v1alpha1

type ClientMappingsRepresentation struct {
	// Client
	// +optional
	Client string `json:"client,omitempty"`

	// ID
	// +optional
	ID string `json:"id,omitempty"`

	// Mappings
	// +optional
	Mappings []RoleRepresentation `json:"mappings,omitempty"`
}

type FederatedIdentity struct {
	// Federated Identity Provider.
	IdentityProvider string `json:"identityProvider,omitempty"`
	// Federated Identity User ID.
	UserID string `json:"userId,omitempty"`
	// Federated Identity User Name.
	UserName string `json:"userName,omitempty"`
}

type Keycloak struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   KeycloakSpec   `json:"spec,omitempty"`
	Status KeycloakStatus `json:"status,omitempty"`
}

type KeycloakAPIClient struct {
	// Client ID. If not specified, automatically generated.
	// +optional
	ID string `json:"id,omitempty"`
	// Client ID.
	// +kubebuilder:validation:Required
	ClientID string `json:"clientId"`
	// Client name.
	// +optional
	Name string `json:"name,omitempty"`
	// Surrogate Authentication Required option.
	// +optional
	SurrogateAuthRequired bool `json:"surrogateAuthRequired,omitempty"`
	// Client enabled flag.
	// +optional
	Enabled bool `json:"enabled,omitempty"`
	// What Client authentication type to use.
	// +optional
	ClientAuthenticatorType string `json:"clientAuthenticatorType,omitempty"`
	// Client Secret. The Operator will automatically create a Secret based on this value.
	// +optional
	Secret string `json:"secret,omitempty"`
	// Application base URL.
	// +optional
	BaseURL string `json:"baseUrl,omitempty"`
	// Application Admin URL.
	// +optional
	AdminURL string `json:"adminUrl,omitempty"`
	// Application root URL.
	// +optional
	RootURL string `json:"rootUrl,omitempty"`
	// Client description.
	// +optional
	Description string `json:"description,omitempty"`
	// Default Client roles.
	// +optional
	DefaultRoles []string `json:"defaultRoles,omitempty"`
	// A list of valid Redirection URLs.
	// +optional
	RedirectUris []string `json:"redirectUris,omitempty"`
	// A list of valid Web Origins.
	// +optional
	WebOrigins []string `json:"webOrigins,omitempty"`
	// Not Before setting.
	// +optional
	NotBefore int `json:"notBefore,omitempty"`
	// True if a client supports only Bearer Tokens.
	// +optional
	BearerOnly bool `json:"bearerOnly,omitempty"`
	// True if Consent Screen is required.
	// +optional
	ConsentRequired bool `json:"consentRequired,omitempty"`
	// True if Standard flow is enabled.
	// +optional
	StandardFlowEnabled bool `json:"standardFlowEnabled"`
	// True if Implicit flow is enabled.
	// +optional
	ImplicitFlowEnabled bool `json:"implicitFlowEnabled"`
	// True if Direct Grant is enabled.
	// +optional
	DirectAccessGrantsEnabled bool `json:"directAccessGrantsEnabled"`
	// True if Service Accounts are enabled.
	// +optional
	ServiceAccountsEnabled bool `json:"serviceAccountsEnabled,omitempty"`
	// True if this is a public Client.
	// +optional
	PublicClient bool `json:"publicClient"`
	// True if this client supports Front Channel logout.
	// +optional
	FrontchannelLogout bool `json:"frontchannelLogout,omitempty"`
	// Protocol used for this Client.
	// +optional
	Protocol string `json:"protocol,omitempty"`
	// Client Attributes.
	// +optional
	Attributes map[string]string `json:"attributes,omitempty"`
	// True if Full Scope is allowed.
	// +optional
	FullScopeAllowed *bool `json:"fullScopeAllowed,omitempty"`
	// Node registration timeout.
	// +optional
	NodeReRegistrationTimeout int `json:"nodeReRegistrationTimeout,omitempty"`
	// Protocol Mappers.
	// +optional
	ProtocolMappers []KeycloakProtocolMapper `json:"protocolMappers,omitempty"`
	// True to use a Template Config.
	// +optional
	UseTemplateConfig bool `json:"useTemplateConfig,omitempty"`
	// True to use Template Scope.
	// +optional
	UseTemplateScope bool `json:"useTemplateScope,omitempty"`
	// True to use Template Mappers.
	// +optional
	UseTemplateMappers bool `json:"useTemplateMappers,omitempty"`
	// Access options.
	// +optional
	Access map[string]bool `json:"access,omitempty"`
	// A list of optional client scopes. Optional client scopes are
	// applied when issuing tokens for this client, but only when they
	// are requested by the scope parameter in the OpenID Connect
	// authorization request.
	// +optional
	OptionalClientScopes []string `json:"optionalClientScopes,omitempty"`
	// A list of default client scopes. Default client scopes are
	// always applied when issuing OpenID Connect tokens or SAML
	// assertions for this client.
	// +optional
	DefaultClientScopes []string `json:"defaultClientScopes,omitempty"`
	// True if fine-grained authorization support is enabled for this client.
	// +optional
	AuthorizationServicesEnabled bool `json:"authorizationServicesEnabled,omitempty"`
	// Authorization settings for this resource server.
	// +optional
	AuthorizationSettings *KeycloakResourceServer `json:"authorizationSettings,omitempty"`
	// Authentication Flow Binding Overrides.
	// +optional
	AuthenticationFlowBindingOverrides map[string]string `json:"authenticationFlowBindingOverrides,omitempty"`
}

