v1

type CrossNamespaceObjectReference struct {
	// API version of the referent
	// +optional
	APIVersion string `json:"apiVersion,omitempty"`

	// Kind of the referent
	// +kubebuilder:validation:Enum=Bucket;GitRepository;Kustomization;HelmRelease;HelmChart;HelmRepository;ImageRepository;ImagePolicy;ImageUpdateAutomation;OCIRepository;ArtifactGenerator;ExternalArtifact
	// +required
	Kind string `json:"kind"`

	// Name of the referent
	// If multiple resources are targeted `*` may be set.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +required
	Name string `json:"name"`

	// Namespace of the referent
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:Optional
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
	// map is equivalent to an element of matchExpressions, whose key field is "key", the
	// operator is "In", and the values array contains only "value". The requirements are ANDed.
	// MatchLabels requires the name to be set to `*`.
	// +optional
	MatchLabels map[string]string `json:"matchLabels,omitempty"`
}

type OIDCProvider struct {
	// IssuerURL is the OIDC issuer URL used for provider discovery. It must
	// match the 'iss' claim of tokens issued by this provider.
	// +kubebuilder:validation:Pattern="^https?://"
	// +required
	IssuerURL string `json:"issuerURL"`

	// Audience is the expected audience ('aud' claim) for tokens issued by
	// this provider. Defaults to 'notification-controller'.
	// +optional
	Audience string `json:"audience,omitempty"`

	// Variables is an optional list of named CEL expressions, evaluated in order
	// and exposed as 'vars.<name>'. Each expression can read the token claims
	// via 'claims' and any variable defined before it. Use it to share
	// sub-expressions across validations.
	// +optional
	Variables []OIDCVariable `json:"variables,omitempty"`

	// Validations is the list of CEL boolean expressions evaluated against the
	// token claims and the variables. The request is accepted only if all of
	// them evaluate to true; the message of each failing expression is returned
	// to the caller.
	//
	// At least one validation is required. A valid signature alone does not
	// authorize a request: public issuers issue tokens to any caller on the
	// platform, so the validations must constrain the caller's identity claims
	// (e.g. 'repository_owner' for GitHub Actions).
	// +kubebuilder:validation:MinItems=1
	// +required
	Validations []OIDCValidation `json:"validations"`
}

type OIDCValidation struct {
	// Expression is the CEL boolean expression to evaluate.
	// +required
	Expression string `json:"expression"`

	// Message is returned to the caller when the expression evaluates to false.
	// +required
	Message string `json:"message"`
}

type OIDCVariable struct {
	// Name is the variable name; it must be a valid CEL identifier.
	// +required
	Name string `json:"name"`

	// Expression is the CEL expression that defines the variable value.
	// +required
	Expression string `json:"expression"`
}

type Receiver struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec ReceiverSpec `json:"spec,omitempty"`
	// +kubebuilder:default:={"observedGeneration":-1}
	Status ReceiverStatus `json:"status,omitempty"`
}

type ReceiverList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Receiver `json:"items"`
}

type ReceiverResource struct {
	CrossNamespaceObjectReference `json:",inline"`

	// Filter is a CEL expression expected to return a boolean that is evaluated
	// for each resource matched by this reference when a webhook is received,
	// in addition to the top-level resourceFilter. A reconciliation is requested
	// only when both expressions (when set) return true.
	// The expression can read the resource metadata via 'res' and the webhook
	// request body via 'req'. For generic-oidc receivers, the verified OIDC
	// token claims are also available via 'claims'.
	// When the expression is specified the controller will parse it and mark
	// the object as terminally failed if the expression is invalid or does not
	// return a boolean.
	// +optional
	Filter string `json:"filter,omitempty"`
}

type ReceiverSpec struct {
	// Type of webhook sender, used to determine
	// the validation procedure and payload deserialization.
	// +kubebuilder:validation:Enum=generic;generic-hmac;generic-oidc;github;gitlab;bitbucket;harbor;dockerhub;quay;gcr;nexus;acr;cdevents
	// +required
	Type string `json:"type"`

	// Interval at which to reconcile the Receiver with its Secret references.
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"
	// +kubebuilder:default:="10m"
	// +optional
	Interval *metav1.Duration `json:"interval,omitempty"`

	// Events specifies the list of event types to handle,
	// e.g. 'push' for GitHub or 'Push Hook' for GitLab.
	// +optional
	Events []string `json:"events,omitempty"`

	// A list of resources to be notified about changes.
	// +required
	Resources []ReceiverResource `json:"resources"`

	// ResourceFilter is a CEL expression expected to return a boolean that is
	// evaluated for each resource referenced in the Resources field when a
	// webhook is received. If the expression returns false then the controller
	// will not request a reconciliation for the resource.
	// The expression can read the resource metadata via 'res' and the webhook
	// request body via 'req'. For generic-oidc receivers, the verified OIDC
	// token claims are also available via 'claims'.
	// When the expression is specified the controller will parse it and mark
	// the object as terminally failed if the expression is invalid or does not
	// return a boolean.
	// +optional
	ResourceFilter string `json:"resourceFilter,omitempty"`

	// SecretRef specifies the Secret containing the token used
	// to validate the payload authenticity. The Secret must contain a 'token'
	// key. For GCR receivers, the Secret must also contain an 'email' key
	// with the IAM service account email configured on the Pub/Sub push
	// subscription, and an 'audience' key with the expected OIDC token audience.
	//
	// Required for all receiver types except 'generic-oidc', which authenticates
	// requests using the OIDC token instead and must not set this field.
	// +optional
	SecretRef *meta.LocalObjectReference `json:"secretRef,omitempty"`

	// OIDCProviders specifies the OIDC providers used to authenticate incoming
	// requests when Type is 'generic-oidc'. The provider whose IssuerURL matches
	// the token's 'iss' claim is used to verify the token signature, expiration
	// and audience, and to evaluate the configured CEL validations against the
	// token claims.
	// +listType=map
	// +listMapKey=issuerURL
	// +optional
	OIDCProviders []OIDCProvider `json:"oidcProviders,omitempty"`

	// Suspend tells the controller to suspend subsequent
	// events handling for this receiver.
	// +optional
	Suspend bool `json:"suspend,omitempty"`
}

type ReceiverStatus struct {
	meta.ReconcileRequestStatus `json:",inline"`

	// Conditions holds the conditions for the Receiver.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// WebhookPath is the generated incoming webhook address in the format
	// of '/hook/sha256sum(token+name+namespace)'.
	// +optional
	WebhookPath string `json:"webhookPath,omitempty"`

	// ObservedGeneration is the last observed generation of the Receiver object.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}