optional
	Match []DevicePostureMatch `json:"match,omitempty"`

	// Input contains the rule-specific configuration.
	// +kubebuilder:validation:Optional
	Input *DevicePostureInput `json:"input,omitempty"`

	// Cloudflare contains the Cloudflare API credentials.
	// +kubebuilder:validation:Required
	Cloudflare CloudflareDetails `json:"cloudflare"`
}

type DevicePostureRuleStatus struct {
	// RuleID is the Cloudflare Device Posture Rule ID.
	// +kubebuilder:validation:Optional
	RuleID string `json:"ruleId,omitempty"`

	// AccountID is the Cloudflare Account ID.
	// +kubebuilder:validation:Optional
	AccountID string `json:"accountId,omitempty"`

	// State indicates the current state.
	// +kubebuilder:validation:Optional
	State string `json:"state,omitempty"`

	// Conditions represent the latest available observations.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed.
	// +kubebuilder:validation:Optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type DeviceSettingsPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DeviceSettingsPolicySpec   `json:"spec,omitempty"`
	Status DeviceSettingsPolicyStatus `json:"status,omitempty"`
}

type DeviceSettingsPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DeviceSettingsPolicy `json:"items"`
}

type DeviceSettingsPolicySpec struct {
	// SplitTunnelMode determines how split tunneling is configured.
	// "exclude" means traffic to listed addresses bypasses the tunnel (default WARP behavior).
	// "include" means only traffic to listed addresses goes through the tunnel.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=exclude;include
	// +kubebuilder:default=exclude
	SplitTunnelMode string `json:"splitTunnelMode,omitempty"`

	// SplitTunnelExclude lists addresses/hosts to exclude from the tunnel.
	// Only used when SplitTunnelMode is "exclude".
	// +kubebuilder:validation:Optional
	SplitTunnelExclude []SplitTunnelEntry `json:"splitTunnelExclude,omitempty"`

	// SplitTunnelInclude lists addresses/hosts to include in the tunnel.
	// Only used when SplitTunnelMode is "include".
	// +kubebuilder:validation:Optional
	SplitTunnelInclude []SplitTunnelEntry `json:"splitTunnelInclude,omitempty"`

	// FallbackDomains lists domains that should use the specified DNS servers
	// instead of Gateway DNS.
	// +kubebuilder:validation:Optional
	FallbackDomains []FallbackDomainEntry `json:"fallbackDomains,omitempty"`

	// AutoPopulateFromRoutes automatically populates split tunnel entries
	// from NetworkRoute resources in the cluster.
	// +kubebuilder:validation:Optional
	AutoPopulateFromRoutes *AutoPopulateConfig `json:"autoPopulateFromRoutes,omitempty"`

	// Cloudflare contains the Cloudflare API credentials and account information.
	// +kubebuilder:validation:Required
	Cloudflare CloudflareDetails `json:"cloudflare"`
}

type DeviceSettingsPolicyStatus struct {
	// AccountID is the Cloudflare Account ID.
	// +kubebuilder:validation:Optional
	AccountID string `json:"accountId,omitempty"`

	// SplitTunnelExcludeCount is the number of exclude entries configured.
	// +kubebuilder:validation:Optional
	SplitTunnelExcludeCount int `json:"splitTunnelExcludeCount,omitempty"`

	// SplitTunnelIncludeCount is the number of include entries configured.
	// +kubebuilder:validation:Optional
	SplitTunnelIncludeCount int `json:"splitTunnelIncludeCount,omitempty"`

	// FallbackDomainsCount is the number of fallback domain entries configured.
	// +kubebuilder:validation:Optional
	FallbackDomainsCount int `json:"fallbackDomainsCount,omitempty"`

	// AutoPopulatedRoutesCount is the number of routes auto-populated from NetworkRoutes.
	// +kubebuilder:validation:Optional
	AutoPopulatedRoutesCount int `json:"autoPopulatedRoutesCount,omitempty"`