type KeycloakAPIRealm struct {
	// +kubebuilder:validation:Required
	// +optional
	ID string `json:"id,omitempty"`
	// Realm name.
	// +kubebuilder:validation:Required
	Realm string `json:"realm"`
	// Realm enabled flag.
	// +optional
	Enabled bool `json:"enabled"`
	// Client scopes
	// +optional
	ClientScopes []KeycloakClientScope `json:"clientScopes,omitempty"`

	// Default role
	// +optional
	DefaultRole *RoleRepresentation `json:"defaultRole,omitempty"`
}

type KeycloakAPIUser struct {
	// User ID.
	ID string `json:"id,omitempty"`
	// User Name.
	UserName string `json:"username,omitempty"`
	// First Name.
	FirstName string `json:"firstName,omitempty"`
	// Last Name.
	LastName string `json:"lastName,omitempty"`
	// Email.
	Email string `json:"email,omitempty"`
	// True if email has already been verified.
	EmailVerified bool `json:"emailVerified,omitempty"`
	// User enabled flag.
	Enabled bool `json:"enabled,omitempty"`
	// A set of Realm Roles.
	RealmRoles []string `json:"realmRoles,omitempty"`
	// A set of Client Roles.
	ClientRoles map[string][]string `json:"clientRoles,omitempty"`
	// A set of Required Actions.
	RequiredActions []string `json:"requiredActions,omitempty"`
	// A set of Groups.
	Groups []string `json:"groups,omitempty"`
	// A set of Federated Identities.
	FederatedIdentities []FederatedIdentity `json:"federatedIdentities,omitempty"`
	// A set of Credentials.
	Credentials []KeycloakCredential `json:"credentials,omitempty"`
	// A set of Attributes.
	Attributes map[string][]string `json:"attributes,omitempty"`
}

type KeycloakClient struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   KeycloakClientSpec   `json:"spec,omitempty"`
	Status KeycloakClientStatus `json:"status,omitempty"`
}

type KeycloakClientList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []KeycloakClient `json:"items"`
}

type KeycloakClientScope struct {
	// +optional
	Attributes map[string]string `json:"attributes,omitempty"`
	// +optional
	Description string `json:"description,omitempty"`
	// +optional
	ID string `json:"id,omitempty"`
	// +optional
	Name string `json:"name,omitempty"`
	// +optional
	Protocol string `json:"protocol,omitempty"`
	// Protocol Mappers.
	// +optional
	ProtocolMappers []KeycloakProtocolMapper `json:"protocolMappers,omitempty"`
}

type KeycloakClientSpec struct {
	// Selector for looking up KeycloakRealm Custom Resources.
	// +kubebuilder:validation:Required
	RealmSelector *metav1.LabelSelector `json:"realmSelector"`
	// Keycloak Client REST object.
	// +kubebuilder:validation:Required
	Client *KeycloakAPIClient `json:"client"`
	// Client Roles
	// +optional
	// +listType=map
	// +listMapKey=name
	Roles []RoleRepresentation `json:"roles,omitempty"`
	// Scope Mappings
	// +optional
	ScopeMappings *MappingsRepresentation `json:"scopeMappings,omitempty"`
	// Service account realm roles for this client.
	// +optional
	ServiceAccountRealmRoles []string `json:"serviceAccountRealmRoles,omitempty"`
	// Service account client roles for this client.
	// +optional
	ServiceAccountClientRoles map[string][]string `json:"serviceAccountClientRoles,omitempty"`
}

