v1alpha1

type GitReference struct {
	// Branch is the Git branch to check out.
	// +optional
	Branch string `json:"branch,omitempty"`

	// Tag is the Git tag to check out.
	// +optional
	Tag string `json:"tag,omitempty"`

	// Commit is the Git commit SHA to check out.
	// +kubebuilder:validation:Pattern=`^[a-f0-9]{7,40}$`
	// +optional
	Commit string `json:"commit,omitempty"`

	// Semver is a semver range expression used to select the latest
	// matching Git tag.
	// +optional
	Semver string `json:"semver,omitempty"`
}

type HelmChartTemplate struct {
	// RepoURL is the URL of the Helm chart repository.
	// Supports HTTP/HTTPS Helm repositories and OCI registries (oci://).
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:Pattern=`^(https?://|oci://).+$`
	// +required
	RepoURL string `json:"repoURL"`

	// Chart is the name of the Helm chart within the repository.
	// +kubebuilder:validation:MinLength=1
	// +required
	Chart string `json:"chart"`

	// Version is the exact chart version to install (e.g. "1.2.3").
	// If empty, the latest version is used.
	// +optional
	Version string `json:"version,omitempty"`

	// Interval at which the operator re-reconciles this Helm release.
	// +required
	Interval metav1.Duration `json:"interval"`

	// Values holds the default Helm chart values as arbitrary JSON.
	// Module.Spec.Values can override these on a per-instance basis.
	// +kubebuilder:pruning:PreserveUnknownFields
	// +optional
	Values *runtime.RawExtension `json:"values,omitempty"`

	// ReleaseName overrides the Helm release name.
	// Defaults to the Module name if not specified.
	// +kubebuilder:validation:MaxLength=53
	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`
	// +optional
	ReleaseName string `json:"releaseName,omitempty"`

	// CreateNamespace instructs the operator to create the target namespace
	// before installing the chart, if it does not already exist.
	// +optional
	CreateNamespace bool `json:"createNamespace,omitempty"`

	// Timeout is the maximum duration for any single Helm operation.
	// Defaults to 5m if not specified.
	// +optional
	Timeout *metav1.Duration `json:"timeout,omitempty"`

	// MaxHistory limits the number of Helm release revisions saved.
	// Defaults to 10 if not specified.
	// +kubebuilder:validation:Minimum=0
	// +optional
	MaxHistory *int32 `json:"maxHistory,omitempty"`

	// Upgrade configures the Helm upgrade strategy.
	// +optional
	Upgrade *HelmUpgradeStrategy `json:"upgrade,omitempty"`

	// SecretRef references a Secret in the Module's resolved namespace
	// containing credentials for the Helm repository.
	// Supported keys: username, password (Basic Auth), caFile, certFile, keyFile (TLS).
	// +optional
	SecretRef *SecretReference `json:"secretRef,omitempty"`
}

type HelmReleaseStatus struct {
	// ChartVersion is the version of the currently deployed Helm chart.
	// +optional
	ChartVersion string `json:"chartVersion,omitempty"`

	// Revision is the Helm release revision number.
	// +optional
	Revision int32 `json:"revision,omitempty"`

	// Status is the Helm release status (e.g. deployed, failed, pending-upgrade).
	// +kubebuilder:validation:Enum=unknown;deployed;uninstalled;superseded;failed;uninstalling;pending-install;pending-upgrade;pending-rollback
	// +optional
	Status string `json:"status,omitempty"`

	// ValuesChecksum is a SHA-256 hash of the rendered values used for
	// the most recent install or upgrade, enabling change detection.
	// +optional
	ValuesChecksum string `json:"valuesChecksum,omitempty"`
}

type HelmUpgradeStrategy struct {
	// Force forces resource updates through a replacement strategy.
	// +optional
	Force bool `json:"force,omitempty"`

	// CleanupOnFail rolls back changes on upgrade failure.
	// +optional
	CleanupOnFail bool `json:"cleanupOnFail,omitempty"`

	// MaxRetries is the maximum number of retries before marking the release as failed.
	// Defaults to 0 (no retries).
	// +kubebuilder:validation:Minimum=0
	// +optional
	MaxRetries *int32 `json:"maxRetries,omitempty"`

