model

const (
	// Name allows customizing the human-readable route name
	Name = "name"
	// TLSCustomCASecret replaces https://pomerium.io/reference/#tls-custom-certificate-authority
	//nolint: gosec
	TLSCustomCASecret = "tls_custom_ca_secret"
	// TLSClientSecret replaces https://pomerium.io/reference/#tls-client-certificate
	//nolint: gosec
	TLSClientSecret = "tls_client_secret"
	// TLSDownstreamClientCASecret replaces https://pomerium.io/reference/#tls-downstream-client-certificate-authority
	TLSDownstreamClientCASecret = "tls_downstream_client_ca_secret"
	// TLSServerName is annotation to override TLS server name
	TLSServerName = "tls_server_name"
	// SecureUpstream indicate that service communication should happen over HTTPS
	SecureUpstream = "secure_upstream"
	// PathRegex indicates that paths of ImplementationSpecific type should be treated as regular expression
	PathRegex = "path_regex"
	// UseServiceProxy will use standard k8s service proxy as upstream, opposed to individual endpoints
	UseServiceProxy = "service_proxy_upstream"
	// SSHUpstream indicates this route is for natively-proxied SSH https://www.pomerium.com/docs/capabilities/native-ssh-access
	SSHUpstream = "ssh_upstream"
	// TCPUpstream indicates this route is for TCP tunneled over HTTP https://www.pomerium.com/docs/tcp/
	TCPUpstream = "tcp_upstream"
	// UDPUpstream indicates this route is for UDP tunneled over HTTP https://www.pomerium.com/docs/capabilities/udp/
	UDPUpstream = "udp_upstream"
	// SubtleAllowEmptyHost is a required annotation when creating an ingress containing
	// rules with an empty (catch-all) host, as it can cause unexpected behavior
	SubtleAllowEmptyHost = "subtle_allow_empty_host"
	// KubernetesServiceAccountTokenSecret allows k8s service authentication via pomerium
	//nolint: gosec
	KubernetesServiceAccountTokenSecret = "kubernetes_service_account_token_secret"
	// KubernetesServiceAccountTokenSecretKey defines key within the secret that contains token
	KubernetesServiceAccountTokenSecretKey = "token"
	// SetRequestHeadersSecret defines a secret to copy request headers from
	SetRequestHeadersSecret = "set_request_headers_secret"
	// SetResponseHeadersSecret defines a secret to copy response headers from
	SetResponseHeadersSecret = "set_response_headers_secret"
	// StorageConnectionStringKey represents a secret that must be present in the Storage Secret
	StorageConnectionStringKey = "connection"
	// CAKey is certificate authority secret key
	CAKey = "ca.crt"
	// SSHPrivateKey is the ssh privatekey secret key
	SSHPrivateKey = "ssh-privatekey"
	// MCPServer indicates this route is an MCP server without any additional configuration
	MCPServer = "mcp_server"
	// MCPClient indicates this route is an MCP client without any additional configuration
	MCPClient = "mcp_client"
	// MCPServerMaxRequestBytes sets the maximum request body size for MCP server routes
	MCPServerMaxRequestBytes = "mcp_server_max_request_bytes"
	// MCPServerUpstreamOAuth2AuthorizationURLParams sets the OAuth2 authorization url params for MCP server authentication
	MCPServerUpstreamOAuth2AuthorizationURLParams = "mcp_server_upstream_oauth2_authorization_url_params"
	// MCPServerUpstreamOAuth2Secret references a secret containing OAuth2 configuration for MCP server upstream authentication
	MCPServerUpstreamOAuth2Secret = "mcp_server_upstream_oauth2_secret" //nolint: gosec
	// MCPServerUpstreamOAuth2AuthURL sets the OAuth2 token URL for MCP server upstream authentication
	MCPServerUpstreamOAuth2AuthURL = "mcp_server_upstream_oauth2_auth_url"
	// MCPServerUpstreamOAuth2TokenURL sets the OAuth2 token URL for MCP server upstream authentication
	MCPServerUpstreamOAuth2TokenURL = "mcp_server_upstream_oauth2_token_url" //nolint: gosec
	// MCPServerUpstreamOAuth2Scopes sets the OAuth2 scopes for MCP server upstream authentication
	MCPServerUpstreamOAuth2Scopes = "mcp_server_upstream_oauth2_scopes"
	// MCPServerPath sets the path property for MCP server routes
	MCPServerPath = "mcp_server_path"
	// MCPServerAuthorizationServerURL sets the authorization server URL for MCP server upstream OAuth2.
	// When set, Pomerium uses this URL directly instead of performing RFC 9728 auto-discovery.
	MCPServerAuthorizationServerURL = "mcp_server_authorization_server_url"
	// MCPServerUpstreamOAuth2AuthStyle sets the OAuth2 authentication style for upstream token exchange.
	// Valid values: "in_params" (client credentials in POST body), "in_header" (HTTP Basic Auth).
	// Defaults to auto-detect when not set.
	MCPServerUpstreamOAuth2AuthStyle = "mcp_server_upstream_oauth2_auth_style"
	// MCPServerUpstreamOAuth2ClientIDKey defines the key within the OAuth2 secret that contains the client ID
	MCPServerUpstreamOAuth2ClientIDKey = "client_id"
	// MCPServerUpstreamOAuth2ClientSecretKey defines the key within the OAuth2 secret that contains the client secret
	MCPServerUpstreamOAuth2ClientSecretKey = "client_secret"
	// IdentityProviderSecret defines a secret to set the idp_client_id and idp_client_secret from.
	IdentityProviderSecret = "identity_provider_secret"
	// IdentityProviderClientIDKey is the client id key in the IdentityProviderSecret.
	IdentityProviderClientIDKey = "client_id"
	// IdentityProviderClientSecretKey is the client secret key in the IdentityProviderSecret.
	IdentityProviderClientSecretKey = "client_secret"
	// UpstreamTunnel sets the upstream tunnel property.
	UpstreamTunnel = "upstream_tunnel"
	// UpstreamTunnelSSHPolicy sets the upstream tunnel ssh policy property.
	UpstreamTunnelSSHPolicy = "upstream_tunnel_ssh_policy"
)