types

type AccessPolicy struct {
	// Decision is the CF Web UI "Action": allow, block, bypass, service_auth.
	// Mapped to CF API: allow -> "allow", block -> "deny", bypass -> "bypass",
	// service_auth -> "non_identity".
	Decision string `json:"decision"`

	// Name is the CF Web UI "Policy name".
	Name string `json:"name,omitempty"`

	// Include rules use OR logic (CF Web UI "Configure rules" > "Include").
	Include []AccessRule `json:"include,omitempty"`

	// Require rules use AND logic (CF Web UI "Configure rules" > "Require").
	Require []AccessRule `json:"require,omitempty"`

	// Exclude rules use NOT logic (CF Web UI "Configure rules" > "Exclude").
	Exclude []AccessRule `json:"exclude,omitempty"`
}

type AccessPolicyDef struct {
	// Name is the policy template name (from label key, e.g., "internal", "bypass")
	Name string `json:"name"`

	// AppName is the CF "Application name" (optional, defaults to "labelgate-<name>")
	AppName string `json:"app_name,omitempty"`

	// SessionDuration is the CF "Session Duration" (default: "24h")
	SessionDuration string `json:"session_duration"`

	// Policies are the access policies to apply.
	// Phase 5.1: single policy (len=1). Phase 5.2: multiple numbered policies.
	Policies []AccessPolicy `json:"policies"`
}

type AccessRule struct {
	// Selector is the CF Web UI selector name.
	Selector string `json:"selector"`

	// Values are the selector values (comma-separated in labels, split into slice).
	Values []string `json:"values"`
}

type ContainerEvent struct {
	// Type is the event type
	Type EventType `json:"type"`

	// ContainerID is the container ID
	ContainerID string `json:"container_id"`

	// ContainerName is the container name
	ContainerName string `json:"container_name"`

	// Labels are the container labels
	Labels map[string]string `json:"labels,omitempty"`

	// Timestamp is when the event occurred
	Timestamp time.Time `json:"timestamp"`

	// AgentID is the agent that reported the event (empty for local)
	AgentID string `json:"agent_id,omitempty"`
}

type ContainerInfo struct {
	// ID is the container ID
	ID string `json:"id"`

	// Name is the container name
	Name string `json:"name"`

	// Image is the container image
	Image string `json:"image"`

	// Labels are the container labels
	Labels map[string]string `json:"labels"`

	// Networks maps network name to IP address
	Networks map[string]string `json:"networks,omitempty"`

	// State is the container state (running, exited, etc.)
	State string `json:"state"`

	// Created is when the container was created
	Created time.Time `json:"created"`

	// Started is when the container was started
	Started time.Time `json:"started,omitempty"`
}

type DNSRecord struct {
	ID       string        `json:"id"`
	ZoneID   string        `json:"zone_id"`
	ZoneName string        `json:"zone_name"`
	Name     string        `json:"name"`
	Type     DNSRecordType `json:"type"`
	Content  string        `json:"content"`
	Proxied  bool          `json:"proxied"`
	TTL      int           `json:"ttl"`
	Priority int           `json:"priority,omitempty"`
	Comment  string        `json:"comment,omitempty"`
}

type DNSRecordType string

type DNSService struct {
	// ServiceName is the service identifier from label
	ServiceName string `json:"service_name"`

	// Hostname is the full DNS hostname
	Hostname string `json:"hostname"`

	// Type is the DNS record type (A, AAAA, CNAME, etc.)
	Type DNSRecordType `json:"type"`

	// Target is the record target (IP, hostname, or "auto")
	Target string `json:"target"`

	// Proxied indicates if Cloudflare proxy is enabled
	Proxied bool `json:"proxied"`

	// TTL is the record TTL in seconds (0 = auto)
	TTL int `json:"ttl"`

	// Credential is the credential name to use
	Credential string `json:"credential"`

	// Cleanup indicates if record should be deleted when container stops
	Cleanup bool `json:"cleanup"`

	// Comment is an optional comment for the record
	Comment string `json:"comment,omitempty"`

	// Access is the name of the access policy template to apply (optional).
	// References a labelgate.access.<name> definition.
	Access string `json:"access,omitempty"`

	// MX specific fields
	Priority int `json:"priority,omitempty"`

	// SRV specific fields
	Weight int `json:"weight,omitempty"`
	Port   int `json:"port,omitempty"`