type KeycloakClientStatus struct {
	// Current phase of the operator.
	Phase StatusPhase `json:"phase"`
	// Human-readable message indicating details about current operator phase or error.
	Message string `json:"message"`
	// True if all resources are in a ready state and all work is done.
	Ready bool `json:"ready"`
	// A map of all the secondary resources types and names created for this CR. e.g "Deployment": [ "DeploymentName1", "DeploymentName2" ]
	SecondaryResources map[string][]string `json:"secondaryResources,omitempty"`
}

type KeycloakCredential struct {
	// Credential Type.
	Type string `json:"type,omitempty"`
	// Credential Value.
	Value string `json:"value,omitempty"`
	// True if this credential object is temporary.
	Temporary bool `json:"temporary,omitempty"`
}

type KeycloakExternal struct {
	// If set to true, this Keycloak will be treated as an external instance.
	// The unmanaged field also needs to be set to true if this field is true.
	Enabled bool `json:"enabled,omitempty"`
	// The URL to use for the keycloak admin API. Needs to be set if external is true.
	// +optional
	URL string `json:"url,omitempty"`
}

type KeycloakList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Keycloak `json:"items"`
}

type KeycloakPolicy struct {
	// Config.
	// +optional
	Config map[string]string `json:"config,omitempty"`
	// The decision strategy dictates how the policies associated with a given permission are evaluated and how
	// a final decision is obtained. 'Affirmative' means that at least one policy must evaluate to a positive
	// decision in order for the final decision to be also positive. 'Unanimous' means that all policies must
	// evaluate to a positive decision in order for the final decision to be also positive. 'Consensus' means
	// that the number of positive decisions must be greater than the number of negative decisions. If the number
	// of positive and negative is the same, the final decision will be negative.
	// +optional
	DecisionStrategy string `json:"decisionStrategy,omitempty"`
	// A description for this policy.
	// +optional
	Description string `json:"description,omitempty"`
	// ID.
	// +optional
	ID string `json:"id,omitempty"`
	// The logic dictates how the policy decision should be made. If 'Positive', the resulting effect
	// (permit or deny) obtained during the evaluation of this policy will be used to perform a decision.
	// If 'Negative', the resulting effect will be negated, in other words, a permit becomes a deny and vice-versa.
	// +optional
	Logic string `json:"logic,omitempty"`
	// The name of this policy.
	// +optional
	Name string `json:"name,omitempty"`
	// Owner.
	// +optional
	Owner string `json:"owner,omitempty"`
	// Policies.
	// +optional
	Policies []string `json:"policies,omitempty"`
	// Resources.
	// +optional
	Resources []string `json:"resources,omitempty"`
	// Resources Data.
	// +optional
	ResourcesData []KeycloakResource `json:"resourcesData,omitempty"`
	// Scopes.
	// +optional
	Scopes []string `json:"scopes,omitempty"`
	// Type.
	// +optional
	Type string `json:"type,omitempty"`
	// Scopes Data.
	// +optional
	ScopesData []apiextensionsv1.JSON `json:"scopesData,omitempty"`
}

type KeycloakProtocolMapper struct {
	// Protocol Mapper ID.
	// +optional
	ID string `json:"id,omitempty"`
	// Protocol Mapper Name.
	// +optional
	Name string `json:"name,omitempty"`
	// Protocol to use.
	// +optional
	Protocol string `json:"protocol,omitempty"`
	// Protocol Mapper to use
	// +optional
	ProtocolMapper string `json:"protocolMapper,omitempty"`
	// True if Consent Screen is required.
	// +optional
	ConsentRequired bool `json:"consentRequired,omitempty"`
	// Text to use for displaying Consent Screen.
	// +optional
	ConsentText string `json:"consentText,omitempty"`
	// Config options.
	// +optional
	Config map[string]string `json:"config,omitempty"`
}

type KeycloakRealm struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   KeycloakRealmSpec   `json:"spec,omitempty"`
	Status KeycloakRealmStatus `json:"status,omitempty"`
}

type KeycloakRealmList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []KeycloakRealm `json:"items"`
}

type KeycloakRealmSpec struct {
	// When set to true, this KeycloakRealm will be marked as unmanaged and not be managed by this operator.
	// It can then be used for targeting purposes.
	// +optional
	Unmanaged bool `json:"unmanaged,omitempty"`
	// Selector for looking up Keycloak Custom Resources.
	// +kubebuilder:validation:Required
	InstanceSelector *metav1.LabelSelector `json:"instanceSelector,omitempty"`
	// Keycloak Realm REST object.
	// +kubebuilder:validation:Required
	Realm *KeycloakAPIRealm `json:"realm"`
}

