v1alpha1

type HTTPTransport struct {
	// target port is the HTTP port that serves the MCP server.over HTTP
	TargetPort uint32 `json:"targetPort,omitempty"`

	// the target path where MCP is served
	TargetPath string `json:"path,omitempty"`
}

type KeycloakProvider struct {
	Realm string `json:"realm" yaml:"realm"`
}

type MCPAuthorizationServer struct {
	Issuer           string                    `json:"issuer" yaml:"issuer"`
	Audience         string                    `json:"audience" yaml:"audience"`
	JwksURL          string                    `json:"jwksUrl" yaml:"jwksUrl"`
	Provider         *MCPClientProvider        `json:"provider,omitempty" yaml:"provider,omitempty"`
	ResourceMetadata MCPClientResourceMetadata `json:"resourceMetadata" yaml:"resourceMetadata"`
}

type MCPClientProvider struct {
	Keycloak KeycloakProvider `json:"keycloak,omitempty" yaml:"keycloak,omitempty"`
}

type MCPClientResourceMetadata struct {
	// BaseURL denotes the protected base url of the protected resource ie: http://localhost:3000
	BaseUrl string `json:"baseUrl" yaml:"resource"`
	// Scopes supported by this resource
	// +optional
	ScopesSupported []string `json:"scopesSupported,omitempty" yaml:"scopesSupported,omitempty"`
	// Bearer methods supported by this resource
	// +optional
	BearerMethodsSupported []string `json:"bearerMethodsSupported,omitempty" yaml:"bearerMethodsSupported,omitempty"`
	// Additional resource metadata fields
	// +optional
	AdditionalFields map[string]string `json:"additionalFields,omitempty" yaml:"additionalFields,omitempty"`
}

type MCPServer struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   MCPServerSpec   `json:"spec,omitempty"`
	Status MCPServerStatus `json:"status,omitempty"`
}

type MCPServerAuthentication struct {
	// JWT defines the JWT authentication configuration.
	JWT *MCPServerJWTAuthentication `json:"jwt,omitempty"`
}

type MCPServerAuthorization struct {
	// Server defines the configuration for the MCP authorization server that protects the MCP server.
	// Setting this field will configure agentgateway to use the authorization server
	// to protect the MCP server and its resources as well as adapt traffic to the MCP client to comply with the
	// MCP authorization spec before forwarding traffic to the MCP client.
	// +optional
	Server *MCPAuthorizationServer `json:"server,omitempty"`

	// Rules defines the CEL-based authorization rules that control access to the MCP server resources.
	// +optional
	Rules *[]string `json:"rules,omitempty"`
}

type MCPServerConditionReason string

type MCPServerConditionType string

type MCPServerDeployment struct {
	// Image defines the container image to to deploy the MCP server.
	Image string `json:"image,omitempty"`

	// Port defines the port on which the MCP server will listen.
	Port uint16 `json:"port,omitempty"`

	// Cmd defines the command to run in the container to start the mcp server.
	Cmd string `json:"cmd,omitempty"`

	// Args defines the arguments to pass to the command.
	Args []string `json:"args,omitempty"`

	// Env defines the environment variables to set in the container.
	Env map[string]string `json:"env,omitempty"`

	// SecretRefs defines the list of Kubernetes secrets to reference.
	// These secrets will be mounted as volumes to the MCP server container.
	// +optional
	SecretRefs []corev1.LocalObjectReference `json:"secretRefs,omitempty"`
}

type MCPServerJWTAuthentication struct {
	// Issuer is the JWT issuer URL.
	Issuer string `json:"issuer,omitempty"`

	// Audiences is a list of audiences that the JWT must match.
	Audiences []string `json:"audiences,omitempty"`

	// JWKS references a secret containing the JSON Web Key Set.
	// The secret must contain a key with the JWKS content.
	JWKS *corev1.SecretKeySelector `json:"jwks,omitempty"`
}

type MCPServerList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []MCPServer `json:"items"`
}

type MCPServerSpec struct {
	// Configuration to Deploy the MCP Server using a docker container
	Deployment MCPServerDeployment `json:"deployment"`

	// TransportType defines the type of mcp server being run
	// +kubebuilder:validation:Enum=stdio;http
	TransportType TransportType `json:"transportType,omitempty"`

	// StdioTransport defines the configuration for a standard input/output transport.
	StdioTransport *StdioTransport `json:"stdioTransport,omitempty"`

	// HTTPTransport defines the configuration for a Streamable HTTP transport.
	HTTPTransport *HTTPTransport `json:"httpTransport,omitempty"`

	// Authn defines the authentication configuration for the MCP server.
	// This field is optional and can be used to configure JWT authentication.
	// If not specified, the MCP server will not require authentication.
	// +optional
	Authn *MCPServerAuthentication `json:"authn,omitempty"`

	// Authz defines the authorization rule configuration for the MCP server.
	// This field is optional and can be used to configure authorization rules
	// for access to the MCP server and specific tools. If not specified, the MCP server will not enforce
	// any authorization rules.
	// +optional
	Authz *MCPServerAuthorization `json:"authz,omitempty"`
}

type MCPServerStatus struct {
	// Conditions describe the current conditions of the MCPServer.
	// Implementations should prefer to express MCPServer conditions
	// using the `MCPServerConditionType` and `MCPServerConditionReason`
	// constants so that operators and tools can converge on a common
	// vocabulary to describe MCPServer state.
	//
	// Known condition types are:
	//
	// * "Accepted"
	// * "ResolvedRefs"
	// * "Programmed"
	// * "Ready"
	//
	// +optional
	// +listType=map
	// +listMapKey=type
	// +kubebuilder:validation:MaxItems=8
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed for this MCPServer.
	// It corresponds to the MCPServer's generation, which is updated on mutation by the API Server.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type StdioTransport struct{}

type TransportType string