vault

type CachingClientFactory interface {
	ClientFactory
	Restore(context.Context, ctrlclient.Client, ctrlclient.Object) (Client, error)
	RestoreAll(context.Context, ctrlclient.Client) error
	Prune(context.Context, ctrlclient.Client, ctrlclient.Object, CachingClientFactoryPruneRequest) (int, error)
}

type CachingClientFactoryConfig struct {
	Persist                   bool
	StorageConfig             *ClientCacheStorageConfig
	ClientCacheSize           int
	CollectClientCacheMetrics bool
	Recorder                  record.EventRecorder
	MetricsRegistry           prometheus.Registerer
}

type CachingClientFactoryPruneRequest struct {
	FilterFunc   clientCacheObjectFilterFunc
	PruneStorage bool
}

type Client interface {
	ClientBase
	Init(context.Context, ctrlclient.Client, *secretsv1beta1.VaultAuth, *secretsv1beta1.VaultConnection, string, *ClientOptions) error
	Login(context.Context, ctrlclient.Client) error
	Restore(context.Context, *api.Secret) error
	GetTokenSecret() *api.Secret
	CheckExpiry(int64) (bool, error)
	Validate() error
	GetVaultAuthObj() *secretsv1beta1.VaultAuth
	GetVaultConnectionObj() *secretsv1beta1.VaultConnection
	GetCredentialProvider() credentials.CredentialProvider
	GetCacheKey() (ClientCacheKey, error)
	Close()
	Clone(string) (Client, error)
	IsClone() bool
	Namespace() string
	SetNamespace(string)
}

type ClientBase interface {
	Read(context.Context, string) (*api.Secret, error)
	Write(context.Context, string, map[string]any) (*api.Secret, error)
	KVv1(string) (*api.KVv1, error)
	KVv2(string) (*api.KVv2, error)
}

type ClientCache interface {
	Get(ClientCacheKey) (Client, bool)
	Add(Client) (bool, error)
	Remove(ClientCacheKey) bool
	Len() int
	Prune(filterFunc ClientCachePruneFilterFunc) []ClientCacheKey
	Contains(key ClientCacheKey) bool
}

type ClientCacheKey string

type ClientCachePruneFilterFunc func(Client) bool

type ClientCacheStorage interface {
	Store(context.Context, ctrlclient.Client, ClientCacheStorageStoreRequest) (*corev1.Secret, error)
	Restore(context.Context, ctrlclient.Client, ClientCacheStorageRestoreRequest) (*clientCacheStorageEntry, error)
	RestoreAll(context.Context, ctrlclient.Client, ClientCacheStorageRestoreAllRequest) ([]*clientCacheStorageEntry, error)
	Prune(context.Context, ctrlclient.Client, ClientCacheStoragePruneRequest) (int, error)
	Purge(context.Context, ctrlclient.Client) error
	Len(context.Context, ctrlclient.Client) (int, error)
}

type ClientCacheStorageConfig struct {
	// EnforceEncryption for persisting Clients i.e. the controller must have VaultTransitRef
	// configured before it will persist the Client to storage. This option requires Persist to be true.
	EnforceEncryption bool
	HMACSecretObjKey  ctrlclient.ObjectKey
}

type ClientCacheStoragePruneRequest struct {
	MatchingLabels ctrlclient.MatchingLabels
	Filter         PruneFilterFunc
}

type ClientCacheStorageRestoreAllRequest struct {
	DecryptionClient    Client
	DecryptionVaultAuth *secretsv1beta1.VaultAuth
}

type ClientCacheStorageRestoreRequest struct {
	SecretObjKey        ctrlclient.ObjectKey
	CacheKey            ClientCacheKey
	DecryptionClient    Client
	DecryptionVaultAuth *secretsv1beta1.VaultAuth
}

type ClientCacheStorageStoreRequest struct {
	OwnerReferences     []metav1.OwnerReference
	Client              Client
	EncryptionClient    Client
	EncryptionVaultAuth *secretsv1beta1.VaultAuth
}

type ClientConfig struct {
	// CACertSecretRef is the name of a k8 secret that contains a data key
	// "ca.crt" that holds a CA cert that can be used to validate the
	// certificate presented by the Vault server
	CACertSecretRef string
	// K8sNamespace the namespace of the CACertSecretRef secret
	K8sNamespace string
	// Address is the URL of the Vault server
	Address string
	// SkipTLSVerify controls whether the Vault server's TLS certificate is
	// verified
	SkipTLSVerify bool
	// TLSServerName is the name to use as the SNI host when connecting via TLS
	// to Vault
	TLSServerName string
	// VaultNamespace is the namespace in Vault to auth to
	VaultNamespace string
}

type ClientFactory interface {
	Get(context.Context, ctrlclient.Client, ctrlclient.Object) (Client, error)
}

type ClientOptions struct {
	SkipRenewal bool
}

type HMACValidator interface {
	HMAC(context.Context, ctrlclient.Client, []byte) ([]byte, error)
	Validate(context.Context, ctrlclient.Client, []byte, []byte) (bool, []byte, error)
}

type PKICertResponse struct {
	CAChain        []string `json:"ca_chain"`
	Certificate    string   `json:"certificate"`
	Expiration     int64    `json:"expiration"`
	IssuingCa      string   `json:"issuing_ca"`
	PrivateKey     string   `json:"private_key"`
	PrivateKeyType string   `json:"private_key_type"`
	SerialNumber   string   `json:"serial_number"`
}

type PruneFilterFunc func(secret corev1.Secret) bool