type KeycloakRealmStatus struct {
	// Current phase of the operator.
	Phase StatusPhase `json:"phase"`
	// Human-readable message indicating details about current operator phase or error.
	Message string `json:"message"`
	// True if all resources are in a ready state and all work is done.
	Ready bool `json:"ready"`
	// A map of all the secondary resources types and names created for this CR. e.g "Deployment": [ "DeploymentName1", "DeploymentName2" ]
	SecondaryResources map[string][]string `json:"secondaryResources,omitempty"`
	// TODO
	LoginURL string `json:"loginURL"`
}

type KeycloakResource struct {
	// ID.
	// +optional
	ID string `json:"_id,omitempty"`
	// The attributes associated with the resource.
	// +optional
	Attributes map[string]string `json:"attributes,omitempty"`
	// A unique name for this resource. The name can be used to uniquely identify a resource, useful when
	// querying for a specific resource.
	// +optional
	DisplayName string `json:"displayName,omitempty"`
	// An URI pointing to an icon.
	// +optional
	IconURI string `json:"icon_uri,omitempty"`
	// A unique name for this resource. The name can be used to uniquely identify a resource, useful when
	// querying for a specific resource.
	// +optional
	Name string `json:"name,omitempty"`
	// True if the access to this resource can be managed by the resource owner.
	// +optional
	OwnerManagedAccess bool `json:"ownerManagedAccess,omitempty"`
	// The type of this resource. It can be used to group different resource instances with the same type.
	// +optional
	Type string `json:"type,omitempty"`
	// Set of URIs which are protected by resource.
	// +optional
	Uris []string `json:"uris,omitempty"`
	// The scopes associated with this resource.
	// +optional
	Scopes []apiextensionsv1.JSON `json:"scopes,omitempty"`
}

type KeycloakResourceServer struct {
	// True if resources should be managed remotely by the resource server.
	// +optional
	AllowRemoteResourceManagement bool `json:"allowRemoteResourceManagement,omitempty"`
	// Client ID.
	// +optional
	ClientID string `json:"clientId,omitempty"`
	// The decision strategy dictates how permissions are evaluated and how a
	// final decision is obtained. 'Affirmative' means that at least one
	// permission must evaluate to a positive decision in order to grant access
	// to a resource and its scopes. 'Unanimous' means that all permissions must
	// evaluate to a positive decision in order for the final decision to be also positive.
	// +optional
	DecisionStrategy string `json:"decisionStrategy,omitempty"`
	// ID.
	// +optional
	ID string `json:"id,omitempty"`
	// Name.
	// +optional
	Name string `json:"name,omitempty"`
	// Policies.
	// +optional
	Policies []KeycloakPolicy `json:"policies,omitempty"`
	// The policy enforcement mode dictates how policies are enforced when evaluating authorization requests.
	// 'Enforcing' means requests are denied by default even when there is no policy associated with a given resource.
	// 'Permissive' means requests are allowed even when there is no policy associated with a given resource.
	// 'Disabled' completely disables the evaluation of policies and allows access to any resource.
	// +optional
	PolicyEnforcementMode string `json:"policyEnforcementMode,omitempty"`
	// Resources.
	// +optional
	Resources []KeycloakResource `json:"resources,omitempty"`
	// Authorization Scopes.
	// +optional
	Scopes []KeycloakScope `json:"scopes,omitempty"`
}

type KeycloakScope struct {
	// A unique name for this scope. The name can be used to uniquely identify a scope, useful when querying
	// for a specific scope.
	// +optional
	DisplayName string `json:"displayName,omitempty"`
	// An URI pointing to an icon.
	// +optional
	IconURI string `json:"iconUri,omitempty"`
	// ID.
	// +optional
	ID string `json:"id,omitempty"`
	// A unique name for this scope. The name can be used to uniquely identify a scope, useful when querying
	// for a specific scope.
	// +optional
	Name string `json:"name,omitempty"`
	// Policies.
	// +optional
	Policies []KeycloakPolicy `json:"policies,omitempty"`
	// Resources.
	// +optional
	Resources []KeycloakResource `json:"resources,omitempty"`
}

