v1alpha1

type Database struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DatabaseSpec   `json:"spec"`
	Status DatabaseStatus `json:"status,omitempty"`
}

type DatabaseList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Database `json:"items"`
}

type DatabaseParameters struct {
	// The role name of the user who will own the new database, or DEFAULT to
	// use the default (namely, the user executing the command). To create a
	// database owned by another role, you must be a direct or indirect member
	// of that role, or be a superuser.
	// +optional
	// +crossplane:generate:reference:type=Role
	Owner *string `json:"owner,omitempty"`

	// OwnerRef references the role object that will own this database.
	// +optional
	OwnerRef *xpv2.Reference `json:"ownerRef,omitempty"`

	// OwnerSelector selects a reference to a Role that will own this database.
	// +optional
	OwnerSelector *xpv2.Selector `json:"ownerSelector,omitempty"`

	// The name of the template from which to create the new database, or
	// DEFAULT to use the default template (template1).
	Template *string `json:"template,omitempty"`

	// Strategy sets the method used to create the database from the template.
	// This field is create-only and requires PostgreSQL 15+.
	// When omitted, PostgreSQL uses the server default.
	// +kubebuilder:validation:Enum=WAL_LOG;FILE_COPY
	// +optional
	Strategy *DatabaseStrategy `json:"strategy,omitempty"`

	// Character set encoding to use in the new database. Specify a string
	// constant (e.g., 'SQL_ASCII'), or an integer encoding number, or DEFAULT
	// to use the default encoding (namely, the encoding of the template
	// database). The character sets supported by the PostgreSQL server are
	// described in Section 23.3.1. See below for additional restrictions.
	Encoding *string `json:"encoding,omitempty"`

	// Collation order (LC_COLLATE) to use in the new database. This affects the
	// sort order applied to strings, e.g. in queries with ORDER BY, as well as
	// the order used in indexes on text columns. The default is to use the
	// collation order of the template database. See below for additional
	// restrictions.
	LCCollate *string `json:"lcCollate,omitempty"`

	// Character classification (LC_CTYPE) to use in the new database. This
	// affects the categorization of characters, e.g. lower, upper and digit.
	// The default is to use the character classification of the template
	// database. See below for additional restrictions.
	LCCType *string `json:"lcCType,omitempty"`

	// The name of the tablespace that will be associated with the new database,
	// or DEFAULT to use the template database's tablespace. This tablespace
	// will be the default tablespace used for objects created in this database.
	// See CREATE TABLESPACE for more information.
	Tablespace *string `json:"tablespace,omitempty"`

	// If false then no one can connect to this database. The default is true,
	// allowing connections (except as restricted by other mechanisms, such as
	// GRANT/REVOKE CONNECT).
	AllowConnections *bool `json:"allowConnections,omitempty"`

	// How many concurrent connections can be made to this database. -1 (the
	// default) means no limit.
	ConnectionLimit *int `json:"connectionLimit,omitempty"`

	// If true, then this database can be cloned by any user with CREATEDB
	// privileges; if false (the default), then only superusers or the owner of
	// the database can clone it.
	IsTemplate *bool `json:"isTemplate,omitempty"`
}

type DatabaseSpec struct {
	xpv2.ClusterManagedResourceSpec `json:",inline"`
	ForProvider                     DatabaseParameters `json:"forProvider"`
}

type DatabaseStatus struct {
	xpv2.ManagedResourceStatus `json:",inline"`
}

type DatabaseStrategy string

type DefaultPrivileges struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DefaultPrivilegesSpec   `json:"spec"`
	Status DefaultPrivilegesStatus `json:"status,omitempty"`
}

type DefaultPrivilegesList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DefaultPrivileges `json:"items"`
}

type DefaultPrivilegesParameters struct {
	// Privileges to be granted.
	// See https://www.postgresql.org/docs/current/sql-grant.html for available privileges.
	// +optional
	Privileges GrantPrivileges `json:"privileges,omitempty"`

	// TargetRole is the role whose future objects will have default privileges applied.
	// When this role creates new objects, the specified privileges are automatically
	// granted. Maps to FOR ROLE in ALTER DEFAULT PRIVILEGES.
	// See https://www.postgresql.org/docs/current/sql-alterdefaultprivileges.html
	// +required
	TargetRole *string `json:"targetRole"`

	// ObjectType to which the privileges are granted.
	// +kubebuilder:validation:Enum=table;sequence;function;schema;type
	// +required
	ObjectType *string `json:"objectType,omitempty"`

