v1alpha1

type AWSSDKAuth struct {
	AuthMethod string `json:"authMethod"`

	Region string `json:"region"`

	ServiceAccount *ServiceAccountSelector `json:"serviceAccountRef,omitempty"`

	SecretRef *AWSSDKSecretRef `json:"secretRef,omitempty"`
}

type AWSSDKSecretRef struct {
	AccessKeyId     SecretKeySelector `json:"accessKeyIdSecretRef"`
	SecretAccessKey SecretKeySelector `json:"secretAccessKeySecretRef"`
}

type AWSSQSConfig struct {
	// QueueURL is the URL of the AWS SDK queue.
	// +required
	QueueURL string `json:"queueURL"`

	// Authentication methods for AWS.
	// +required
	Auth AWSSDKAuth `json:"auth"`

	// MaxNumberOfMessages specifies the maximum number of messages to retrieve from the SDK queue in a single request.
	// +optional
	// +kubebuilder:default=10
	MaxNumberOfMessages int32 `json:"numberOfMessages"`

	// WaitTimeSeconds specifies the duration (in seconds) to wait for messages in the SDK queue before returning.
	// +optional
	// +kubebuilder:default=20
	WaitTimeSeconds int32 `json:"waitTimeSeconds"`

	// VisibilityTimeout specifies the duration (in seconds) that a message received from the SDK queue is hidden from subsequent retrievals.
	// +optional
	// +kubebuilder:default=30
	VisibilityTimeout int32 `json:"visibilityTimeout"`
}

type AzureEventGridConfig struct {
	Host string `json:"host"`

	// +required
	// +kubebuilder:default=8080
	Port int32 `json:"port"`

	Subscriptions []string `json:"subscriptions"`
}

type BasicAuth struct {
	// UsernameSecretRef contains a secret reference for the username
	// +required
	UsernameSecretRef SecretKeySelector `json:"usernameSecretRef,omitempty"`

	// PasswordSecretRef contains a secret reference for the password
	// +required
	PasswordSecretRef SecretKeySelector `json:"passwordSecretRef,omitempty"`
}

type BearerToken struct {
	// BearerTokenSecretRef references a Kubernetes Secret containing the bearer token.
	// +required
	BearerTokenSecretRef SecretKeySelector `json:"bearerTokenSecretRef"`
}

type Condition struct {
	Value     string             `json:"value"`
	Operation ConditionOperation `json:"operation"`
}

type ConditionOperation string

type Config struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ConfigSpec   `json:"spec,omitempty"`
	Status ConfigStatus `json:"status,omitempty"`
}

type ConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Config `json:"items"`
}

type ConfigSpec struct {
	// NotificationSources specifies the notification systems to listen to.
	// +required
	NotificationSources []NotificationSource `json:"notificationSources"`

	// DestinationsToWatch specifies which secrets the controller should monitor.
	// +required
	DestinationsToWatch []DestinationToWatch `json:"destinationsToWatch"`
}

type ConfigStatus struct {
	// Conditions represent the latest available observations of the resource's state.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type DeploymentDestination struct {
	// NamespaceSelectors selects namespaces based on labels.
	// The manifest must reside in a namespace that matches at least one of these selectors.
	// +optional
	NamespaceSelectors []metav1.LabelSelector `json:"namespaceSelectors,omitempty"`

	// LabelSelectors selects resources based on their labels.
	// The resource must satisfy all conditions defined in this selector.
	// Supports both matchLabels and matchExpressions for advanced filtering.
	// +optional
	LabelSelectors *metav1.LabelSelector `json:"labelSelectors,omitempty"`

	// Names specifies a list of resource names to watch.
	// The resource must have a name that matches one of these entries.
	// +optional
	Names []string `json:"names,omitempty"`
}

type DestinationToWatch struct {
	// Type specifies the type of destination to watch.
	// +required
	// +kubebuilder:validation:Enum=ExternalSecret;Deployment;PushSecret;WorkflowRunTemplate
	Type string `json:"type"`
	// +optional
	WorkflowRunTemplate *WorkflowRunTemplateDestination `json:"workflowRunTemplate,omitempty"`
	// +optional
	ExternalSecret *ExternalSecretDestination `json:"externalSecret,omitempty"`
	// +optional
	PushSecret *PushSecretDestination `json:"pushSecret,omitempty"`
	// +optional
	Deployment *DeploymentDestination `json:"deployment,omitempty"`
	//UpdateStrategy. If not specified, will use each destinations' default update strategy.
	UpdateStrategy *UpdateStrategy `json:"updateStrategy,omitempty"`
	//MatchStrategy. If not specified, will use each destinations' default match strategy.
	// +optional
	MatchStrategy *MatchStrategy `json:"matchStrategy,omitempty"`
	//WaitStrategy. If not specified, will use each destinations's default wait strategy.
	// +optional
	WaitStrategy *WaitStrategy `json:"waitStrategy,omitempty"`
}

