v1alpha1

type AgentCredential struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AgentCredentialSpec   `json:"spec,omitempty"`
	Status AgentCredentialStatus `json:"status,omitempty"`
}

type AgentCredentialList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AgentCredential `json:"items"`
}

type AgentCredentialSpec struct {
	// Backend is the observability backend this credential grants access to
	// (metrics → Mimir, logs → Loki, traces → Tempo). Drives which gateway's
	// htpasswd Secret this credential is aggregated into.
	Backend CredentialBackend `json:"backend"`

	// AgentName identifies the telemetry agent this credential belongs to.
	// Used as the basic-auth username in the generated Secret and htpasswd entry.
	// RFC 7617 forbids ':' in basic-auth usernames.
	// +kubebuilder:validation:Pattern="^[a-zA-Z0-9][a-zA-Z0-9_-]{0,252}$"
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	AgentName string `json:"agentName"`

	// SecretName overrides the generated Secret name. Defaults to metadata.name.
	// Must be a valid DNS-1123 subdomain.
	// +optional
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:Pattern="^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
	SecretName string `json:"secretName,omitempty"`
}

type AgentCredentialStatus struct {
	// SecretRef points to the rendered Secret in the same namespace.
	// +optional
	SecretRef *corev1.LocalObjectReference `json:"secretRef,omitempty"`

	// Conditions represent the latest available observations of the credential's state.
	// Types: Ready (secret rendered), GatewaySynced (htpasswd aggregated).
	// +optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type CredentialBackend string

type DataSource struct {
	// ID is the unique id of the data source.
	ID int64 `json:"ID"`

	// Name is the name of the data source.
	Name string `json:"name"`
}

type GrafanaOrganization struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   GrafanaOrganizationSpec   `json:"spec,omitempty"`
	Status GrafanaOrganizationStatus `json:"status,omitempty"`
}

type GrafanaOrganizationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []GrafanaOrganization `json:"items"`
}

type GrafanaOrganizationSpec struct {
	// DisplayName is the name displayed when viewing the organization in Grafana. It can be different from the actual org's name.
	// +kubebuilder:example="Giant Swarm"
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:unique=true
	DisplayName string `json:"displayName"`

	// Access rules defines user permissions for interacting with the organization in Grafana.
	RBAC *RBAC `json:"rbac"`

	// Tenants is a list of tenants that are associated with the Grafana organization.
	// +kubebuilder:example={"giantswarm"}
	// +kube:validation:MinItems=1
	Tenants []TenantID `json:"tenants"`
}

type GrafanaOrganizationStatus struct {
	// OrgID is the actual organisation ID in grafana.
	// +optional
	OrgID int64 `json:"orgID"`

	// DataSources is a list of grafana data sources that are available to the Grafana organization.
	// +optional
	DataSources []DataSource `json:"dataSources"`

	// DisplayName records the last display name successfully applied to the Grafana
	// organization referenced by OrgID.
	// +optional
	DisplayName string `json:"displayName,omitempty"`
}

type RBAC struct {
	// Admins is a list of user organizations that have admin access to the grafanaorganization.
	Admins []string `json:"admins"`

	// Editors is a list of user organizations that have editor access to the grafanaorganization.
	// +optional
	Editors []string `json:"editors"`

	// Viewers is a list of user organizations that have viewer access to the grafanaorganization.
	// +optional
	Viewers []string `json:"viewers"`
}

type TenantID string