	// State indicates the current state of the policy.
	// +kubebuilder:validation:Optional
	State string `json:"state,omitempty"`

	// Conditions represent the latest available observations of the DeviceSettingsPolicy's state.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed by the controller.
	// +kubebuilder:validation:Optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type DomainConfiguration struct {
	// AutoRenew enables automatic domain renewal
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=true
	AutoRenew bool `json:"autoRenew,omitempty"`

	// Privacy enables WHOIS privacy protection
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=true
	Privacy bool `json:"privacy,omitempty"`

	// Locked prevents unauthorized transfers
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=true
	Locked bool `json:"locked,omitempty"`

	// NameServers specifies custom nameservers (optional)
	// If not specified, Cloudflare nameservers will be used
	// +kubebuilder:validation:Optional
	NameServers []string `json:"nameServers,omitempty"`
}

type DomainRegistration struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DomainRegistrationSpec   `json:"spec,omitempty"`
	Status DomainRegistrationStatus `json:"status,omitempty"`
}

type DomainRegistrationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DomainRegistration `json:"items"`
}

type DomainRegistrationSpec struct {
	// DomainName is the domain name to manage
	// This domain must already be registered with Cloudflare Registrar
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Pattern=`^[a-zA-Z0-9][a-zA-Z0-9-]{0,61}[a-zA-Z0-9]\.[a-zA-Z]{2,}$`
	DomainName string `json:"domainName"`

	// Configuration contains domain settings
	// +kubebuilder:validation:Optional
	Configuration *DomainConfiguration `json:"configuration,omitempty"`

	// RegistrantContact contains the registrant contact information
	// If not specified, existing contact information will be preserved
	// +kubebuilder:validation:Optional
	RegistrantContact *RegistrantContact `json:"registrantContact,omitempty"`

	// CredentialsRef references a CloudflareCredentials resource
	// If not specified, the default CloudflareCredentials will be used
	// +kubebuilder:validation:Optional
	CredentialsRef *CredentialsReference `json:"credentialsRef,omitempty"`
}

type DomainRegistrationState string

type DomainRegistrationStatus struct {
	// Conditions represent the latest available observations
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// State represents the current state of the domain
	// +optional
	State DomainRegistrationState `json:"state,omitempty"`

	// DomainID is the Cloudflare domain ID
	// +optional
	DomainID string `json:"domainId,omitempty"`

	// CurrentRegistrar is the current registrar name
	// +optional
	CurrentRegistrar string `json:"currentRegistrar,omitempty"`

	// RegistryStatuses contains the registry status codes
	// +optional
	RegistryStatuses string `json:"registryStatuses,omitempty"`

	// ExpiresAt is when the domain registration expires
	// +optional
	ExpiresAt *metav1.Time `json:"expiresAt,omitempty"`

	// CreatedAt is when the domain was registered
	// +optional
	CreatedAt *metav1.Time `json:"createdAt,omitempty"`

	// AutoRenew indicates if auto-renewal is enabled
	// +optional
	AutoRenew bool `json:"autoRenew,omitempty"`

	// Privacy indicates if WHOIS privacy is enabled
	// +optional
	Privacy bool `json:"privacy,omitempty"`

	// Locked indicates if the domain is locked
	// +optional
	Locked bool `json:"locked,omitempty"`

	// TransferInStatus contains transfer status if applicable
	// +optional
	TransferInStatus string `json:"transferInStatus,omitempty"`

	// Message provides additional information about the current state
	// +optional
	Message string `json:"message,omitempty"`
}

type EgressSettings struct {
	IPv4         string `json:"ipv4,omitempty"`
	IPv6         string `json:"ipv6,omitempty"`
	IPv4Fallback string `json:"ipv4Fallback,omitempty"`
}

type ExistingTunnel struct {
	// +kubebuilder:validation:Optional
	// Existing Tunnel ID to run on. Tunnel ID and Tunnel Name cannot be both empty. If both are provided, ID is used if valid, else falls back to Name.
	Id string `json:"id,omitempty"`

