v1alpha1

type MemberRole string

type NetworkIsolationSpec struct {
	// Enabled toggles the enforcement of network isolation.
	// If true, default deny-all ingress rules are applied except for allowed namespaces.
	// +optional
	Enabled bool `json:"enabled"`

	// AllowedNamespaces specifies a list of external namespaces permitted to access this workspace
	// when isolation is enabled. Essential system namespaces (e.g., 'istio-system', 'monitoring')
	// should be included here if required.
	// +listType=set
	// +kubebuilder:validation:MaxItems=64
	// +kubebuilder:validation:items:MinLength=1
	// +kubebuilder:validation:items:MaxLength=63
	// +kubebuilder:validation:items:Pattern=`^([a-z0-9]([-a-z0-9]*[a-z0-9])?)$`
	// +optional
	AllowedNamespaces []string `json:"allowedNamespaces,omitempty"`
}

type ResourceReference struct {
	// Name is the name of the referenced resource.
	// +required
	Name string `json:"name"`

	// Namespace is the namespace of the referenced resource.
	// Empty for cluster-scoped resources.
	// +optional
	Namespace string `json:"namespace,omitempty"`
}

type Workspace struct {
	metav1.TypeMeta `json:",inline"`

	// Standard object's metadata.
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// Spec defines the desired behavior of the Workspace.
	// +required
	Spec WorkspaceSpec `json:"spec"`

	// Status represents the current information about the Workspace.
	// +optional
	Status WorkspaceStatus `json:"status,omitzero"`
}

type WorkspaceList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []Workspace `json:"items"`
}

type WorkspaceMember struct {
	// Role defines the authorization level (Admin, Edit, View).
	// +required
	Role MemberRole `json:"role"`

	// Subject is the unique identifier of the member (e.g., OIDC subject or username).
	// This identifier maps directly to the Kubernetes RBAC Subject.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +required
	Subject string `json:"subject"`

	// Username is the member's Harbor registry username.
	// When set, this value is used as the Harbor project member identity
	// instead of Subject.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +optional
	Username *string `json:"username,omitempty"`

	// Name is the human-readable display name of the member.
	// +optional
	Name *string `json:"name,omitempty"`

	// ServiceAccount indicates whether this member is a service account
	// rather than a human user.
	// +optional
	ServiceAccount bool `json:"serviceAccount,omitempty"`
}

type WorkspaceSpec struct {
	// Namespace is the name of the Kubernetes Namespace to be created for this workspace.
	// It must be unique across all Workspaces.
	// When omitted, a 6-character name is auto-generated by the mutating webhook.
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=`^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="namespace is immutable"
	// +kubebuilder:validation:XValidation:rule="!(self in ['default','kube-system','kube-public','kube-node-lease','otterscale-system'])",message="namespace is reserved and cannot be used for a workspace"
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// Members is the list of members granted access to this workspace.
	// +listType=atomic
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:XValidation:rule="self.exists(u, u.role == 'admin')",message="at least one workspace member must have role 'admin'"
	// +required
	Members []WorkspaceMember `json:"members"`

	// ResourceQuota defines the compute resource constraints (CPU, Memory, etc.) applied to the underlying namespace.
	// +optional
	ResourceQuota *corev1.ResourceQuotaSpec `json:"resourceQuota,omitempty"`

	// LimitRange defines the default resource limits and requests for pods in the workspace.
	// +optional
	LimitRange *corev1.LimitRangeSpec `json:"limitRange,omitempty"`

	// NetworkIsolation defines the ingress traffic rules for the workspace.
	// +optional
	NetworkIsolation NetworkIsolationSpec `json:"networkIsolation,omitzero"`
}

type WorkspaceStatus struct {
	// ObservedGeneration is the most recent generation observed by the controller.
	// It corresponds to the Workspace's generation, which is updated on mutation by the API Server.
	// This allows clients to determine whether the controller has processed the latest spec changes.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// NamespaceRef is a reference to the Namespace managed by this Workspace.
	// +optional
	NamespaceRef *ResourceReference `json:"namespaceRef,omitempty"`

	// ResourceQuotaRef is a reference to the ResourceQuota managed by this Workspace.
	// +optional
	ResourceQuotaRef *ResourceReference `json:"resourceQuotaRef,omitempty"`

	// LimitRangeRef is a reference to the LimitRange managed by this Workspace.
	// +optional
	LimitRangeRef *ResourceReference `json:"limitRangeRef,omitempty"`

	// ConfigMapRef is a reference to the ConfigMap managed by this Workspace.
	// +optional
	ConfigMapRef *ResourceReference `json:"configMapRef,omitempty"`

	// RoleBindingRefs contains references to all RBAC RoleBindings created for the workspace members.
	// +listType=map
	// +listMapKey=name
	// +optional
	RoleBindingRefs []ResourceReference `json:"roleBindingRefs,omitempty"`

	// NetworkPolicyRef is a reference to the NetworkPolicy enforcing network isolation.
	// +optional
	NetworkPolicyRef *ResourceReference `json:"networkPolicyRef,omitempty"`

	// ImagePullSecretRef is a reference to the docker-registry Secret
	// containing Harbor robot credentials for image pull/push.
	// +optional
	ImagePullSecretRef *ResourceReference `json:"imagePullSecretRef,omitempty"`

	// HelmRepositoryRef is a reference to the FluxCD HelmRepository for this workspace's Harbor OCI registry.
	// +optional
	HelmRepositoryRef *ResourceReference `json:"helmRepositoryRef,omitempty"`

	// Conditions store the status conditions of the Workspace (e.g., Ready, Failed).
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}