v1alpha

type AccessPolicyClient struct {
	// Application is the name of the client application that can exchange tokens with the target application.
	//
	// +kubebuilder:validation:Required
	Application ResourceName `json:"application"`

	// Namespace is the namespace which the client application resides. If not specified, the namespace of the
	// SecurityConfig's referenced application will be used.
	//
	// +kubebuilder:validation:Optional
	Namespace *ResourceName `json:"namespace,omitempty"`
}

type AccessPolicySpec struct {
	// InheritInboundRules specifies whether the inbound access policy rules of the corresponding Skiperator Application
	// should be used as clients for token exchange. Defaults to false. When set to true, the complete list of clients
	// will be the union of the explicitly specified clients in Clients and the clients resolved from inbound rules.
	//
	// +kubebuilder:validation:Optional
	InheritInboundRules bool `json:"inheritInboundRules"`

	// Clients which may perform token exchange with your application as target.
	//
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=100
	// +kubebuilder:validation:Optional
	Clients []AccessPolicyClient `json:"clients,omitempty"`
}

type MaskinportenClientRef struct {
	// Name of the referenced MaskinportenClient.
	//
	// +kubebuilder:validation:Required
	Name ResourceName `json:"name"`
}

type MaskinportenClientSpec struct {
	// ClientName is the client name to be registered at DigDir.
	// It is shown during login for user-centric flows, and is otherwise a human-readable way to differentiate between clients at DigDir's self-service portal.
	//
	// +kubebuilder:validation:MaxLength=100
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:Required
	ClientName string `json:"clientName"`

	// Scopes is an object of consumed scopes.
	//
	// +kubebuilder:validation:Optional
	Scopes *MaskinportenScope `json:"scopes,omitempty"`
}

type MaskinportenScope struct {
	// `consumes` is a list of scopes that your client can request access to.
	//
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=100
	// +kubebuilder:validation:Required
	ConsumedScopes []naisiov1.ConsumedScope `json:"consumes"`
}

type MaskinportenSpec struct {
	// Enabled indicates whether Maskinporten should be configured for the application.
	//
	// +kubebuilder:validation:Required
	Enabled bool `json:"enabled"`

	// Client defines the Maskinporten client configuration inline.
	// Use this when you want to configure the client directly.
	//
	// +kubebuilder:validation:Optional
	Client *MaskinportenClientSpec `json:"client,omitempty"`

	// ClientRef references an existing MaskinportenClient by name.
	// Use this when a MaskinportenClient exists, and you want to reference it.
	//
	// +kubebuilder:validation:Optional
	ClientRef *MaskinportenClientRef `json:"clientRef,omitempty"`

	// SecretRef sources the Maskinporten client credentials from one or more existing Kubernetes secrets.
	// Use this when you have an existing OAuth client registered outside the SecurityConfig CRD
	// and MaskinportenClient CRD (e.g. manually registered at DigDir).
	//
	// +kubebuilder:validation:Optional
	SecretRef *SecretRef `json:"secretRef,omitempty"`
}

type Phase string

type ResourceName string

type SecretKeySelector struct {
	// Name is the name of the Kubernetes secret.
	//
	// +kubebuilder:validation:Required
	Name ResourceName `json:"name"`

	// Key is the key within the secret whose value should be used.
	//
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Pattern=`^[a-zA-Z0-9]([-._a-zA-Z0-9]*[a-zA-Z0-9])?$`
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:MinLength=1
	Key string `json:"key"`
}

type SecretRef struct {
	// ClientID references the secret key containing the Maskinporten client ID (MASKINPORTEN_CLIENT_ID).
	//
	// +kubebuilder:validation:Required
	ClientID SecretKeySelector `json:"clientID"`

	// ClientJWK references the secret key containing the Maskinporten client JWK (MASKINPORTEN_CLIENT_JWK).
	//
	// +kubebuilder:validation:Required
	ClientJWK SecretKeySelector `json:"clientJWK"`
}

type SecurityConfig struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// spec defines the desired state of SecurityConfig
	// +required
	Spec SecurityConfigSpec `json:"spec"`

	// status defines the observed state of SecurityConfig
	// +optional
	Status SecurityConfigStatus `json:"status,omitzero"`
}

type SecurityConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []SecurityConfig `json:"items"`
}

type SecurityConfigSpec struct {
	// Tokenx specifies whether to configure the token exchange capability for an application referred to by `applicationRef`.
	// accessPolicies of the application referred to by applicationRef
	// will be used to restrict which applications can exchange tokens where the specified application is the intended audience.
	//
	// +kubebuilder:validation:Optional
	Tokenx *TokenXSpec `json:"tokenx,omitempty"`

	// Maskinporten specifies whether to configure the maskinporten API consumer capability for an application referred to by `applicationRef`.
	// The configuration can either be provided inline via the `client` field,
	// by referencing an existing MaskinportenClient resource via the `clientRef` field,
	// or by sourcing credentials from existing Kubernetes secrets via the `secretRef` field.
	//
	// +kubebuilder:validation:Optional
	Maskinporten *MaskinportenSpec `json:"maskinporten,omitempty"`

	// ApplicationRef is a reference to the name of the SKIP application for which this SecurityConfig applies.
	//
	// +kubebuilder:validation:Required
	ApplicationRef ResourceName `json:"applicationRef"`
}

type SecurityConfigStatus struct {
	ObservedGeneration      int64              `json:"observedGeneration,omitempty"`
	Conditions              []metav1.Condition `json:"conditions,omitempty"`
	Phase                   Phase              `json:"phase,omitempty"`
	Message                 string             `json:"message,omitempty"`
	JwkerSecretName         string             `json:"jwkerSecretName,omitempty"`
	MaskinportenSectretName string             `json:"maskinportenSecretName,omitempty"`
	Ready                   bool               `json:"ready"`
}

type TokenXSpec struct {
	// Enabled indicates whether token exchange should be configured for the application.
	//
	// +kubebuilder:validation:Required
	Enabled bool `json:"enabled"`

	// AccessPolicy specifies configuration of which clients can exchange tokens with the application as target when
	// token exchange is enabled. If not specified, no clients are allowed.
	//
	// +kubebuilder:validation:Optional
	AccessPolicy *AccessPolicySpec `json:"accessPolicy,omitempty"`
}