	// +kubebuilder:validation:Optional
	// Existing Tunnel name to run on. Tunnel Name and Tunnel ID cannot be both empty. If both are provided, ID is used if valid, else falls back to Name.
	Name string `json:"name,omitempty"`
}

type FIPSSettings struct {
	TLS bool `json:"tls,omitempty"`
}

type FallbackDomainEntry struct {
	// Suffix is the domain suffix to match (e.g., "internal.company.com").
	// +kubebuilder:validation:Required
	Suffix string `json:"suffix"`

	// Description is an optional description for this entry.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=200
	Description string `json:"description,omitempty"`

	// DNSServer is a list of DNS server IPs to use for this domain.
	// +kubebuilder:validation:Optional
	DNSServer []string `json:"dnsServer,omitempty"`
}

type FeatureToggle string

type GatewayConfiguration struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   GatewayConfigurationSpec   `json:"spec,omitempty"`
	Status GatewayConfigurationStatus `json:"status,omitempty"`
}

type GatewayConfigurationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []GatewayConfiguration `json:"items"`
}

type GatewayConfigurationSpec struct {
	// Settings contains the Gateway configuration settings.
	// +kubebuilder:validation:Required
	Settings GatewaySettings `json:"settings"`

	// Cloudflare contains the Cloudflare API credentials.
	// +kubebuilder:validation:Required
	Cloudflare CloudflareDetails `json:"cloudflare"`
}

type GatewayConfigurationStatus struct {
	// AccountID is the Cloudflare Account ID.
	// +kubebuilder:validation:Optional
	AccountID string `json:"accountId,omitempty"`

	// State indicates the current state.
	// +kubebuilder:validation:Optional
	State string `json:"state,omitempty"`

	// Conditions represent the latest available observations.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed.
	// +kubebuilder:validation:Optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type GatewayList struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   GatewayListSpec   `json:"spec,omitempty"`
	Status GatewayListStatus `json:"status,omitempty"`
}

type GatewayListItem struct {
	// Value is the list entry value.
	// +kubebuilder:validation:Required
	Value string `json:"value"`

	// Description is an optional description for this item.
	// +kubebuilder:validation:Optional
	Description string `json:"description,omitempty"`
}

type GatewayListList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []GatewayList `json:"items"`
}

type GatewayListSpec struct {
	// Name of the Gateway List in Cloudflare.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=255
	Name string `json:"name,omitempty"`

	// Description is a human-readable description.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=1000
	Description string `json:"description,omitempty"`

	// Type is the list type.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=SERIAL;URL;DOMAIN;EMAIL;IP
	Type string `json:"type"`

	// Items are the list entries.
	// +kubebuilder:validation:Optional
	Items []GatewayListItem `json:"items,omitempty"`

	// ItemsFromConfigMap references a ConfigMap containing list items.
	// +kubebuilder:validation:Optional
	ItemsFromConfigMap *ConfigMapKeyRef `json:"itemsFromConfigMap,omitempty"`

	// Cloudflare contains the Cloudflare API credentials.
	// +kubebuilder:validation:Required
	Cloudflare CloudflareDetails `json:"cloudflare"`
}

type GatewayListStatus struct {
	// ListID is the Cloudflare Gateway List ID.
	// +kubebuilder:validation:Optional
	ListID string `json:"listId,omitempty"`

	// AccountID is the Cloudflare Account ID.
	// +kubebuilder:validation:Optional
	AccountID string `json:"accountId,omitempty"`

	// ItemCount is the number of items in the list.
	// +kubebuilder:validation:Optional
	ItemCount int `json:"itemCount,omitempty"`

	// State indicates the current state.
	// +kubebuilder:validation:Optional
	State string `json:"state,omitempty"`

