api

type Action struct {
	Verb     string
	Resource string
	// Group is the API group the resource lives in. Empty means hecate.dev,
	// which is every Action that existed before settings could write anything —
	// so the default keeps those unchanged rather than making each restate the
	// group it always had.
	//
	// The core group is spelled coreGroup rather than "", because "" here would
	// be indistinguishable from "unset" and would silently authorise against
	// hecate.dev instead. Getting that wrong means checking the wrong resource
	// and allowing a write nobody was granted.
	Group string
}

type Authenticator struct {
	// Client is Hecate's own client, used to create TokenReviews and
	// SubjectAccessReviews. It needs `create` on those two and nothing more:
	// Hecate asks whether the caller may act, it does not act as them.
	Client client.Client
}

type BadRequest struct{ Reason string }

type ClusterTarget struct {
	// Secret holding the kubeconfig, as "namespace/name".
	Secret string `json:"secret"`
	// Gates using it. Empty is not an error — a cluster can be connected before
	// any Gate references it, and saying so is more useful than hiding it,
	// which is what listing only Gate-referenced clusters used to do: you could
	// store a kubeconfig and watch nothing appear.
	Gates []string `json:"gates"`
	// Reachable is whether the credentials in the Secret actually answer.
	//
	// Checked here rather than left until a promotion needs it. A kubeconfig
	// that has expired, or names an endpoint this cluster cannot route to,
	// looks identical to a working one right up to the moment a Gate is waiting
	// on it — and that is the moment when nobody wants to be debugging
	// credentials.
	Reachable bool `json:"reachable"`
	// Detail says why when Reachable is false.
	Detail string `json:"detail,omitempty"`
}

type FidesTarget struct {
	ServerURL string `json:"serverURL"`
	// Gates naming this server, as "namespace/name".
	Gates []string `json:"gates"`
	// Environments this server is asked about, as UUIDs — the same value that
	// appears in the Fides UI, so the two can be lined up.
	Environments []string `json:"environments,omitempty"`
	// Reachable is the result of actually asking, not of the URL looking
	// plausible. A misconfigured evidence server is indistinguishable from a
	// working one until a promotion needs it, which is the worst moment to find
	// out.
	Reachable bool `json:"reachable"`
	// Detail says why when Reachable is false.
	Detail string `json:"detail,omitempty"`
}

type Forbidden struct {
	Subject   Subject
	Action    Action
	Namespace string
	Reason    string
}

type HomeCluster struct {
	// InCluster is whether Hecate is running inside Kubernetes at all, rather
	// than against a kubeconfig on someone's laptop.
	InCluster bool `json:"inCluster"`
	// Server is the API server address, as this process reaches it. Inside a
	// cluster that is the service address rather than the public endpoint,
	// which is honest — it is what Hecate uses.
	Server string `json:"server,omitempty"`
	// Namespace is where Hecate itself is installed.
	Namespace string `json:"namespace,omitempty"`
}

type Identity struct {
	Name   string   `json:"name"`
	Groups []string `json:"groups,omitempty"`
}

type Login struct {
	// contains filtered or unexported fields
}

type LoginConfig struct {
	// Issuer is the OIDC provider, e.g. https://login.example.com. Discovery
	// happens at startup, so a wrong one fails the rollout rather than the
	// first login.
	Issuer string
	// ClientID and ClientSecret identify Hecate to the provider.
	ClientID     string
	ClientSecret string
	// RedirectURL is where the provider sends the browser back. It must be the
	// public URL of this server plus /auth/callback.
	RedirectURL string
	// Scopes beyond openid. `profile` and `email` are usual; `groups` is often
	// what carries the claim Kubernetes maps to groups.
	Scopes []string
	// Insecure allows the session cookie over plain HTTP. For local
	// development only — it is the difference between a token the network can
	// read and one it cannot.
	Insecure bool
}

type Server struct {
	Ops  *ops.Ops
	Auth *Authenticator
	// Version is reported at /healthz, so an operator can tell which build is
	// answering without reading the deployment.
	Version string
	// Login is the browser sign-in flow. Nil serves the API to callers who
	// already hold a Kubernetes token — which is every CLI and script, and is
	// why this is optional rather than required.
	Login *Login
}

type Settings struct {
	// Version is the running build, so a bug report can name it.
	Version string `json:"version"`
	// Identity is who the API thinks you are, straight from the token. The most
	// common sign-in complaint is "it says I cannot do this and I should be
	// able to", and the first useful question is which account you arrived as.
	Identity Identity `json:"identity"`
	// Fides is every evidence server the visible Gates point at, with whether
	// it answers.
	Fides []FidesTarget `json:"fides"`
	// Clusters are the remote clusters Gates watch (#22).
	Clusters []ClusterTarget `json:"clusters"`
	// Telemetry is where traces go, if anywhere.
	Telemetry Telemetry `json:"telemetry"`
	// Home is the cluster Hecate itself runs in.
	//
	// Reported because the screen listing "connected clusters" was read three
	// times as saying no cluster was connected, when Hecate was running inside
	// one and promoting into it. A panel that can only ever show the extra
	// clusters, and is empty on the installation everyone actually has, is a
	// panel that says "none" to the question people are asking.
	Home HomeCluster `json:"home"`
}

type Subject struct {
	Name   string
	Groups []string
}

type Telemetry struct {
	Endpoint   string `json:"endpoint,omitempty"`
	Configured bool   `json:"configured"`
}