hooks

type Credentials struct {
	CookieSecret string `json:"cookieSecret"`
	AppDexSecret string `json:"appDexSecret"`
}

type DexAuthenticator struct {
	ID          string                 `json:"uuid"`
	EncodedName string                 `json:"encodedName"`
	Name        string                 `json:"name"`
	Namespace   string                 `json:"namespace"`
	Spec        map[string]interface{} `json:"spec"`

	AllowAccessToKubernetes bool        `json:"allowAccessToKubernetes"`
	Credentials             Credentials `json:"credentials"`

	// AllowAccessToKubernetesAnnotation carries the raw annotation value from the filter,
	// which has no logger, to the hook body, which does. It is nil when the annotation is
	// absent, and json:"-" keeps it out of the internal values the templates read.
	AllowAccessToKubernetesAnnotation *string `json:"-"`
}

type DexAuthenticatorSecret struct {
	ID          string      `json:"uuid"`
	Name        string      `json:"name"`
	Namespace   string      `json:"namespace"`
	Credentials Credentials `json:"credentials"`
}

type DexCA struct {
	Name string `json:"name"`
	Data []byte `json:"data"`
}

type DexClient struct {
	ID        string `json:"id"`
	EncodedID string `json:"encodedID"`

	Name      string                 `json:"name"`
	Namespace string                 `json:"namespace"`
	Spec      map[string]interface{} `json:"spec"`

	Secret string `json:"clientSecret"`

	// LegacyID and LegacyEncodedID is formatted with a colons delimiter which is impossible to use as a
	//   basic auth credentials part
	LegacyID        string `json:"legacyID"`
	LegacyEncodedID string `json:"legacyEncodedID"`

	Labels      map[string]string `json:"labels"`
	Annotations map[string]string `json:"annotations"`

	AllowAccessToKubernetes bool `json:"allowAccessToKubernetes"`

	// AllowAccessToKubernetesAnnotation carries the raw annotation value from the filter,
	// which has no logger, to the hook body, which does. It is nil when the annotation is
	// absent, and json:"-" keeps it out of the internal values the templates read.
	AllowAccessToKubernetesAnnotation *string `json:"-"`
}

type DexClientSecret struct {
	ID        string `json:"id"`
	Name      string `json:"name"`
	Namespace string `json:"namespace"`
	Secret    []byte `json:"spec"`
}

type DexGroup struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              DexGroupSpec   `json:"spec"`
	Status            DexGroupStatus `json:"status,omitempty"`
}

type DexGroupMember struct {
	Kind string `json:"kind" yaml:"kind"`
	Name string `json:"name" yaml:"name"`
}

type DexGroupSpec struct {
	Name    string           `json:"name"`
	Members []DexGroupMember `json:"members" yaml:"members"`
}

type DexGroupStatus struct {
	Errors []struct {
		Message   string `json:"message"`
		ObjectRef struct {
			Kind string `json:"kind"`
			Name string `json:"name"`
		} `json:"objectRef"`
	} `json:"errors,omitempty"`
}

type DexProvider map[string]interface{}

type DexProviderBitbucketForCheck struct {
	ClientID     string `json:"clientID"`
	ClientSecret string `json:"clientSecret,omitempty"`
}

type DexProviderCheck struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              DexProviderCheckSpec   `json:"spec"`
	Status            DexProviderCheckStatus `json:"status"`
}

type DexProviderCheckPhase string

type DexProviderCheckSpec struct {
	ProviderName  string `json:"providerName"`
	InitiatorType string `json:"initiatorType,omitempty"`
}

type DexProviderCheckStatus struct {
	Phase                         DexProviderCheckPhase        `json:"phase"`
	Message                       string                       `json:"message,omitempty"`
	ObservedDexProviderGeneration int64                        `json:"observedDexProviderGeneration,omitempty"`
	Checks                        []DexProviderCheckStepStatus `json:"checks,omitempty"`
	CompletedAt                   *metav1.Time                 `json:"completedAt,omitempty"`
}

type DexProviderCheckStepStatus struct {
	Name    string `json:"name"`
	Status  string `json:"status"`
	Message string `json:"message,omitempty"`
}