	// CAA specific fields
	Flags int    `json:"flags,omitempty"`
	Tag   string `json:"tag,omitempty"`
}

type DNSTarget string

type EventType string

type IngressRule struct {
	Hostname      string               `json:"hostname,omitempty"`
	Path          string               `json:"path,omitempty"`
	Service       string               `json:"service"`
	OriginRequest *OriginRequestConfig `json:"origin_request,omitempty"`
}

type OriginRequestConfig struct {
	// Connection settings
	ConnectTimeout       string `json:"connect_timeout,omitempty"`
	TLSTimeout           string `json:"tls_timeout,omitempty"`
	TCPKeepAlive         string `json:"tcp_keepalive,omitempty"`
	KeepAliveConnections int    `json:"keep_alive_connections,omitempty"`
	KeepAliveTimeout     string `json:"keep_alive_timeout,omitempty"`

	// TLS settings
	NoTLSVerify      bool   `json:"no_tls_verify,omitempty"`
	OriginServerName string `json:"origin_server_name,omitempty"`
	CAPool           string `json:"ca_pool,omitempty"`

	// HTTP settings
	HTTPHostHeader         string `json:"http_host_header,omitempty"`
	NoHappyEyeballs        bool   `json:"no_happy_eyeballs,omitempty"`
	DisableChunkedEncoding bool   `json:"disable_chunked_encoding,omitempty"`

	// Protocol settings
	ProxyType string `json:"proxy_type,omitempty"` // "", "socks"
}

type ParsedContainer struct {
	// Container info
	Info *ContainerInfo `json:"info"`

	// DNS services parsed from labels
	DNSServices []*DNSService `json:"dns_services,omitempty"`

	// Tunnel services parsed from labels
	TunnelServices []*TunnelService `json:"tunnel_services,omitempty"`

	// AccessPolicies are named access policy definitions from this container.
	// Key is the policy name (e.g., "internal", "bypass").
	AccessPolicies map[string]*AccessPolicyDef `json:"access_policies,omitempty"`

	// AgentID is the agent that reported this container
	AgentID string `json:"agent_id,omitempty"`
}

type ResolvedAccessBinding struct {
	// Hostname from the referencing tunnel/dns service
	Hostname string `json:"hostname"`

	// PolicyDef is the resolved access policy definition
	PolicyDef *AccessPolicyDef `json:"policy_def"`

	// ContainerID of the referencing tunnel/dns service
	ContainerID string `json:"container_id,omitempty"`

	// ContainerName of the referencing tunnel/dns service
	ContainerName string `json:"container_name,omitempty"`

	// ServiceName of the referencing tunnel/dns service
	ServiceName string `json:"service_name"`

	// AgentID of the agent that reported this container
	AgentID string `json:"agent_id,omitempty"`

	// Cleanup follows the tunnel/dns service's cleanup setting
	Cleanup bool `json:"cleanup"`

	// Credential for CF API calls
	Credential string `json:"credential"`
}

type Tunnel struct {
	ID           string           `json:"id"`
	Name         string           `json:"name"`
	AccountID    string           `json:"account_id"`
	Status       string           `json:"status"`
	RemoteConfig bool             `json:"remote_config"`
	ConnectorID  string           `json:"connector_id,omitempty"`
	IngressRules []*TunnelIngress `json:"ingress_rules,omitempty"`
}

type TunnelConfiguration struct {
	TunnelID string        `json:"tunnel_id"`
	Ingress  []IngressRule `json:"ingress"`
}

type TunnelIngress struct {
	Hostname      string               `json:"hostname,omitempty"`
	Path          string               `json:"path,omitempty"`
	Service       string               `json:"service"`
	OriginRequest *OriginRequestConfig `json:"origin_request,omitempty"`
}

type TunnelProtocol string

type TunnelService struct {
	// ServiceName is the service identifier from label
	ServiceName string `json:"service_name"`

	// Hostname is the public hostname for the service
	Hostname string `json:"hostname"`

	// Service is the backend service URL (e.g., http://localhost:8080)
	Service string `json:"service"`

	// Tunnel is the tunnel name to use
	Tunnel string `json:"tunnel"`

	// Path is the optional path pattern for routing
	Path string `json:"path,omitempty"`

	// Credential is the credential name to use
	Credential string `json:"credential"`

	// Cleanup indicates if ingress should be deleted when container stops
	Cleanup bool `json:"cleanup"`

	// Access is the name of the access policy template to apply (optional).
	// References a labelgate.access.<name> definition.
	Access string `json:"access,omitempty"`

	// OriginRequest contains origin request configuration
	OriginRequest *OriginRequestConfig `json:"origin_request,omitempty"`
}