v1beta2

type ActivePeriod struct {
	ActiveFrom  *metav1.Time `json:"from,omitempty"`
	ActiveUntil *metav1.Time `json:"until,omitempty"`
}

type GlobalResourcePermitTemplate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   GlobalResourcePermitTemplateSpec   `json:"spec"`
	Status GlobalResourcePermitTemplateStatus `json:"status,omitempty"`
}

type GlobalResourcePermitTemplateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []GlobalResourcePermitTemplate `json:"items"`
}

type GlobalResourcePermitTemplateReference = ResourcePermitTemplateReference

type GlobalResourcePermitTemplateSpec struct {
	// Impersonation identifies the required ServiceAccount used for context loading
	// and every managed-resource action, including cleanup. Namespaced templates
	// use a ServiceAccount in their own namespace; global templates specify both
	// name and namespace. There is no default execution identity.
	// +kubebuilder:validation:Required
	Impersonation *meta.NamespacedRFC1123ObjectReferenceWithNamespace `json:"impersonation"`

	// NamespaceSelectors limit the namespaces in which ResourcePermits may reference this template.
	// Selectors are ORed. When omitted, the template is available in every namespace.
	// +optional
	NamespaceSelectors []selectors.NamespaceSelector `json:"namespaceSelectors,omitempty"`

	// Resources rendered and managed by this template.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinItems=1
	Resources []apiruntime.ResourceTemplate `json:"resources"`

	// ParamSchema is the JSON Schema used to validate template parameters.
	// Properties may use the x-capsule-form vendor extension to select values
	// from arbitrary Kubernetes GVKs in compatible form clients. The schema may
	// use x-kubernetes-validations for Kubernetes-compatible CEL rules.
	ParamSchema *k8sruntime.RawExtension `json:"paramSchema,omitempty"`

	// Context loads additional Kubernetes resources for use by all resource targets and templates.
	// Resource reference fields may use parameters declared by ParamSchema.
	// +optional
	Context *tpl.TemplateContext `json:"context,omitempty"`

	// The default duration of the ResourcePermit referencing this template should be valid for. If not set,
	// the resource will be kept until the request is deleted.
	DefaultDuration *metav1.Duration `json:"defaultDuration,omitempty"`
	// The max allowed duration of the ResourcePermit referencing this template should be valid for.
	MaxDuration *metav1.Duration `json:"maxDuration,omitempty"`

	// The duration of this ResourcePermit will be kept in the system after it has been expired (eg. auditing purposes)
	// If not set, the ResourcePermit will be deleted after expiring.
	KeepFor *resourcepermit.ExtendedDuration `json:"keepFor,omitempty"`

	// Approvals configures automatic and manual approval of requests using this template.
	// +optional
	Approvals resourcepermit.ApprovalSpec `json:"approvals,omitempty"`
}

type GlobalResourcePermitTemplateStatus struct {
	// ObservedGeneration is the most recent generation resolved by the controller.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Namespaces contains the namespaces allowed to reference this template.
	// A single "*" entry means that the template is available in every namespace.
	// +optional
	Namespaces []string `json:"namespaces,omitempty"`

	// Conditions contains the reconciliation conditions for this template.
	// +optional
	Conditions meta.ConditionList `json:"conditions,omitempty"`
}

type ResolvedGlobalResourcePermitTemplateReference = ResolvedResourcePermitTemplateReference

type ResolvedResourcePermitTemplateReference struct {
	ResourcePermitTemplateReference `json:",inline"`

	// ResourceVersion of the template used to render the request resources.
	// +kubebuilder:validation:Required
	ResourceVersion string `json:"resourceVersion"`
}

type ResourcePermit struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ResourcePermitSpec   `json:"spec,omitempty"`
	Status ResourcePermitStatus `json:"status,omitempty"`
}

type ResourcePermitFailure struct {
	// Stage identifies whether the failure happened before review or while
	// activating an already approved request.
	// +kubebuilder:validation:Enum=Preflight;Activation
	Stage ResourcePermitFailureStage `json:"stage"`
	// RetryPhase is the phase Capsule resumes after recovery succeeds.
	// +kubebuilder:validation:Enum=Requested;Approved
	RetryPhase ResourcePermitPhase `json:"retryPhase"`
	// Reason is the stable machine-readable Ready condition reason.
	Reason string `json:"reason"`
	// Message contains the latest actionable failure returned by Kubernetes.
	Message string `json:"message"`
}

type ResourcePermitFailureStage string

type ResourcePermitList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []ResourcePermit `json:"items"`
}

