v1alpha1

type JWKSSpec struct {
	// `keys` is a base64 encoded JSON webkey Set. If specified, the OIDCAuthenticator skips the request to the issuer's jwks_uri endpoint to retrieve the keys.
	Keys []byte `json:"keys,omitempty"`

	// +kubebuilder:default=true
	// `distributedClaims` enables the OIDCAuthenticator to return references to claims that are asserted by external Claims providers.
	DistributedClaims *bool `json:"distributedClaims,omitempty"`
}

type OIDCAuthenticationSpec struct {

	// IssuerURL is the URL the provider signs ID Tokens as. This will be the "iss"
	// field of all tokens produced by the provider and is used for configuration
	// discovery.
	//
	// The URL is usually the provider's URL without a path, for example
	// "https://foo.com" or "https://example.com".
	//
	// The provider must implement configuration discovery.
	// See: https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig
	IssuerURL string `json:"issuerURL"`

	// ClientID is the audience for which the JWT must be issued for, the "aud" field.
	//
	// The plugin supports the "authorized party" OpenID Connect claim, which allows
	// specialized providers to issue tokens to a client for a different client.
	// See: https://openid.net/specs/openid-connect-core-1_0.html#IDToken
	ClientID string `json:"clientID"`

	// UsernameClaim is the JWT field to use as the user's username.
	UsernameClaim *string `json:"usernameClaim"`

	// UsernamePrefix, if specified, causes claims mapping to username to be prefix with
	// the provided value. A value "oidc:" would result in usernames like "oidc:john".
	//
	// If not provided, the prefix defaults to "( .metadata.name )/".
	// The value "-" can be used to disable all prefixing.
	UsernamePrefix *string `json:"usernamePrefix,omitempty"`

	// GroupsClaim, if specified, causes the OIDCAuthenticator to try to populate the user's
	// groups with an ID Token field. If the GroupsClaim field is present in an ID Token the value
	// must be a string or list of strings.
	GroupsClaim *string `json:"groupsClaim,omitempty"`

	// GroupsPrefix, if specified, causes claims mapping to group names to be prefixed with the
	// value. A value "oidc:" would result in groups like "oidc:engineering" and "oidc:marketing".
	//
	// If not provided, the prefix defaults to "( .metadata.name )/".
	// The value "-" can be used to disable all prefixing.
	GroupsPrefix *string `json:"groupsPrefix,omitempty"`

	// SupportedSigningAlgs sets the accepted set of JOSE signing algorithms that
	// can be used by the provider to sign tokens.
	//
	// https://tools.ietf.org/html/rfc7518#section-3.1
	//
	// This value defaults to RS256, the value recommended by the OpenID Connect
	// spec:
	//
	// https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
	SupportedSigningAlgs []SigningAlgorithm `json:"supportedSigningAlgs,omitempty"`

	// RequiredClaims, if specified, causes the OIDCAuthenticator to verify that all the
	// required claims key value pairs are present in the ID Token.
	RequiredClaims map[string]string `json:"requiredClaims,omitempty"`

	// ExtraClaims, if specified, causes the OIDCAuthenticator to copy listed claims to the
	// user Extra field.
	// Claims will be converted to lower case and prefixed with "gardener.cloud/user/" before being copied.
	// If any of the extra claims is not present in the token then the token will be rejected.
	ExtraClaims []string `json:"extraClaims,omitempty"`

	// CABundle is a PEM encoded CA bundle which will be used to validate the OpenID server's certificate.
	// If unspecified, system's trusted certificates are used.
	CABundle []byte `json:"caBundle,omitempty"`

	// JWKS if specified, provides an option to specify JWKS keys offline.
	JWKS JWKSSpec `json:"jwks,omitempty"`

	// MaxTokenExpirationSeconds if specified, sets a limit in seconds to the maximum validity duration of a token.
	// Tokens issued with validity greater that this value will not be verified.
	// Setting this will require that the tokens have the "iat" and "exp" claims.
	MaxTokenExpirationSeconds *int64 `json:"maxTokenExpirationSeconds,omitempty"`
}

type OIDCAuthenticationStatus struct{}

type OpenIDConnect struct {
	metav1.TypeMeta `json:",inline"`

	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   OIDCAuthenticationSpec   `json:"spec"`
	Status OIDCAuthenticationStatus `json:"status,omitempty"`
}

type OpenIDConnectList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []OpenIDConnect `json:"items"`
}

type SigningAlgorithm string