	// EnableRollback triggers an automatic rollback when an upgrade fails.
	// +optional
	EnableRollback bool `json:"enableRollback,omitempty"`
}

type InventoryEntry struct {
	// ID uniquely identifies the resource in the format
	// "<namespace>_<name>_<group>_<kind>".
	// +required
	ID string `json:"id"`

	// Version is the API version of the resource (e.g. "v1", "apps/v1").
	// +required
	Version string `json:"version"`
}

type KustomizationStatus struct {
	// LastAppliedRevision is the Git commit SHA that was last successfully
	// built and applied to the cluster.
	// +optional
	LastAppliedRevision string `json:"lastAppliedRevision,omitempty"`

	// LastAttemptedRevision is the Git commit SHA that was last attempted
	// (may differ from LastAppliedRevision on failure).
	// +optional
	LastAttemptedRevision string `json:"lastAttemptedRevision,omitempty"`
}

type KustomizationTemplate struct {
	// URL is the Git repository URL containing the kustomization.
	// Supports HTTPS and SSH URLs.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:Pattern=`^(https?://|git@|ssh://).+$`
	// +required
	URL string `json:"url"`

	// Ref specifies the Git reference to check out.
	// If not set, the default branch (usually main) is used.
	// +optional
	Ref *GitReference `json:"ref,omitempty"`

	// Path is the directory path within the repository where
	// kustomization.yaml is located. Defaults to the repository root.
	// +optional
	Path string `json:"path,omitempty"`

	// Interval at which the operator re-reconciles this kustomization.
	// +required
	Interval metav1.Duration `json:"interval"`

	// Prune enables garbage collection: resources that were previously
	// applied but are no longer present in the kustomization output
	// will be deleted from the cluster.
	// +optional
	Prune bool `json:"prune,omitempty"`

	// Force instructs the operator to recreate resources that have
	// immutable field changes, instead of failing the apply.
	// +optional
	Force bool `json:"force,omitempty"`

	// Timeout is the maximum duration for the build and apply operation.
	// Defaults to 5m if not specified.
	// +optional
	Timeout *metav1.Duration `json:"timeout,omitempty"`

	// TargetNamespace overrides the namespace for all resources in the
	// kustomization output. If empty, each resource keeps its own namespace.
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=`^([a-z0-9]([-a-z0-9]*[a-z0-9])?)$`
	// +optional
	TargetNamespace string `json:"targetNamespace,omitempty"`

	// Patches is a list of strategic merge or JSON6902 patches to apply
	// on top of the kustomization output before sending to the cluster.
	// +listType=atomic
	// +optional
	Patches []KustomizePatch `json:"patches,omitempty"`

	// SecretRef references a Secret containing credentials for the Git
	// repository. Supported keys: username + password (HTTPS), identity +
	// identity.pub + known_hosts (SSH).
	// +optional
	SecretRef *SecretReference `json:"secretRef,omitempty"`
}

type KustomizePatch struct {
	// Patch is the inline YAML patch content.
	// +kubebuilder:validation:MinLength=1
	// +required
	Patch string `json:"patch"`

	// Target selects which resources to apply the patch to.
	// If not set, the patch is applied to all matching resources.
	// +optional
	Target *PatchSelector `json:"target,omitempty"`
}

type Module struct {
	metav1.TypeMeta `json:",inline"`

	// Standard object's metadata.
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// Spec defines the desired behavior of the Module.
	// +required
	Spec ModuleSpec `json:"spec"`

	// Status represents the current information about the Module.
	// +optional
	Status ModuleStatus `json:"status,omitzero"`
}

type ModuleClass struct {
	metav1.TypeMeta `json:",inline"`

	// Standard object's metadata.
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// Spec defines the desired behavior of the ModuleClass.
	// +required
	Spec ModuleClassSpec `json:"spec"`
}

type ModuleClassList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []ModuleClass `json:"items"`
}

type ModuleClassSpec struct {
	// Description is a human-readable description of the module class.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	Description string `json:"description,omitempty"`

	// Namespace is the default target namespace where resources will be
	// deployed when a Module is instantiated from this class.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=`^([a-z0-9]([-a-z0-9]*[a-z0-9])?)$`
	// +required
	Namespace string `json:"namespace"`

	// HelmChart defines a Helm chart-based module.
	// The operator downloads the chart and manages the Helm release directly.
	// Mutually exclusive with Kustomization (enforced via CEL).
	// +optional
	HelmChart *HelmChartTemplate `json:"helmChart,omitempty"`