	// Conditions represent the latest available observations.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed.
	// +kubebuilder:validation:Optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type GatewayRule struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   GatewayRuleSpec   `json:"spec,omitempty"`
	Status GatewayRuleStatus `json:"status,omitempty"`
}

type GatewayRuleList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []GatewayRule `json:"items"`
}

type GatewayRuleSettings struct {
	// BlockPageEnabled enables custom block page.
	// +kubebuilder:validation:Optional
	BlockPageEnabled *bool `json:"blockPageEnabled,omitempty"`

	// BlockReason is shown on the block page.
	// +kubebuilder:validation:Optional
	BlockReason string `json:"blockReason,omitempty"`

	// OverrideIPs for DNS override action.
	// +kubebuilder:validation:Optional
	OverrideIPs []string `json:"overrideIps,omitempty"`

	// OverrideHost for DNS override action.
	// +kubebuilder:validation:Optional
	OverrideHost string `json:"overrideHost,omitempty"`

	// L4Override for L4 override action.
	// +kubebuilder:validation:Optional
	L4Override *L4OverrideSettings `json:"l4Override,omitempty"`

	// BISOAdminControls for browser isolation.
	// +kubebuilder:validation:Optional
	BISOAdminControls *BISOAdminControls `json:"bisoAdminControls,omitempty"`

	// CheckSession enables session check.
	// +kubebuilder:validation:Optional
	CheckSession *SessionSettings `json:"checkSession,omitempty"`

	// AddHeaders adds headers to requests.
	// +kubebuilder:validation:Optional
	AddHeaders map[string]string `json:"addHeaders,omitempty"`

	// InsecureDisableDNSSECValidation disables DNSSEC validation.
	// +kubebuilder:validation:Optional
	InsecureDisableDNSSECValidation *bool `json:"insecureDisableDnssecValidation,omitempty"`

	// EgressSettings for egress action.
	// +kubebuilder:validation:Optional
	Egress *EgressSettings `json:"egress,omitempty"`

	// PayloadLog configures logging.
	// +kubebuilder:validation:Optional
	PayloadLog *PayloadLogSettings `json:"payloadLog,omitempty"`

	// UntrustedCertificateAction for TLS inspection.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=pass_through;block;error
	UntrustedCertificateAction string `json:"untrustedCertificateAction,omitempty"`

	// AuditSSH enables SSH command logging.
	// +kubebuilder:validation:Optional
	AuditSSH *AuditSSHSettings `json:"auditSsh,omitempty"`

	// ResolveDNSInternally for private DNS resolution.
	// +kubebuilder:validation:Optional
	ResolveDNSInternally *bool `json:"resolveDnsInternally,omitempty"`

	// DNSResolverIPv4 custom resolver.
	// +kubebuilder:validation:Optional
	DNSResolverIPv4 *DNSResolver `json:"dnsResolverIpv4,omitempty"`

	// DNSResolverIPv6 custom resolver.
	// +kubebuilder:validation:Optional
	DNSResolverIPv6 *DNSResolver `json:"dnsResolverIpv6,omitempty"`

	// NotificationSettings for alerts.
	// +kubebuilder:validation:Optional
	NotificationSettings *NotificationSettings `json:"notificationSettings,omitempty"`
}

type GatewayRuleSpec struct {
	// Name of the Gateway Rule in Cloudflare.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=255
	Name string `json:"name,omitempty"`

	// Description is a human-readable description.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=1000
	Description string `json:"description,omitempty"`

	// Precedence determines the order of rule evaluation (lower = earlier).
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Minimum=0
	Precedence int `json:"precedence"`

	// Enabled controls whether the rule is active.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=true
	Enabled bool `json:"enabled,omitempty"`

	// Action is what happens when the rule matches.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=allow;block;log;isolate;l4_override;egress;resolve;quarantine
	Action string `json:"action"`

	// Filters specifies which types of traffic this rule applies to.
	// +kubebuilder:validation:Optional
	Filters []string `json:"filters,omitempty"`

	// Traffic is the wirefilter expression for traffic matching.
	// +kubebuilder:validation:Optional
	Traffic string `json:"traffic,omitempty"`