	// WithOption allows an option to be set on the grant.
	// See https://www.postgresql.org/docs/current/sql-grant.html for available
	// options for each grant type, and the effects of applying the option.
	// +kubebuilder:validation:Enum=ADMIN;GRANT
	// +optional
	WithOption *GrantOption `json:"withOption,omitempty"`

	// Role is the role that will receive the default privileges (the grantee).
	// Maps to TO in ALTER DEFAULT PRIVILEGES ... GRANT ... TO role.
	// +optional
	// +crossplane:generate:reference:type=Role
	Role *string `json:"role,omitempty"`

	// RoleRef to which default privileges are granted.
	// +immutable
	// +optional
	RoleRef *xpv2.Reference `json:"roleRef,omitempty"`

	// RoleSelector selects a reference to a Role this default grant is for.
	// +immutable
	// +optional
	RoleSelector *xpv2.Selector `json:"roleSelector,omitempty"`

	// Database in which the default privileges are applied
	// +optional
	// +crossplane:generate:reference:type=Database
	Database *string `json:"database,omitempty"`

	// DatabaseRef references the database object this default grant it for.
	// +immutable
	// +optional
	DatabaseRef *xpv2.Reference `json:"databaseRef,omitempty"`

	// DatabaseSelector selects a reference to a Database this grant is for.
	// +immutable
	// +optional
	DatabaseSelector *xpv2.Selector `json:"databaseSelector,omitempty"`

	// Schema in which the default privileges are applied.
	// Not applicable when objectType is schema.
	// +optional
	Schema *string `json:"schema,omitempty"`
}

type DefaultPrivilegesSpec struct {
	xpv2.ClusterManagedResourceSpec `json:",inline"`
	ForProvider                     DefaultPrivilegesParameters `json:"forProvider"`
}

type DefaultPrivilegesStatus struct {
	xpv2.ManagedResourceStatus `json:",inline"`
}

type DropBehavior string

type Extension struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ExtensionSpec   `json:"spec"`
	Status ExtensionStatus `json:"status,omitempty"`
}

type ExtensionList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Extension `json:"items"`
}

type ExtensionParameters struct {
	// Extension name to be installed.
	Extension string `json:"extension"`

	// Version of the extension to be installed.
	// +immutable
	// +optional
	Version *string `json:"version,omitempty"`

	// Schema for extension install.
	// +optional
	Schema *string `json:"schema,omitempty"`

	// Database for extension install.
	// +optional
	// +crossplane:generate:reference:type=Database
	Database *string `json:"database,omitempty"`

	// DatabaseRef references the database object this extension is for.
	// +immutable
	// +optional
	DatabaseRef *xpv2.Reference `json:"databaseRef,omitempty"`

	// DatabaseSelector selects a reference to a Database this extension is for.
	// +immutable
	// +optional
	DatabaseSelector *xpv2.Selector `json:"databaseSelector,omitempty"`
}

type ExtensionSpec struct {
	xpv2.ClusterManagedResourceSpec `json:",inline"`
	ForProvider                     ExtensionParameters `json:"forProvider"`
}

type ExtensionStatus struct {
	xpv2.ManagedResourceStatus `json:",inline"`
}

type Grant struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   GrantSpec   `json:"spec"`
	Status GrantStatus `json:"status,omitempty"`
}

type GrantList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Grant `json:"items"`
}

type GrantOption string

type GrantParameters struct {
	// Privileges to be granted.
	// See https://www.postgresql.org/docs/current/sql-grant.html for available privileges.
	// +optional
	Privileges GrantPrivileges `json:"privileges,omitempty"`

	// WithOption allows an option to be set on the grant.
	// See https://www.postgresql.org/docs/current/sql-grant.html for available
	// options for each grant type, and the effects of applying the option.
	// +kubebuilder:validation:Enum=ADMIN;GRANT
	// +optional
	WithOption *GrantOption `json:"withOption,omitempty"`

	// Role this grant is for.
	// +optional
	// +crossplane:generate:reference:type=Role
	Role *string `json:"role,omitempty"`

	// RoleRef references the role object this grant is for.
	// +immutable
	// +optional
	RoleRef *xpv2.Reference `json:"roleRef,omitempty"`

	// RoleSelector selects a reference to a Role this grant is for.
	// +immutable
	// +optional
	RoleSelector *xpv2.Selector `json:"roleSelector,omitempty"`