	// Kustomization defines a Kustomize-based module.
	// The operator clones the source, builds the kustomization, and applies
	// the manifests using server-side apply.
	// Mutually exclusive with HelmChart (enforced via CEL).
	// +optional
	Kustomization *KustomizationTemplate `json:"kustomization,omitempty"`
}

type ModuleList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []Module `json:"items"`
}

type ModuleSpec struct {
	// ModuleClassName is the name of the ModuleClass to instantiate.
	// This field is immutable after creation.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="moduleClassName is immutable"
	// +required
	ModuleClassName string `json:"moduleClassName"`

	// Namespace overrides the default target namespace defined in the ModuleClass.
	// If not specified, the namespace from the ModuleClass is used.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=`^([a-z0-9]([-a-z0-9]*[a-z0-9])?)$`
	// +optional
	Namespace *string `json:"namespace,omitempty"`

	// Values overrides the default Helm chart values for Helm-based modules.
	// Only applicable when the referenced ModuleClass uses a HelmChart.
	// Ignored for Kustomization-based modules.
	// +kubebuilder:pruning:PreserveUnknownFields
	// +optional
	Values *runtime.RawExtension `json:"values,omitempty"`

	// ApprovedClassGeneration is the ModuleClass generation that has been
	// approved for deployment. When the referenced ModuleClass's generation
	// exceeds this value, the controller will not apply changes until this field
	// is updated to match or exceed the new generation.
	//
	// Leave unset (nil) to auto-approve all class changes (legacy behavior).
	// Set explicitly to enable manual upgrade approval.
	// +optional
	ApprovedClassGeneration *int64 `json:"approvedClassGeneration,omitempty"`
}

type ModuleStatus struct {
	// ObservedGeneration is the most recent generation observed by the controller.
	// It corresponds to the Module's generation, which is updated on mutation by the API Server.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// AppliedClassGeneration is the ModuleClass generation that was last
	// successfully applied. The controller uses this to detect whether a
	// class upgrade is pending.
	// +optional
	AppliedClassGeneration int64 `json:"appliedClassGeneration,omitempty"`

	// AvailableClassGeneration is the latest generation of the referenced
	// ModuleClass. When this exceeds AppliedClassGeneration, an upgrade
	// is available.
	// +optional
	AvailableClassGeneration int64 `json:"availableClassGeneration,omitempty"`

	// Namespace is the resolved target namespace where resources are deployed.
	// It reflects the effective namespace (Module override or ModuleClass default).
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// HelmRelease captures the observed state of the Helm release
	// when the Module is backed by a HelmChart.
	// +optional
	HelmRelease *HelmReleaseStatus `json:"helmRelease,omitempty"`

	// Kustomization captures the observed state of the Kustomize-based
	// deployment when the Module is backed by a Kustomization.
	// +optional
	Kustomization *KustomizationStatus `json:"kustomization,omitempty"`

	// Inventory tracks the Kubernetes resources managed by this Module.
	// Used for garbage collection (pruning) of resources that are no longer
	// part of the desired state.
	// +listType=atomic
	// +optional
	Inventory []InventoryEntry `json:"inventory,omitempty"`

	// Conditions store the status conditions of the Module (e.g., Ready, UpgradeAvailable).
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type PatchSelector struct {
	// Group is the API group of the target resource.
	// +optional
	Group string `json:"group,omitempty"`

	// Version is the API version of the target resource.
	// +optional
	Version string `json:"version,omitempty"`

	// Kind is the kind of the target resource.
	// +optional
	Kind string `json:"kind,omitempty"`

	// Namespace of the target resource.
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// Name of the target resource.
	// +optional
	Name string `json:"name,omitempty"`

	// AnnotationSelector filters resources by annotations
	// (e.g. "config.kubernetes.io/managed-by=kustomize").
	// +optional
	AnnotationSelector string `json:"annotationSelector,omitempty"`

	// LabelSelector filters resources by labels (e.g. "app=nginx").
	// +optional
	LabelSelector string `json:"labelSelector,omitempty"`
}

type SecretReference struct {
	// Name is the name of the Secret.
	// +kubebuilder:validation:MinLength=1
	// +required
	Name string `json:"name"`
}