v1alpha1

type MemberRole string

type NetworkIsolationSpec struct {
	// Enabled toggles the enforcement of network isolation.
	// If true, ingress is denied except from the workspace's own namespace and
	// the allowed namespaces below.
	// +optional
	Enabled bool `json:"enabled"`

	// AllowedNamespaces lists external namespaces permitted to reach this workspace
	// while isolation is enabled. Include system namespaces (e.g. 'istio-system',
	// 'monitoring') here if the workloads need them.
	// +listType=set
	// +kubebuilder:validation:MaxItems=64
	// +kubebuilder:validation:items:MinLength=1
	// +kubebuilder:validation:items:MaxLength=63
	// +kubebuilder:validation:items:Pattern=`^([a-z0-9]([-a-z0-9]*[a-z0-9])?)$`
	// +optional
	AllowedNamespaces []string `json:"allowedNamespaces,omitempty"`
}

type ResourceReference struct {
	// Name is the name of the referenced resource.
	// +required
	Name string `json:"name"`

	// Namespace is the namespace of the referenced resource.
	// Empty for cluster-scoped resources.
	// +optional
	Namespace string `json:"namespace,omitempty"`
}

type Workspace struct {
	metav1.TypeMeta `json:",inline"`

	// Standard object's metadata.
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// Spec defines the desired behavior of the Workspace.
	// +required
	Spec WorkspaceSpec `json:"spec"`

	// Status represents the current information about the Workspace.
	// +optional
	Status WorkspaceStatus `json:"status,omitzero"`
}

type WorkspaceList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []Workspace `json:"items"`
}

type WorkspaceMember struct {
	// Role defines the authorization level (Admin, Edit, View).
	// +required
	Role MemberRole `json:"role"`

	// Subject is the unique identifier of the member (e.g., OIDC subject or username).
	// It is used directly as the Kubernetes RBAC Subject and as the member's Harbor
	// identity: Harbor federates against the same OIDC provider, so the two match
	// by construction.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +required
	Subject string `json:"subject"`

	// Name is the human-readable display name of the member.
	// +optional
	Name *string `json:"name,omitempty"`

	// ServiceAccount indicates whether this member is a service account
	// rather than a human user.
	// +optional
	ServiceAccount bool `json:"serviceAccount,omitempty"`
}

type WorkspaceSpec struct {
	// Namespace is the Kubernetes Namespace created for this workspace, and must
	// be unique across all Workspaces.
	// When omitted, a 6-character name is auto-generated by the mutating webhook.
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=`^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="namespace is immutable"
	// +kubebuilder:validation:XValidation:rule="!(self in ['default','kube-system','kube-public','kube-node-lease','otterscale-system'])",message="namespace is reserved and cannot be used for a workspace"
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// Members is the list of members granted access to this workspace.
	// +listType=atomic
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:XValidation:rule="self.exists(u, u.role == 'admin')",message="at least one workspace member must have role 'admin'"
	// +required
	Members []WorkspaceMember `json:"members"`

	// ResourceQuota defines the resource constraints applied to the namespace.
	// +optional
	ResourceQuota *corev1.ResourceQuotaSpec `json:"resourceQuota,omitempty"`

	// LimitRange defines the default resource limits and requests for the workspace's pods.
	// +optional
	LimitRange *corev1.LimitRangeSpec `json:"limitRange,omitempty"`

	// NetworkIsolation defines the ingress traffic rules for the workspace.
	// +optional
	NetworkIsolation NetworkIsolationSpec `json:"networkIsolation,omitzero"`
}

type WorkspaceStatus struct {
	// ObservedGeneration is the most recent Workspace generation the controller
	// processed, so clients can tell whether the latest spec change took effect.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// NamespaceRef is a reference to the Namespace managed by this Workspace.
	// +optional
	NamespaceRef *ResourceReference `json:"namespaceRef,omitempty"`

	// ResourceQuotaRef is a reference to the ResourceQuota managed by this Workspace.
	// +optional
	ResourceQuotaRef *ResourceReference `json:"resourceQuotaRef,omitempty"`

	// LimitRangeRef is a reference to the LimitRange managed by this Workspace.
	// +optional
	LimitRangeRef *ResourceReference `json:"limitRangeRef,omitempty"`

	// RoleBindingRefs references the RBAC RoleBindings created for the members.
	// +listType=map
	// +listMapKey=name
	// +optional
	RoleBindingRefs []ResourceReference `json:"roleBindingRefs,omitempty"`

	// NetworkPolicyRef is a reference to the NetworkPolicy enforcing network isolation.
	// +optional
	NetworkPolicyRef *ResourceReference `json:"networkPolicyRef,omitempty"`

	// ImagePullSecretRef is a reference to the docker-registry Secret holding the
	// Harbor robot credentials for image pull/push.
	// +optional
	ImagePullSecretRef *ResourceReference `json:"imagePullSecretRef,omitempty"`

	// HelmRepositoryRef is a reference to the FluxCD HelmRepository for the
	// workspace's Harbor OCI registry.
	// +optional
	HelmRepositoryRef *ResourceReference `json:"helmRepositoryRef,omitempty"`

	// Conditions holds the Workspace's status conditions (e.g. Ready).
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}