type DexProviderCrowdForCheck struct {
	BaseURL      string `json:"baseURL"`
	ClientID     string `json:"clientID"`
	ClientSecret string `json:"clientSecret"`
}

type DexProviderForCheck struct {
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              DexProviderForCheckSpec `json:"spec"`
}

type DexProviderForCheckSpec struct {
	Enabled        *bool                         `json:"enabled,omitempty"`
	Type           string                        `json:"type"`
	Github         *DexProviderGithubForCheck    `json:"github,omitempty"`
	Gitlab         *DexProviderGitlabForCheck    `json:"gitlab,omitempty"`
	BitbucketCloud *DexProviderBitbucketForCheck `json:"bitbucketCloud,omitempty"`
	Crowd          *DexProviderCrowdForCheck     `json:"crowd,omitempty"`
	OIDC           *DexProviderOIDCForCheck      `json:"oidc,omitempty"`
	LDAP           *DexProviderLDAPForCheck      `json:"ldap,omitempty"`
	SAML           *DexProviderSAMLForCheck      `json:"saml,omitempty"`
}

type DexProviderGithubForCheck struct {
	ClientID     string `json:"clientID"`
	ClientSecret string `json:"clientSecret,omitempty"`
}

type DexProviderGitlabForCheck struct {
	ClientID     string `json:"clientID,omitempty"`
	ClientSecret string `json:"clientSecret,omitempty"`
	BaseURL      string `json:"baseURL,omitempty"`
	RootCAData   string `json:"rootCAData,omitempty"`
}

type DexProviderLDAPForCheck struct {
	Host               string                           `json:"host"`
	InsecureNoSSL      bool                             `json:"insecureNoSSL,omitempty"`
	StartTLS           bool                             `json:"startTLS,omitempty"`
	RootCAData         string                           `json:"rootCAData,omitempty"`
	InsecureSkipVerify bool                             `json:"insecureSkipVerify,omitempty"`
	BindDN             string                           `json:"bindDN,omitempty"`
	BindPW             string                           `json:"bindPW,omitempty"`
	Kerberos           *DexProviderLDAPKerberosForCheck `json:"kerberos,omitempty"`
}

type DexProviderLDAPKerberosForCheck struct {
	Enabled          bool   `json:"enabled,omitempty"`
	KeytabSecretName string `json:"keytabSecretName,omitempty"`
}

type DexProviderOIDCForCheck struct {
	ClientID           string `json:"clientID,omitempty"`
	ClientSecret       string `json:"clientSecret,omitempty"`
	Issuer             string `json:"issuer"`
	RootCAData         string `json:"rootCAData,omitempty"`
	InsecureSkipVerify bool   `json:"insecureSkipVerify,omitempty"`
}

type DexProviderSAMLForCheck struct {
	SSOURL     string `json:"ssoURL"`
	RootCAData string `json:"rootCAData,omitempty"`
}

type DexUser struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              DexUserSpec   `json:"spec"`
	Status            DexUserStatus `json:"status,omitempty"`
}

type DexUserExpire struct {
	Name     string    `json:"name"`
	ExpireAt time.Time `json:"expireAt"`

	CheckExpire bool `json:"-"`
}

type DexUserInternalValues struct {
	Name        string `json:"name"`
	EncodedName string `json:"encodedName"`

	Spec   DexUserSpec   `json:"spec"`
	Status DexUserStatus `json:"status,omitempty"`

	ExpireAt string `json:"-"`
}

type DexUserLock struct {
	State   bool               `json:"state"`
	Reason  *DexUserLockReason `json:"reason,omitempty"`
	Message *string            `json:"message,omitempty"`
	Until   *string            `json:"until,omitempty"`
}

type DexUserLockReason string

type DexUserSpec struct {
	Email    string   `json:"email"`
	Password string   `json:"password"`
	UserID   string   `json:"userID,omitempty"`
	Groups   []string `json:"groups,omitempty"`
	TTL      string   `json:"ttl,omitempty"`
}

type DexUserStatus struct {
	ExpireAt string      `json:"expireAt,omitempty"`
	Lock     DexUserLock `json:"lock"`
}