	// Identity is the wirefilter expression for identity matching.
	// +kubebuilder:validation:Optional
	Identity string `json:"identity,omitempty"`

	// DevicePosture is the wirefilter expression for device posture matching.
	// +kubebuilder:validation:Optional
	DevicePosture string `json:"devicePosture,omitempty"`

	// RuleSettings contains action-specific settings.
	// +kubebuilder:validation:Optional
	RuleSettings *GatewayRuleSettings `json:"ruleSettings,omitempty"`

	// Cloudflare contains the Cloudflare API credentials.
	// +kubebuilder:validation:Required
	Cloudflare CloudflareDetails `json:"cloudflare"`
}

type GatewayRuleStatus struct {
	// RuleID is the Cloudflare Gateway Rule ID.
	// +kubebuilder:validation:Optional
	RuleID string `json:"ruleId,omitempty"`

	// AccountID is the Cloudflare Account ID.
	// +kubebuilder:validation:Optional
	AccountID string `json:"accountId,omitempty"`

	// State indicates the current state.
	// +kubebuilder:validation:Optional
	State string `json:"state,omitempty"`

	// Conditions represent the latest available observations.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed.
	// +kubebuilder:validation:Optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type GatewaySettings struct {
	// TLSDecrypt enables TLS decryption.
	// +kubebuilder:validation:Optional
	TLSDecrypt *TLSDecryptSettings `json:"tlsDecrypt,omitempty"`

	// ActivityLog configures activity logging.
	// +kubebuilder:validation:Optional
	ActivityLog *ActivityLogSettings `json:"activityLog,omitempty"`

	// AntiVirus configures AV scanning.
	// +kubebuilder:validation:Optional
	AntiVirus *AntiVirusSettings `json:"antiVirus,omitempty"`

	// BlockPage configures the block page.
	// +kubebuilder:validation:Optional
	BlockPage *BlockPageSettings `json:"blockPage,omitempty"`

	// BodyScanning configures body scanning.
	// +kubebuilder:validation:Optional
	BodyScanning *BodyScanningSettings `json:"bodyScanning,omitempty"`

	// BrowserIsolation configures browser isolation.
	// +kubebuilder:validation:Optional
	BrowserIsolation *BrowserIsolationSettings `json:"browserIsolation,omitempty"`

	// FIPS enables FIPS mode.
	// +kubebuilder:validation:Optional
	FIPS *FIPSSettings `json:"fips,omitempty"`

	// ProtocolDetection enables protocol detection.
	// +kubebuilder:validation:Optional
	ProtocolDetection *ProtocolDetectionSettings `json:"protocolDetection,omitempty"`

	// CustomCertificate configures custom root CA.
	// +kubebuilder:validation:Optional
	CustomCertificate *CustomCertificateSettings `json:"customCertificate,omitempty"`

	// NonIdentityBrowserIsolation configures non-identity isolation.
	// +kubebuilder:validation:Optional
	NonIdentityBrowserIsolation *NonIdentityBrowserIsolationSettings `json:"nonIdentityBrowserIsolation,omitempty"`
}

type HeaderModification struct {
	// Name is the header name
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// Operation is the operation to perform
	// +kubebuilder:validation:Required
	Operation HeaderOperation `json:"operation"`

	// Value is the static header value (for set/add operations)
	// +kubebuilder:validation:Optional
	Value string `json:"value,omitempty"`

	// Expression is a dynamic expression for the value
	// Example: ip.geoip.country
	// +kubebuilder:validation:Optional
	Expression string `json:"expression,omitempty"`
}

type HeaderOperation string

type IdentityProviderConfig struct {
	// ClientID is the OAuth client ID.
	// +kubebuilder:validation:Optional
	ClientID string `json:"clientId,omitempty"`

	// ClientSecret is the OAuth client secret (use ConfigSecretRef for sensitive values).
	// +kubebuilder:validation:Optional
	ClientSecret string `json:"clientSecret,omitempty"`