	// Database this grant is for.
	// +optional
	// +crossplane:generate:reference:type=Database
	Database *string `json:"database,omitempty"`

	// DatabaseRef references the database object this grant it for.
	// +immutable
	// +optional
	DatabaseRef *xpv2.Reference `json:"databaseRef,omitempty"`

	// DatabaseSelector selects a reference to a Database this grant is for.
	// +immutable
	// +optional
	DatabaseSelector *xpv2.Selector `json:"databaseSelector,omitempty"`

	// Schema this grant is for.
	// +optional
	Schema *string `json:"schema,omitempty"`

	// SchemaRef references the schema object this grant it for.
	// +immutable
	// +optional
	SchemaRef *xpv2.Reference `json:"schemaRef,omitempty"`

	// SchemaSelector selects a reference to a Schema this grant is for.
	// +immutable
	// +optional
	SchemaSelector *xpv2.Selector `json:"schemaSelector,omitempty"`

	// MemberOf is the Role that this grant makes Role a member of.
	// +optional
	// +crossplane:generate:reference:type=Role
	MemberOf *string `json:"memberOf,omitempty"`

	// MemberOfRef references the Role that this grant makes Role a member of.
	// +immutable
	// +optional
	MemberOfRef *xpv2.Reference `json:"memberOfRef,omitempty"`

	// MemberOfSelector selects a reference to a Role that this grant makes Role a member of.
	// +immutable
	// +optional
	MemberOfSelector *xpv2.Selector `json:"memberOfSelector,omitempty"`

	// RevokePublicOnDb apply the statement "REVOKE ALL ON DATABASE %s FROM PUBLIC" to make database unreachable from public
	// +optional
	RevokePublicOnDb *bool `json:"revokePublicOnDb,omitempty" default:"false"`

	// The columns upon which to grant the privileges.
	// +optional
	// +kubebuilder:validation:items:Pattern:=^[a-zA-Z_][a-zA-Z0-9_$]*$
	Columns []string `json:"columns,omitempty"`

	// The tables upon which to grant the privileges. The single element "*"
	// targets every table in the schema and cannot be combined with names. A
	// wildcard grant is authoritative: it revokes ALL PRIVILEGES on the schema
	// from the role before granting.
	// +optional
	// +kubebuilder:validation:items:Pattern:=^(\*|[a-zA-Z_][a-zA-Z0-9_$]*)$
	Tables []string `json:"tables,omitempty"`

	// The sequences upon which to grant the privileges. The single element "*"
	// targets every sequence in the schema and cannot be combined with names,
	// and is authoritative like the tables wildcard.
	// +optional
	// +kubebuilder:validation:items:Pattern:=^(\*|[a-zA-Z_][a-zA-Z0-9_$]*)$
	Sequences []string `json:"sequences,omitempty"`

	// The routines upon which to grant the privileges.
	// +optional
	Routines []Routine `json:"routines,omitempty"`

	// The foreign data wrappers upon which to grant the privileges.
	// +optional
	// +kubebuilder:validation:items:Pattern:=^[a-zA-Z_][a-zA-Z0-9_$]*$
	ForeignDataWrappers []string `json:"foreignDataWrappers,omitempty"`

	// The foreign servers upon which to grant the privileges.
	// +optional
	// +kubebuilder:validation:items:Pattern:=^[a-zA-Z_][a-zA-Z0-9_$]*$
	ForeignServers []string `json:"foreignServers,omitempty"`

	// WithInherit controls whether the grantee automatically inherits the privileges
	// of the granted role. When set to false, emits WITH INHERIT FALSE (PostgreSQL 16+),
	// granting membership without automatic privilege inheritance. Only valid when
	// memberOf is set. When omitted, PostgreSQL's default behavior (inherit true) applies.
	// Note: this field is only evaluated when non-nil. Removing it from the manifest
	// does NOT revert the database-side setting; set withInherit: true explicitly to revert.
	// +optional
	WithInherit *bool `json:"withInherit,omitempty"`
}

type GrantPrivilege string

type GrantPrivileges []GrantPrivilege

type GrantSpec struct {
	xpv2.ClusterManagedResourceSpec `json:",inline"`
	ForProvider                     GrantParameters `json:"forProvider"`
}

type GrantStatus struct {
	xpv2.ManagedResourceStatus `json:",inline"`
}

type GrantType string

type ProviderConfig struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ProviderConfigSpec   `json:"spec"`
	Status ProviderConfigStatus `json:"status,omitempty"`
}

type ProviderConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ProviderConfig `json:"items"`
}

type ProviderConfigSpec struct {
	// Credentials required to authenticate to this provider.
	Credentials ProviderCredentials `json:"credentials"`
	// Defines the database name used to set up a connection to the provided
	// PostgreSQL instance. Same as PGDATABASE environment variable.
	// +kubebuilder:default="postgres"
	DefaultDatabase string `json:"defaultDatabase,omitempty"`
	// Defines the SSL mode used to set up a connection to the provided
	// PostgreSQL instance
	// +kubebuilder:validation:Enum=disable;require;verify-ca;verify-full
	// +kubebuilder:default=verify-full
	// +kubebuilder:validation:Optional
	SSLMode *string `json:"sslMode,omitempty"`
}

type ProviderConfigStatus struct {
	xpv2.ProviderConfigStatus `json:",inline"`
}

type ProviderConfigUsage struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	xpv2.ProviderConfigUsage `json:",inline"`
}

type ProviderConfigUsageList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ProviderConfigUsage `json:"items"`
}

type ProviderCredentials struct {
	// Source of the provider credentials.
	// +kubebuilder:validation:Enum=PostgreSQLConnectionSecret
	Source xpv2.CredentialsSource `json:"source"`

	// A CredentialsSecretRef is a reference to a PostgreSQL connection secret
	// that contains the credentials that must be used to connect to the
	// provider. +optional
	ConnectionSecretRef *xpv2.SecretReference `json:"connectionSecretRef,omitempty"`

	// SecretKeyMapping allows overriding the default secret key names used
	// to read credentials from the connection secret. When not specified,
	// standard Crossplane keys are used: "endpoint", "port", "username", "password".
	// +optional
	SecretKeyMapping *SecretKeyMapping `json:"secretKeyMapping,omitempty"`
}

type Role struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   RoleSpec   `json:"spec"`
	Status RoleStatus `json:"status,omitempty"`
}

type RoleConfigurationParameter struct {
	Name  string `json:"name,omitempty"`
	Value string `json:"value,omitempty"`
}

type RoleList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Role `json:"items"`
}

type RoleObservation struct {
	// PrivilegesAsClauses represents the applied privileges state, taking into account
	// any defaults applied by Postgres, and expressed as a list of ROLE PRIVILEGE clauses.
	PrivilegesAsClauses []string `json:"privilegesAsClauses,omitempty"`
	// ConfigurationParameters represents the applied configuration parameters for the PostgreSQL role.
	ConfigurationParameters *[]RoleConfigurationParameter `json:"configurationParameters,omitempty"`
	// LastPasswordChange records when the provider last set the role's password.
	LastPasswordChange *metav1.Time `json:"lastPasswordChange,omitempty"`
}

type RoleParameters struct {
	// ConnectionLimit to be applied to the role.
	// +kubebuilder:validation:Min=-1
	// +optional
	ConnectionLimit *int32 `json:"connectionLimit,omitempty"`

	// Privileges to be granted.
	// +optional
	Privileges RolePrivilege `json:"privileges,omitempty"`

	// PasswordSecretRef references the secret that contains the password used
	// for this role. If no reference is given, a password will be auto-generated.
	// +optional
	PasswordSecretRef *xpv2.SecretKeySelector `json:"passwordSecretRef,omitempty"`

	// ConfigurationParameters to be applied to the role. If specified, any other configuration parameters set on the
	// role in the database will be reset.
	//
	// See https://www.postgresql.org/docs/current/runtime-config-client.html for some available configuration parameters.
	// +optional
	ConfigurationParameters *[]RoleConfigurationParameter `json:"configurationParameters,omitempty"`

	// PasswordRotationTrigger triggers rotation of the auto-generated password when set to
	// a time after the current LastPasswordChange. Has no effect when passwordSecretRef is set.
	// +optional
	PasswordRotationTrigger *metav1.Time `json:"passwordRotationTrigger,omitempty"`
}

type RolePrivilege struct {
	// SuperUser grants SUPERUSER privilege when true.
	// +optional
	SuperUser *bool `json:"superUser,omitempty"`

	// CreateDb grants CREATEDB when true, allowing the role to create databases.
	// +optional
	CreateDb *bool `json:"createDb,omitempty"`

	// CreateRole grants CREATEROLE when true, allowing this role to create other roles.
	// +optional
	CreateRole *bool `json:"createRole,omitempty"`

