controller

type CELRule struct {
	Name    string `json:"name"`
	CEL     string `json:"cel"`
	Message string `json:"message"`
}

type GenerationRule struct {
	// Namespace is the namespace this rule applies to.
	Namespace string `json:"namespace"`
	// Name is the TransactionType name.
	Name string `json:"name"`
	// Endpoint is the path+method that triggers token generation.
	Endpoint v1alpha1.EndpointSpec `json:"endpoint"`
	// Purpose is the transaction purpose (included in tctx).
	Purpose string `json:"purpose"`
	// Scope is the requested scope for the TxToken.
	Scope string `json:"scope"`
	// TctxMapping defines how to extract tctx fields from the request.
	TctxMapping map[string]v1alpha1.TctxFieldMapping `json:"tctxMapping,omitempty"`
	// TctxEnrichments defines computed tctx fields.
	TctxEnrichments []v1alpha1.TctxEnrichment `json:"tctxEnrichments,omitempty"`
	// RctxFields lists rctx fields to populate.
	RctxFields []string `json:"rctxFields,omitempty"`
	// TokenLifetime is the effective lifetime after policy clamping.
	TokenLifetime string `json:"tokenLifetime"`
}

type RulePublisher interface {
	UpdateGenerationRules(rules []GenerationRule)
	UpdateVerificationRules(rules []VerificationRule)
}

type ServiceTokenRequirementReconciler struct {
	client.Client
	Scheme        *runtime.Scheme
	RulePublisher RulePublisher
}

type TransactionTypeReconciler struct {
	client.Client
	Scheme        *runtime.Scheme
	RulePublisher RulePublisher
}

type VerificationRule struct {
	// Namespace is the namespace this rule applies to.
	Namespace string `json:"namespace"`
	// Name is the ServiceTokenRequirement name.
	Name string `json:"name"`
	// ServiceName is the Kubernetes service this applies to.
	ServiceName string `json:"serviceName"`
	// RequiredScope is the minimum required scope.
	RequiredScope string `json:"requiredScope,omitempty"`
	// RequiredTctxFields lists required tctx fields.
	RequiredTctxFields []string `json:"requiredTctxFields,omitempty"`
	// CELRules are pre-validated CEL expressions.
	CELRules []CELRule `json:"celRules,omitempty"`
	// ExcludedEndpoints lists endpoints that bypass verification.
	ExcludedEndpoints []v1alpha1.EndpointSpec `json:"excludedEndpoints,omitempty"`
	// AutoNarrow enables automatic scope narrowing.
	AutoNarrow bool `json:"autoNarrow,omitempty"`
}