type KeycloakSpec struct {
	// When set to true, this Keycloak will be marked as unmanaged and will not be managed by this operator.
	// It can then be used for targeting purposes.
	// +optional
	// +kubebuilder:default:=true
	Unmanaged bool `json:"unmanaged,omitempty"`
	// Contains configuration for external Keycloak instances. Unmanaged needs to be set to true to use this.
	// +optional
	External KeycloakExternal `json:"external"`
}

type KeycloakStatus struct {
	// Current phase of the operator.
	Phase StatusPhase `json:"phase"`
	// Human-readable message indicating details about current operator phase or error.
	Message string `json:"message"`
	// True if all resources are in a ready state and all work is done.
	Ready bool `json:"ready"`
	// A map of all the secondary resources types and names created for this CR. e.g "Deployment": [ "DeploymentName1", "DeploymentName2" ].
	SecondaryResources map[string][]string `json:"secondaryResources,omitempty"`
	// Version of Keycloak or RHSSO running on the cluster.
	Version string `json:"version"`
	// External URL for accessing Keycloak instance from outside the cluster. Is identical to external.URL if it's specified, otherwise is computed (e.g. from Ingress).
	ExternalURL string `json:"externalURL,omitempty"`
	// The secret where the admin credentials are to be found.
	CredentialSecret string `json:"credentialSecret"`
}

type KeycloakUserRole struct {
	ID          string `json:"id,omitempty"`
	Name        string `json:"name,omitempty"`
	Description string `json:"description,omitempty"`
	Composite   bool   `json:"composite,omitempty"`
	ClientRole  bool   `json:"clientRole,omitempty"`
	ContainerID string `json:"containerId,omitempty"`
}

type MappingsRepresentation struct {
	// Client Mappings
	// +optional
	ClientMappings map[string]ClientMappingsRepresentation `json:"clientMappings,omitempty"`

	// Realm Mappings
	// +optional
	RealmMappings []RoleRepresentation `json:"realmMappings,omitempty"`
}

type RoleRepresentation struct {
	// Role Attributes
	// +optional
	Attributes map[string][]string `json:"attributes,omitempty"`

	// Client Role
	// +optional
	ClientRole *bool `json:"clientRole,omitempty"`

	// Composite
	// +optional
	Composite *bool `json:"composite,omitempty"`

	// Composites
	// +optional
	Composites *RoleRepresentationComposites `json:"composites,omitempty"`

	// Container Id
	// +optional
	ContainerID string `json:"containerId,omitempty"`

	// Description
	// +optional
	Description string `json:"description,omitempty"`

	// Id
	// +optional
	ID string `json:"id,omitempty"`

	// Name
	Name string `json:"name"`
}

type RoleRepresentationArray []RoleRepresentation

type RoleRepresentationComposites struct {
	// Map client => []role
	// +optional
	Client map[string][]string `json:"client,omitempty"`

	// Realm roles
	// +optional
	Realm []string `json:"realm,omitempty"`
}

type RolesRepresentation struct {
	// Client Roles
	// +optional
	Client map[string]RoleRepresentationArray `json:"client,omitempty"`

	// Realm Roles
	// +optional
	Realm []RoleRepresentation `json:"realm,omitempty"`
}

type ScopeMappingRepresentation struct {
	// Client
	// +optional
	Client string `json:"client,omitempty"`

	// Client Scope
	// +optional
	ClientScope string `json:"clientScope,omitempty"`

	// Roles
	// +optional
	Roles []string `json:"roles,omitempty"`

	// Self
	// +optional
	Self string `json:"self,omitempty"`
}

type ScopeMappingRepresentationArray []ScopeMappingRepresentation

type StatusPhase string

type TokenResponse struct {
	// Token Response Access Token.
	// +optional
	AccessToken string `json:"access_token"`
	// Token Response Expired In setting.
	// +optional
	ExpiresIn int `json:"expires_in"`
	// Token Response Refresh Expires In setting.
	// +optional
	RefreshExpiresIn int `json:"refresh_expires_in"`
	// Token Response Refresh Token.
	// +optional
	RefreshToken string `json:"refresh_token"`
	// Token Response Token Type.
	// +optional
	TokenType string `json:"token_type"`
	// Token Response Not Before Policy setting.
	// +optional
	NotBeforePolicy int `json:"not-before-policy"`
	// Token Response Session State.
	// +optional
	SessionState string `json:"session_state"`
	// Token Response Error.
	// +optional
	Error string `json:"error"`
	// Token Response Error Description.
	// +optional
	ErrorDescription string `json:"error_description"`
}