type KubernetesSecret []byte

type KubernetesServicePort intstr.IntOrString

type OfflineSessionSnapshot struct {
	Name            string       `json:"name"`
	Namespace       string       `json:"namespace"`
	UserID          string       `json:"userID"`
	ConnID          string       `json:"connID,omitempty"`
	Email           string       `json:"email,omitempty"`
	LockedUntil     *metav1.Time `json:"lockedUntil,omitempty"`
	RefreshTokenIDs []string     `json:"refreshTokenIDs,omitempty"`
}

type Password struct {
	metav1.TypeMeta                 `json:",inline"`
	metav1.ObjectMeta               `json:"metadata,omitempty"`
	Username                        string     `json:"username"`
	Email                           string     `json:"email"`
	UserID                          string     `json:"userID"`
	Hash                            string     `json:"hash"`
	HashUpdatedAt                   string     `json:"hashUpdatedAt,omitempty"`
	PreviousHashes                  []string   `json:"previousHashes,omitempty"`
	IncorrectPasswordLoginAttempts  int        `json:"incorrectPasswordLoginAttempts,omitempty"`
	Groups                          []string   `json:"groups,omitempty"`
	RequireResetHashOnNextSuccLogin bool       `json:"requireResetHashOnNextSuccLogin"`
	LockedUntil                     *time.Time `json:"lockedUntil"`
}

type PublishAPICert struct {
	Name string `json:"name"`
	Data []byte `json:"data"`
}

type PublishAPIConfig struct {
	Name                        string `json:"name"`
	AddKubeconfigGeneratorEntry []byte `json:"addKubeconfigGeneratorEntry"`
	WhitelistSourceRanges       []byte `json:"whitelistSourceRanges"`
	HTTPSMode                   []byte `json:"httpsMode"`
	IngressClass                []byte `json:"ingressClass"`
}

type RefreshTokenSnapshot struct {
	Name            string `json:"name"`
	Namespace       string `json:"namespace"`
	ClaimsUserID    string `json:"claimsUserID,omitempty"`
	ClaimsUsername  string `json:"claimsUsername,omitempty"`
	ClaimsPreferred string `json:"claimsPreferredUsername,omitempty"`
}

type UserOperation struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              UserOperationSpec   `json:"spec"`
	Status            UserOperationStatus `json:"status"`

	// FilterError carries the error produced by applyUserOperationFilter when
	// the raw object could not be decoded into this struct. It is NOT part of
	// the CRD: it travels only inside the hook snapshot (hence a plain json tag
	// so it survives the snapshot round-trip) so getUserOperations can mark this
	// specific object Failed with the exact reason instead of silently dropping
	// it — all without the FilterFunc ever returning an error and locking the
	// queue. It never reaches the API: status patches send only the status field.
	FilterError string `json:"filterError,omitempty"`
}

type UserOperationLockSpec struct {
	// For is either a Go-style duration string accepted by time.ParseDuration
	// (e.g. "30m", "1h", "2h30m"), or the sentinel userOperationLockForever
	// ("permanent") for an indefinite lock. We use a plain string rather than
	// metav1.Duration so the sentinel can travel through (un)marshalling
	// without colliding with time.ParseDuration's grammar.
	For string `json:"for"`
}

type UserOperationResetPasswordSpec struct {
	NewPasswordHash string `json:"newPasswordHash"`
}

type UserOperationSpec struct {
	User          string                `json:"user,omitempty"`
	Target        *UserOperationTarget  `json:"target,omitempty"`
	Type          UserOperationSpecType `json:"type"`
	InitiatorType string                `json:"initiatorType"`

	ResetPassword *UserOperationResetPasswordSpec `json:"resetPassword,omitempty"`
	Lock          *UserOperationLockSpec          `json:"lock,omitempty"`
}

type UserOperationSpecType string

type UserOperationStatus struct {
	Phase       UserOperationStatusPhase `json:"phase"`
	Message     string                   `json:"message,omitempty"`
	CompletedAt *metav1.Time             `json:"completedAt"`
}

type UserOperationStatusPhase string

type UserOperationTarget struct {
	ConnectorID string `json:"connectorID"`
	Email       string `json:"email"`
}