type ExternalSecretDestination struct {
	// NamespaceSelectors selects namespaces based on labels.
	// The manifest must reside in a namespace that matches at least one of these selectors.
	// +optional
	NamespaceSelectors []metav1.LabelSelector `json:"namespaceSelectors,omitempty"`

	// LabelSelectors selects resources based on their labels.
	// The resource must satisfy all conditions defined in this selector.
	// Supports both matchLabels and matchExpressions for advanced filtering.
	// +optional
	LabelSelectors *metav1.LabelSelector `json:"labelSelectors,omitempty"`

	// Names specifies a list of resource names to watch.
	// The resource must have a name that matches one of these entries.
	// +optional
	Names []string `json:"names,omitempty"`
}

type GCPSMAuthSecretRef struct {
	// The SecretAccessKey is used for authentication
	// +optional
	SecretAccessKey SecretKeySelector `json:"secretAccessKeySecretRef,omitempty"`
}

type GCPWorkloadIdentity struct {
	ServiceAccountRef ServiceAccountSelector `json:"serviceAccountRef"`
	ClusterLocation   string                 `json:"clusterLocation"`
	ClusterName       string                 `json:"clusterName"`
	ClusterProjectID  string                 `json:"clusterProjectID,omitempty"`
}

type GooglePubSubAuth struct {
	// +optional
	SecretRef *GCPSMAuthSecretRef `json:"secretRef,omitempty"`
	// +optional
	WorkloadIdentity *GCPWorkloadIdentity `json:"workloadIdentity,omitempty"`
}

type GooglePubSubConfig struct {
	// SubscriptionID is the ID of the Pub/Sub subscription.
	// +required
	SubscriptionID string `json:"subscriptionID"`

	// ProjectID is the GCP project ID where the subscription exists.
	// +required
	ProjectID string `json:"projectID"`

	// Authentication methods for Google Pub/Sub.
	// +optional
	Auth *GooglePubSubAuth `json:"auth,omitempty"`
}

type HashicorpVaultConfig struct {
	// Host is the hostname or IP address to listen on.
	// +required
	Host string `json:"host"`

	// Port is the port number to listen on.
	// +required
	// +kubebuilder:default=8000
	Port int32 `json:"port"`
}

type KubeConfigRef struct {
	SecretRef SecretKeySelector `json:"secretRef"`
}

type KubernetesAuth struct {
	//+optional
	KubeConfigRef *KubeConfigRef `json:"kubeConfigRef,omitempty"`
	// Defines a CABundle if either TokenRef or ServiceAccountRef are used.
	// +optional
	CABundle string `json:"caBundle,omitempty"`
	//+optional
	TokenRef *TokenRef `json:"tokenRef,omitempty"`
	//+optional
	ServiceAccountRef *ServiceAccountSelector `json:"serviceAccountRef,omitempty"`
}

type KubernetesConfigMapConfig struct {
	// Server URL
	// +required
	ServerURL string `json:"serverURL"`

	// How to authenticate with Kubernetes cluster. If not specified, the default config is used.
	// +optional
	Auth *KubernetesAuth `json:"auth,omitempty"`

	// LabelSelector can be used to identify and narrow down secrets for watching.
	LabelSelector *metav1.LabelSelector `json:"labelSelector,omitempty"`
}

type KubernetesObjectConfig struct {
	// Server URL
	// +required
	ServerURL string `json:"serverURL"`

	// How to authenticate with Kubernetes cluster. If not specified, the default config is used.
	// +optional
	Auth *KubernetesAuth `json:"auth,omitempty"`

	// LabelSelector can be used to identify and narrow down secrets for watching.
	LabelSelector *metav1.LabelSelector `json:"labelSelector,omitempty"`
}

type KubernetesSecretConfig struct {
	// Server URL
	// +required
	ServerURL string `json:"serverURL"`