type ResourcePermitPhase string

type ResourcePermitSpec struct {
	// Template references the template to use for this request.
	// +kubebuilder:validation:Required
	Template ResourcePermitTemplateReference `json:"template"`
	// Params the parameters to use for the template.
	Params *k8sruntime.RawExtension `json:"params,omitempty"`
	// Requesting actor for the resource permit.
	Requestor resourcepermit.AccessEntity `json:"requestor,omitempty"`
	// A reason on why the request is needed
	Reason string `json:"reason,omitempty"`
	// The duration of this ResourcePermit should be valid for.
	// If no duration was defined, the lifecycle is bound to the request itself -
	// if the request is deleted, it's the end of the duration.
	// The Request can also be Terminated by another automation via calling the ExpirePermit() API-Function.
	Duration *metav1.Duration `json:"duration,omitempty"`
	// Optional point in time when the permit should become active. Must be in the future.
	// If omitted, this is set to the current time. The Request must already be approved before the start time.
	// +optional
	// +kubebuilder:validation:Format=date-time
	// +kubebuilder:validation:Type=string
	StartTime *metav1.Time `json:"startTime,omitempty"`
}

type ResourcePermitStatus struct {
	meta.ManagedResourcesStatus `json:",inline"`

	// Request contains the resolved template, execution identity, lifecycle
	// properties, and rendered resources presented for review.
	// +optional
	Request *ResourcePermitStatusRequest `json:"request,omitempty"`

	// Review refers to the subject that either approved or denied the request
	Review *ReviewInfo `json:"review,omitempty"`
	// Failure describes a recoverable preflight or activation failure. RetryPhase
	// is the trusted lifecycle phase Capsule resumes after a successful retry.
	// +optional
	Failure *ResourcePermitFailure `json:"failure,omitempty"`
	// Shows timestamps between approval and termination of the request.
	Active *ActivePeriod `json:"active,omitempty"`
	// The time until which the ResourcePermit should be retained after it expires (e.g. for auditing).
	// If unset, the ResourcePermit can be deleted immediately after expiring.
	KeepUntil *metav1.Time `json:"keepUntil,omitempty"`
	// Transitions is the chronological, append-only audit trail of lifecycle
	// changes. Conditions remain reserved for operational state such as Ready.
	// +optional
	Transitions []ResourcePermitTransition `json:"transitions,omitempty"`
	// Conditions describes current operational state such as readiness.
	Conditions []metav1.Condition `json:"conditions,omitempty"`
	// +kubebuilder:validation:Enum=Created;Requested;Pending;Denied;Approved;Active;Failed;Retrying;Expired
	Phase ResourcePermitPhase `json:"phase,omitempty"`
}

type ResourcePermitStatusRequest struct {
	// Template identifies the exact template version used to render the request.
	// +optional
	Template *ResolvedResourcePermitTemplateReference `json:"template,omitempty"`

	// Impersonation is the resolved identity used for template context loading
	// and managed-resource actions. It is copied from the template before preflight
	// and retained for the request's lifecycle, including cleanup.
	// +optional
	Impersonation *meta.NamespacedRFC1123ObjectReferenceWithNamespace `json:"impersonation,omitempty"`

	// Approvals is the approval policy copied from the resolved template. It is
	// immutable after rendering so an in-flight request is reviewed against the
	// policy presented with its resource snapshot.
	// +optional
	Approvals *resourcepermit.ApprovalSpec `json:"approvals,omitempty"`

	KeepFor   *resourcepermit.ExtendedDuration `json:"keepFor,omitempty"`
	Duration  *metav1.Duration                 `json:"duration,omitempty"`
	StartTime *metav1.Time                     `json:"startTime,omitempty"`
	// Resources contains the fully rendered manifests prepared for this request.
	// These resources are the source of truth for server-side apply and pruning;
	// source templates and rendering context are never copied into the request.
	Resources []apiruntime.RenderedResource `json:"resources,omitempty"`
}

type ResourcePermitTemplate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ResourcePermitTemplateSpec   `json:"spec"`
	Status ResourcePermitTemplateStatus `json:"status,omitempty"`
}

type ResourcePermitTemplateData struct {
	Resources       []apiruntime.ResourceTemplate
	ParamSchema     *k8sruntime.RawExtension
	Context         *tpl.TemplateContext
	DefaultDuration *metav1.Duration
	MaxDuration     *metav1.Duration
	KeepFor         *resourcepermit.ExtendedDuration
	Approvals       resourcepermit.ApprovalSpec
}

type ResourcePermitTemplateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []ResourcePermitTemplate `json:"items"`
}

type ResourcePermitTemplateReference struct {
	// Kind of template being referenced.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=ResourcePermitTemplate;GlobalResourcePermitTemplate
	Kind string `json:"kind"`
	// Name of the template being referenced.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
	Name string `json:"name"`
}

type ResourcePermitTemplateSource interface {
	metav1.Object

	TemplateData() ResourcePermitTemplateData
	ValidateApprovalConditions() error
	EvaluateApprovalConditions(ctx context.Context, br *ResourcePermit) (bool, error)
	CheckApprovalConditions(ctx context.Context, br *ResourcePermit) error
}

type ResourcePermitTemplateSpec struct {
	// Impersonation identifies the required ServiceAccount used for context loading
	// and every managed-resource action, including cleanup. Namespaced templates
	// use a ServiceAccount in their own namespace; global templates specify both
	// name and namespace. There is no default execution identity.
	// +kubebuilder:validation:Required
	Impersonation *meta.LocalRFC1123ObjectReference `json:"impersonation"`

	// Resources rendered and managed by this template.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinItems=1
	Resources []apiruntime.ResourceTemplate `json:"resources"`

	// ParamSchema is the JSON Schema used to validate template parameters.
	// Properties may use the x-capsule-form vendor extension to select values
	// from arbitrary Kubernetes GVKs in compatible form clients. The schema may
	// use x-kubernetes-validations for Kubernetes-compatible CEL rules.
	ParamSchema *k8sruntime.RawExtension `json:"paramSchema,omitempty"`

	// Context loads additional Kubernetes resources for use by all resource targets and templates.
	// Resource reference fields may use parameters declared by ParamSchema.
	// +optional
	Context *tpl.TemplateContext `json:"context,omitempty"`

	// The default duration of a ResourcePermit referencing this template.
	DefaultDuration *metav1.Duration `json:"defaultDuration,omitempty"`
	// The maximum allowed duration of a ResourcePermit referencing this template.
	MaxDuration *metav1.Duration `json:"maxDuration,omitempty"`

	// The duration a ResourcePermit is retained after it expires for auditing.
	KeepFor *resourcepermit.ExtendedDuration `json:"keepFor,omitempty"`

	// Approvals configures automatic and manual approval of requests using this template.
	// +optional
	Approvals resourcepermit.ApprovalSpec `json:"approvals,omitempty"`
}

type ResourcePermitTemplateStatus struct {
	// ObservedGeneration is the most recent generation resolved by the controller.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions contains the reconciliation conditions for this template.
	// +optional
	Conditions meta.ConditionList `json:"conditions,omitempty"`
}

type ResourcePermitTransition struct {
	// Type identifies the lifecycle state entered by this transition. The
	// previous state can be derived from the preceding chronological entry.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=Created;Requested;Pending;Denied;Approved;Active;Failed;Retrying;Expired
	Type ResourcePermitPhase `json:"type"`
	// Timestamp is when the transition was requested or performed.
	// +kubebuilder:validation:Required
	Timestamp metav1.Time `json:"timestamp"`
	// Actor is the authenticated user, ServiceAccount, or Capsule system actor
	// responsible for the transition. Group claims are deliberately not copied
	// into the audit trail.
	// +kubebuilder:validation:Required
	Actor ResourcePermitTransitionActor `json:"actor"`
	// Reason is a stable machine-readable explanation of the transition.
	// +kubebuilder:validation:Required
	Reason string `json:"reason"`
	// Message is the human-readable explanation of the transition.
	// +optional
	Message string `json:"message,omitempty"`
	// EventTime is set after Capsule emits the Kubernetes lifecycle event for
	// this transition.
	// +optional
	EventTime *metav1.Time `json:"eventTime,omitempty"`
}

type ResourcePermitTransitionActor struct {
	// Name is the authenticated actor name.
	// +kubebuilder:validation:Required
	Name string `json:"name"`
	// Type identifies the kind of authenticated actor.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=User;Group;System;ServiceAccount
	Type resourcepermit.AccessEntityType `json:"type"`
}

type ResourcePermitVerdict string

type ReviewInfo struct {
	// The Entity reviewing this request
	Reviewer *resourcepermit.AccessEntity `json:"reviewer,omitempty"`
	// The verdict made by the reviewing entity
	// +kubebuilder:validation:Enum=Pending;Denied;Approved
	Verdict ResourcePermitVerdict `json:"verdict,omitempty"`
	// Message with the review
	Message string `json:"message,omitempty"`
}