v1alpha1

type AccountLimits struct {
	// Conn is the maximum number of connections (-1 for unlimited)
	// +kubebuilder:default=-1
	Conn int64 `json:"conn,omitempty"`

	// Subs is the maximum number of subscriptions (-1 for unlimited)
	// +kubebuilder:default=-1
	Subs int64 `json:"subs,omitempty"`

	// Payload is the maximum message payload size in bytes (-1 for unlimited)
	// +kubebuilder:default=-1
	Payload int64 `json:"payload,omitempty"`

	// Data is the maximum data size in bytes (-1 for unlimited)
	// +kubebuilder:default=-1
	Data int64 `json:"data,omitempty"`

	// Exports is the maximum number of exports (-1 for unlimited)
	// +kubebuilder:default=-1
	Exports int64 `json:"exports,omitempty"`

	// Imports is the maximum number of imports (-1 for unlimited)
	// +kubebuilder:default=-1
	Imports int64 `json:"imports,omitempty"`

	// WildcardExports whether wildcards are allowed in exports
	// +kubebuilder:default=true
	WildcardExports bool `json:"wildcardExports,omitempty"`

	// JetStream defines JetStream-specific limits
	JetStream *JetStreamLimits `json:"jetstream,omitempty"`
}

type AuthMode string

type JWTConfig struct {
	// ResolverDir is the directory path where the resolver is stored
	// +kubebuilder:default="/var/lib/nats-resolver"
	ResolverDir string `json:"resolverDir,omitempty"`

	// OperatorSeedSecret references an existing operator seed (optional)
	OperatorSeedSecret *OperatorSeedSecretRef `json:"operatorSeedSecret,omitempty"`

	// OperatorName is the name of the NATS operator
	// +kubebuilder:default="NATS Operator"
	OperatorName string `json:"operatorName,omitempty"`

	// SystemAccountName is the name of the NatsAccount resource that serves as the
	// NATS system account. If the named NatsAccount does not exist, the operator will
	// create it automatically. Defaults to "<authconfig-name>-system-account", which
	// avoids collisions when multiple NatsAuthConfig resources exist in the same namespace.
	// Set this explicitly only when migrating from a manually-created system account.
	SystemAccountName string `json:"systemAccountName,omitempty"`
}

type JetStreamLimits struct {
	// MemoryStorage is the max number of bytes stored in memory across all streams (-1 for unlimited, 0 to disable)
	MemoryStorage int64 `json:"memoryStorage,omitempty"`

	// DiskStorage is the max number of bytes stored on disk across all streams (-1 for unlimited, 0 to disable)
	DiskStorage int64 `json:"diskStorage,omitempty"`

	// Streams is the maximum number of streams (-1 for unlimited)
	Streams int64 `json:"streams,omitempty"`

	// Consumer is the maximum number of consumers (-1 for unlimited)
	Consumer int64 `json:"consumer,omitempty"`

	// MaxAckPending is the maximum number of outstanding acks per stream (-1 for unlimited)
	MaxAckPending int64 `json:"maxAckPending,omitempty"`

	// MemoryMaxStreamBytes is the max bytes a memory backed stream can have (-1 for unlimited, 0 to disable)
	MemoryMaxStreamBytes int64 `json:"memoryMaxStreamBytes,omitempty"`

	// DiskMaxStreamBytes is the max bytes a disk backed stream can have (-1 for unlimited, 0 to disable)
	DiskMaxStreamBytes int64 `json:"diskMaxStreamBytes,omitempty"`

	// MaxBytesRequired requires max_bytes to be set when creating streams
	MaxBytesRequired bool `json:"maxBytesRequired,omitempty"`
}

type NatsAccount struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   NatsAccountSpec   `json:"spec,omitempty"`
	Status NatsAccountStatus `json:"status,omitempty"`
}

type NatsAccountList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []NatsAccount `json:"items"`
}

type NatsAccountRef struct {
	// Name of the NatsAccount
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// Namespace of the NatsAccount (defaults to same namespace)
	Namespace string `json:"namespace,omitempty"`
}

type NatsAccountSpec struct {
	// AuthConfigRef references the NatsAuthConfig
	// +kubebuilder:validation:Required
	AuthConfigRef NatsAuthConfigRef `json:"authConfigRef"`

	// Description of the account
	Description string `json:"description,omitempty"`

	// Limits defines resource limits for this account
	Limits *AccountLimits `json:"limits,omitempty"`

	// ExistingSeedSecret references an existing account seed (optional)
	ExistingSeedSecret *SecretRef `json:"existingSeedSecret,omitempty"`
}

type NatsAccountStatus struct {
	// AccountID is the public key of the account
	AccountID string `json:"accountId,omitempty"`

	// PublicKey is the public key of the account (same as AccountID)
	PublicKey string `json:"publicKey,omitempty"`

	// JWTSecretRef references the Secret containing the account JWT
	JWTSecretRef SecretRef `json:"jwtSecretRef,omitempty"`

	// Conditions represent the latest available observations of the object's state
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration reflects the generation of the most recently observed NatsAccount
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// LastReconciled is the timestamp of the last reconciliation
	LastReconciled *metav1.Time `json:"lastReconciled,omitempty"`
}

type NatsAuthConfig struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   NatsAuthConfigSpec   `json:"spec,omitempty"`
	Status NatsAuthConfigStatus `json:"status,omitempty"`
}

type NatsAuthConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []NatsAuthConfig `json:"items"`
}

type NatsAuthConfigRef struct {
	// Name of the NatsAuthConfig
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// Namespace of the NatsAuthConfig (defaults to same namespace)
	Namespace string `json:"namespace,omitempty"`
}

type NatsAuthConfigSpec struct {
	// NatsURL is the URL for NATS clients to connect
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Pattern=`^nats://.*`
	NatsURL string `json:"natsURL"`