	// How to authenticate with Kubernetes cluster. If not specified, the default config is used.
	// +optional
	Auth *KubernetesAuth `json:"auth,omitempty"`

	// LabelSelector can be used to identify and narrow down secrets for watching.
	LabelSelector *metav1.LabelSelector `json:"labelSelector,omitempty"`
}

type MatchStrategy struct {
	Path       string      `json:"path"`
	Conditions []Condition `json:"conditions"`
}

type MockConfig struct {
	EmitInterval int32 `json:"emitInterval"`
}

type NotificationSource struct {
	// Type of the notification source (e.g., AwsSqs, AzureEventGrid, GooglePubSub, HashicorpVault, Webhook, TCPSocket, KubernetesSecret, KubernetesConfigMap).
	// +kubebuilder:validation:Enum=AwsSqs;AzureEventGrid;GooglePubSub;HashicorpVault;Webhook;TCPSocket;KubernetesSecret;KubernetesConfigMap
	// +required
	Type string `json:"type"`

	// AwsSqs configuration (required if Type is AwsSqs).
	// +optional
	AwsSqs *AWSSQSConfig `json:"awsSqs,omitempty"`

	AzureEventGrid *AzureEventGridConfig `json:"azureEventGrid,omitempty"`

	// GooglePubSub configuration (required if Type is GooglePubSub).
	// +optional
	GooglePubSub *GooglePubSubConfig `json:"googlePubSub,omitempty"`

	// Webhook configuration (required if Type is Webhook).
	// +optional
	Webhook *WebhookConfig `json:"webhook,omitempty"`

	// HashicorpVault configuration (required if Type is HashicorpVault).
	// +optional
	HashicorpVault *HashicorpVaultConfig `json:"hashicorpVault,omitempty"`

	// Kubernetes Secret watch configuration (required if Type is KubernetesSecret).
	// +optional
	KubernetesSecret *KubernetesSecretConfig `json:"kubernetesSecret,omitempty"`

	// Kubernetes ConfigMap watch configuration (required if Type is KubernetesConfigMap).
	// +optional
	KubernetesConfigMap *KubernetesConfigMapConfig `json:"kubernetesConfigMap,omitempty"`

	// TCPSocket configuration (required if Type is TCPSocket).
	// +optional
	TCPSocket *TCPSocketConfig `json:"tcpSocket,omitempty"`

	// Mock configuration (optional field for testing purposes).
	Mock *MockConfig `json:"mock,omitempty"`
}

type PatchOperationConfig struct {
	Path     string `json:"path"`
	Template string `json:"template"`
}

type PushSecretDestination struct {
	// NamespaceSelectors selects namespaces based on labels.
	// The manifest must reside in a namespace that matches at least one of these selectors.
	// +optional
	NamespaceSelectors []metav1.LabelSelector `json:"namespaceSelectors,omitempty"`

	// LabelSelectors selects resources based on their labels.
	// The resource must satisfy all conditions defined in this selector.
	// Supports both matchLabels and matchExpressions for advanced filtering.
	// +optional
	LabelSelectors *metav1.LabelSelector `json:"labelSelectors,omitempty"`

	// Names specifies a list of resource names to watch.
	// The resource must have a name that matches one of these entries.
	// +optional
	Names []string `json:"names,omitempty"`
}

type RetryPolicy struct {
	// MaxRetries represents the maximum times the reloader should retry to process a message. Numbers greater than 10 will be ignored and 10 will be used instead
	// +optional
	MaxRetries int `json:"maxRetries"`

	// Algorithm represents how watiting time will change for each retry.
	// Currently supports "linear" and "exponential". If an invalid string or null is given, "exponential" will be used
	// +optional
	Algorithm string `json:"algorithm"`
}

type SecretKeySelector struct {

	// Name specifies the name of the referenced Kubernetes secret.
	// +required
	Name string `json:"name"`

	// Key specifies the key within the referenced Kubernetes secret.
	// +required
	Key string `json:"key"`

	// Namespace specifies the Kubernetes namespace where the referenced secret resides.
	// +required
	Namespace string `json:"namespace"`
}

type ServiceAccountSelector struct {

	// Name specifies the name of the service account to be selected.
	// +required
	Name string `json:"name"`