	// Login grants LOGIN when true, allowing the role to login to the server.
	// +optional
	Login *bool `json:"login,omitempty"`

	// Inherit grants INHERIT when true, allowing the role to inherit permissions
	// from other roles it is a member of.
	// +optional
	Inherit *bool `json:"inherit,omitempty"`

	// Replication grants REPLICATION when true, allowing the role to connect in replication mode.
	// +optional
	Replication *bool `json:"replication,omitempty"`

	// BypassRls grants BYPASSRLS when true, allowing the role to bypass row-level security policies.
	// +optional
	BypassRls *bool `json:"bypassRls,omitempty"`
}

type RoleSpec struct {
	xpv2.ClusterManagedResourceSpec `json:",inline"`
	ForProvider                     RoleParameters `json:"forProvider"`
}

type RoleStatus struct {
	xpv2.ManagedResourceStatus `json:",inline"`
	AtProvider                 RoleObservation `json:"atProvider,omitempty"`
}

type Routine struct {
	// The name of the routine. The single entry {name: "*"} targets every
	// routine in the schema; it takes no args, stands alone, and is
	// authoritative like the tables wildcard.
	// +kubebuilder:validation:Pattern:=^(\*|[a-zA-Z_][a-zA-Z0-9_$]*)$
	Name string `json:"name,omitempty"`

	// The arguments of the routine. Each argument is a type name, optionally
	// schema-qualified (e.g. aws_commons._s3_uri_1) for composite types.
	// +optional
	// +kubebuilder:validation:items:Pattern:=^[a-zA-Z_][a-zA-Z0-9_$]*(\.[a-zA-Z_][a-zA-Z0-9_$]*)?$
	Arguments []string `json:"args,omitempty"`
}

type Schema struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   SchemaSpec   `json:"spec"`
	Status SchemaStatus `json:"status,omitempty"`
}

type SchemaList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Schema `json:"items"`
}

type SchemaParameters struct {
	// Role for ownership of this schema.
	// +optional
	// +crossplane:generate:reference:type=Role
	Role *string `json:"role,omitempty"`

	// RoleRef references the role object this schema is for.
	// +immutable
	// +optional
	RoleRef *xpv2.Reference `json:"roleRef,omitempty"`

	// RoleSelector selects a reference to a Role this schema is for.
	// +immutable
	// +optional
	RoleSelector *xpv2.Selector `json:"roleSelector,omitempty"`

	// Database this schema is for.
	// +optional
	// +crossplane:generate:reference:type=Database
	Database *string `json:"database,omitempty"`

	// DatabaseRef references the database object this schema is for.
	// +immutable
	// +optional
	DatabaseRef *xpv2.Reference `json:"databaseRef,omitempty"`

	// DatabaseSelector selects a reference to a Database this schema is for.
	// +immutable
	// +optional
	DatabaseSelector *xpv2.Selector `json:"databaseSelector,omitempty"`

	// RevokePublicOnSchema apply a "REVOKE ALL ON SCHEMA public FROM public" statement
	// +optional
	RevokePublicOnSchema *bool `json:"revokePublicOnSchema,omitempty" default:"false"`

	// DropBehavior configures deletion behavior: CASCADE will automatically drop
	// objects (tables, functions, etc.) that are contained in the schema, and in
	// turn all objects that depend on those objects. The default setting of
	// RESTRICT will refuse to drop the schema if it contains any objects.
	// +kubebuilder:validation:Enum=CASCADE;RESTRICT
	// +kubebuilder:default:=RESTRICT
	// +optional
	DropBehavior *DropBehavior `json:"dropBehavior,omitempty"`
}

type SchemaSpec struct {
	xpv2.ClusterManagedResourceSpec `json:",inline"`
	ForProvider                     SchemaParameters `json:"forProvider"`
}

type SchemaStatus struct {
	xpv2.ManagedResourceStatus `json:",inline"`
}

type SecretKeyMapping struct {
	// Endpoint overrides the key used to read the host/endpoint. Default: "endpoint".
	// +optional
	Endpoint string `json:"endpoint,omitempty"`
	// Port overrides the key used to read the port. Default: "port".
	// +optional
	Port string `json:"port,omitempty"`
	// Username overrides the key used to read the username. Default: "username".
	// +optional
	Username string `json:"username,omitempty"`
	// Password overrides the key used to read the password. Default: "password".
	// +optional
	Password string `json:"password,omitempty"`
}