	// Mode defines the authentication mode (token, jwt, or mixed)
	// +kubebuilder:validation:Required
	// +kubebuilder:default="jwt"
	Mode AuthMode `json:"mode"`

	// ServerAuthConfig defines where to write the server auth configuration
	// +kubebuilder:validation:Required
	ServerAuthConfig ServerAuthConfigRef `json:"serverAuthConfig"`

	// JWT configuration (required if mode is jwt or mixed)
	JWT *JWTConfig `json:"jwt,omitempty"`
}

type NatsAuthConfigStatus struct {
	// OperatorPubKey is the public key of the NATS operator (JWT mode)
	OperatorPubKey string `json:"operatorPubKey,omitempty"`

	// SystemAccountPubKey is the public key of the auto-managed system account (JWT mode)
	SystemAccountPubKey string `json:"systemAccountPubKey,omitempty"`

	// ResolverReady indicates if the resolver is ready (JWT mode)
	ResolverReady bool `json:"resolverReady,omitempty"`

	// LastReconciled is the timestamp of the last reconciliation
	LastReconciled *metav1.Time `json:"lastReconciled,omitempty"`

	// Conditions represent the latest available observations of the object's state
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration reflects the generation of the most recently observed NatsAuthConfig
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type NatsUser struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   NatsUserSpec   `json:"spec,omitempty"`
	Status NatsUserStatus `json:"status,omitempty"`
}

type NatsUserList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []NatsUser `json:"items"`
}

type NatsUserSpec struct {
	// AuthConfigRef references the NatsAuthConfig
	// +kubebuilder:validation:Required
	AuthConfigRef NatsAuthConfigRef `json:"authConfigRef"`

	// AuthType defines the authentication type (token, jwt, or inherit from NatsAuthConfig)
	// +kubebuilder:default="inherit"
	AuthType UserAuthType `json:"authType,omitempty"`

	// AccountRef references the NatsAccount (required for JWT mode)
	AccountRef *NatsAccountRef `json:"accountRef,omitempty"`

	// Username for token-based auth
	Username string `json:"username,omitempty"`

	// PasswordFrom defines how to obtain the password (for token auth)
	PasswordFrom *PasswordSource `json:"passwordFrom,omitempty"`

	// Permissions defines publish/subscribe permissions
	Permissions *Permissions `json:"permissions,omitempty"`

	// ExistingSeedSecret references an existing user seed (optional, JWT mode)
	ExistingSeedSecret *SecretRef `json:"existingSeedSecret,omitempty"`
}

type NatsUserStatus struct {
	// State represents the current state of the user
	// +kubebuilder:default="Pending"
	State UserState `json:"state,omitempty"`

	// Reason provides more detail about the current state
	Reason string `json:"reason,omitempty"`

	// SecretRef references the Secret containing user credentials
	SecretRef SecretRef `json:"secretRef,omitempty"`

	// PublicKey is the public key of the user (JWT mode)
	PublicKey string `json:"publicKey,omitempty"`

	// Conditions represent the latest available observations of the object's state
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration reflects the generation of the most recently observed NatsUser
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// LastReconciled is the timestamp of the last reconciliation
	LastReconciled *metav1.Time `json:"lastReconciled,omitempty"`
}

type OperatorSeedSecretRef struct {
	// Name of the Secret containing the operator seed
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// Namespace of the Secret
	// +kubebuilder:validation:Required
	Namespace string `json:"namespace"`

	// Key within the Secret
	// +kubebuilder:default="operator.seed"
	Key string `json:"key,omitempty"`
}

type PasswordSource struct {
	// Generate indicates whether to generate a random password
	Generate bool `json:"generate,omitempty"`

	// SecretRef references an existing Secret containing the password
	SecretRef *SecretRef `json:"secretRef,omitempty"`
}

type Permissions struct {
	// PublishAllow is a list of subjects the user can publish to
	PublishAllow []string `json:"publishAllow,omitempty"`

	// PublishDeny is a list of subjects the user cannot publish to
	PublishDeny []string `json:"publishDeny,omitempty"`

	// SubscribeAllow is a list of subjects the user can subscribe to
	SubscribeAllow []string `json:"subscribeAllow,omitempty"`

	// SubscribeDeny is a list of subjects the user cannot subscribe to
	SubscribeDeny []string `json:"subscribeDeny,omitempty"`
}

type SecretRef struct {
	// Name of the Secret
	Name string `json:"name,omitempty"`

	// Namespace of the Secret
	Namespace string `json:"namespace,omitempty"`
}

type ServerAuthConfigRef struct {
	// Name of the ConfigMap or Secret
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// Namespace of the ConfigMap or Secret
	// +kubebuilder:validation:Required
	Namespace string `json:"namespace"`

	// Key within the ConfigMap or Secret
	// +kubebuilder:default="auth.conf"
	Key string `json:"key,omitempty"`

	// Type of the resource (ConfigMap or Secret)
	// +kubebuilder:validation:Enum=ConfigMap;Secret
	// +kubebuilder:default="ConfigMap"
	Type string `json:"type,omitempty"`
}

type UserAuthType string

type UserState string