	// ServiceAccountSelector represents a Kubernetes service account with a name and namespace for selection purposes.
	// +required
	Namespace string `json:"namespace"`
	// Audience specifies the `aud` claim for the service account token
	// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
	// then this audiences will be appended to the list
	// +optional
	Audiences []string `json:"audiences,omitempty"`
}

type TCPSocketConfig struct {
	// Host is the hostname or IP address to listen on.
	// +required
	Host string `json:"host"`

	// Port is the port number to listen on.
	// +required
	// +kubebuilder:default=8000
	Port int32 `json:"port"`

	// SecretIdentifierOnPayload is the key that the reloader will look for in the payload.
	// The value of this key should be the same name as in the external secret. It will default to `0.data.ObjectName` if not set
	SecretIdentifierOnPayload string `json:"identifierPathOnPayload,omitempty"`
}

type TokenRef struct {
	SecretRef SecretKeySelector `json:"secretRef"`
}

type UpdateStrategy struct {
	Operation UpdateStrategyOperation `json:"operation"`
	// Required if Operation == Patch
	PatchOperationConfig *PatchOperationConfig `json:"patchOperationConfig,omitempty"`
}

type UpdateStrategyOperation string

type WaitForCondition struct {
	// Period to wait before each retry
	//+optional
	RetryTimeout *metav1.Duration `json:"retryTimeout,omitempty"`
	// Maximum retries to check for a condition
	//+optional
	MaxRetries *int32 `json:"maxRetries,omitempty"`
	// The name of the condition to wait for
	//+required
	Type string `json:"type"`
	// The status of the condition to wait for
	//+optional
	Status string `json:"status"`
	// Optional message to match
	//+optional
	Message string `json:"message,omitempty"`
	// Optional reason to match
	//+optional
	Reason string `json:"reason,omitempty"`
	// Only accept this condition after a given period from the transition time
	//+optional
	TransitionedAfter *metav1.Duration `json:"transitionedAfter,omitempty"`
	// Only accept this condition after a given period from the update time
	//+optional
	UpdatedAfter *metav1.Duration `json:"updatedAfter,omitempty"`
}

type WaitStrategy struct {
	// Waits for a given time interval to reconcile the next object
	//+optional
	Time *metav1.Duration `json:"time,omitempty"`
	// Waits for a given status condition to be met
	//+optional
	Condition *WaitForCondition `json:"condition,omitempty"`
}

type WebhookAuth struct {
	// BasicAuth contains basic authentication credentials.
	// +optional
	BasicAuth *BasicAuth `json:"basicAuth,omitempty"`

	// BearerToken references a Kubernetes Secret containing the bearer token.
	// +optional
	BearerToken *BearerToken `json:"bearerToken,omitempty"`
}

type WebhookConfig struct {
	// Path that the webhook will receive the notifications.
	// If not present `/webhook` will be used. The path always expects a POST and this is not configurable
	// +optional
	Path string `json:"path"`

	// Address is the address where the webhook will be served in your infrastructure.
	// If not present, defaults to `:8090`
	// +optional
	Address string `json:"address"`

	// SecretIdentifierOnPayload is the key that the reloader will look for in the payload.
	// The value of this key should be the same name as in the external secret. It will default to `0.data.ObjectName` if not set
	// +optional
	SecretIdentifierOnPayload string `json:"identifierPathOnPayload,omitempty"`

	// Auth is the authentication method for the webhook
	// +optional
	Auth *WebhookAuth `json:"webhookAuth,omitempty"`

	// RetryPolicy represents the policy to retry when a message fails.
	// If it's empty, reloader will return a 4xx and won't retry.
	// +optional
	RetryPolicy *RetryPolicy `json:"retryPolicy,omitempty"`
}

type WorkflowRunTemplateDestination struct {
	// NamespaceSelectors selects namespaces based on labels.
	// The manifest must reside in a namespace that matches at least one of these selectors.
	// +optional
	NamespaceSelectors []metav1.LabelSelector `json:"namespaceSelectors,omitempty"`

	// LabelSelectors selects resources based on their labels.
	// The resource must satisfy all conditions defined in this selector.
	// Supports both matchLabels and matchExpressions for advanced filtering.
	// +optional
	LabelSelectors *metav1.LabelSelector `json:"labelSelectors,omitempty"`

	// Names specifies a list of resource names to watch.
	// The resource must have a name that matches one of these entries.
	// +optional
	Names []string `json:"names,omitempty"`
}