	// AppsDomain is the Google Workspace domain.
	// +kubebuilder:validation:Optional
	AppsDomain string `json:"appsDomain,omitempty"`

	// AuthURL is the authorization URL (OIDC/OAuth).
	// +kubebuilder:validation:Optional
	AuthURL string `json:"authUrl,omitempty"`

	// TokenURL is the token endpoint URL.
	// +kubebuilder:validation:Optional
	TokenURL string `json:"tokenUrl,omitempty"`

	// CertsURL is the JWKS endpoint URL.
	// +kubebuilder:validation:Optional
	CertsURL string `json:"certsUrl,omitempty"`

	// Scopes are the OAuth scopes to request.
	// +kubebuilder:validation:Optional
	Scopes []string `json:"scopes,omitempty"`

	// IdPPublicCerts are the IdP's public certificates for SAML.
	// +kubebuilder:validation:Optional
	IdPPublicCerts []string `json:"idpPublicCerts,omitempty"`

	// IssuerURL is the OIDC issuer URL.
	// +kubebuilder:validation:Optional
	IssuerURL string `json:"issuerUrl,omitempty"`

	// SSOTargetURL is the SAML SSO URL.
	// +kubebuilder:validation:Optional
	SSOTargetURL string `json:"ssoTargetUrl,omitempty"`

	// SignRequest enables SAML request signing.
	// +kubebuilder:validation:Optional
	SignRequest *bool `json:"signRequest,omitempty"`

	// EmailClaimName is the claim containing the user's email.
	// +kubebuilder:validation:Optional
	EmailClaimName string `json:"emailClaimName,omitempty"`

	// DirectoryID is the Azure AD directory ID.
	// +kubebuilder:validation:Optional
	DirectoryID string `json:"directoryId,omitempty"`

	// SupportGroups enables group sync.
	// +kubebuilder:validation:Optional
	SupportGroups *bool `json:"supportGroups,omitempty"`

	// PKCEEnabled enables PKCE.
	// +kubebuilder:validation:Optional
	PKCEEnabled *bool `json:"pkceEnabled,omitempty"`

	// ConditionalAccessEnabled enables Azure AD conditional access.
	// +kubebuilder:validation:Optional
	ConditionalAccessEnabled *bool `json:"conditionalAccessEnabled,omitempty"`

	// Claims are custom OIDC claims to include.
	// +kubebuilder:validation:Optional
	Claims []string `json:"claims,omitempty"`

	// EmailAttributeName is the SAML attribute containing email.
	// +kubebuilder:validation:Optional
	EmailAttributeName string `json:"emailAttributeName,omitempty"`

	// HeaderAttributes are SAML attributes to pass as headers.
	// +kubebuilder:validation:Optional
	HeaderAttributes []SAMLHeaderAttribute `json:"headerAttributes,omitempty"`

	// APIToken is the API token (GitHub, etc).
	// +kubebuilder:validation:Optional
	APIToken string `json:"apiToken,omitempty"`

	// OktaAccount is the Okta organization URL.
	// +kubebuilder:validation:Optional
	OktaAccount string `json:"oktaAccount,omitempty"`

	// OneloginAccount is the OneLogin subdomain.
	// +kubebuilder:validation:Optional
	OneloginAccount string `json:"oneloginAccount,omitempty"`

	// PingEnvID is the PingOne environment ID.
	// +kubebuilder:validation:Optional
	PingEnvID string `json:"pingEnvId,omitempty"`

	// CentrifyAccount is the Centrify account.
	// +kubebuilder:validation:Optional
	CentrifyAccount string `json:"centrifyAccount,omitempty"`

	// CentrifyAppID is the Centrify app ID.
	// +kubebuilder:validation:Optional
	CentrifyAppID string `json:"centrifyAppId,omitempty"`

	// RedirectURL is the callback URL.
	// +kubebuilder:validation:Optional
	RedirectURL string `json:"redirectUrl,omitempty"`
}