config

type AWS struct {
	Account string `json:"account,omitempty"`
	Region  string `json:"region,omitempty"`
	// FunctionName is the Lambda function the `invoke` trigger names (through its `live` alias).
	// Unset is `sluis-<instance>-issuer`. Prefer Functions["issuer"]; this one is kept for
	// estates that already set it.
	FunctionName string `json:"functionName,omitempty"`
	// Functions name the functions by module (issuer, github, slack, google,
	// cloudflare, backup) when [RenderModules] is the renderer. Unset is
	// `sluis-<instance>-<module>`. The issuer's call to each names it
	// (`<module>.remote`).
	Functions map[string]string `json:"functions,omitempty"`
	// Table is the DynamoDB table of the `dynamodb` state adapter.
	Table string `json:"table,omitempty"`
	// Bucket is the S3 bucket of the `s3` blobs adapter.
	Bucket string `json:"bucket,omitempty"`
	// AuditQueueURL is the SQS queue of the `sqs` audit adapter.
	AuditQueueURL string `json:"auditQueueURL,omitempty"`
}

type AWSAccount struct {
	Account string   `json:"account"`
	Name    string   `json:"name"`
	Issuer  string   `json:"issuer"`
	JWKSURI string   `json:"jwksUri,omitempty"`
	OrgID   string   `json:"orgId,omitempty"`
	Algs    []string `json:"algs,omitempty"`
}

type Access struct{ policy.Policy }

type AdapterChoice = internal.AdapterChoice

type AgentLifetimes = internal.AgentLifetimes

type Apps struct{ internal.PolicyApps }

type Audit = internal.Audit

type Bootstrap struct {
	// Recovery is the account that holds the break-glass groups.
	Recovery *BootstrapRecovery
	// Viewers is the group of everyone who may look, and the people and
	// workloads it admits beside the matrix's own.
	Viewers *BootstrapViewers
	// Controllers are the workloads that run the directory controllers.
	Controllers *BootstrapControllers
	// Probe is the workload that proves the exchange.
	Probe *BootstrapProbe
	// GenerateSecrets writes every confidential client's secret as
	// `{generate: true}` and not as the name the access document gives. The
	// issuer then makes and keeps the value.
	GenerateSecrets bool
	// Claims is the claims table: what a group adds to a token. The access
	// document has no such table, so it is carried through unchanged.
	Claims map[string]policy.Fragment
}

type BootstrapControllers struct {
	// Group is that group's name. It must not be a group of the access
	// matrix: a person placed there would be served as a controller.
	Group string
	// ServiceAccounts is the release's ServiceAccount on Kubernetes.
	ServiceAccounts []BootstrapServiceAccount
	// RoleARNs are the functions' roles on Lambda.
	RoleARNs []string
}

type BootstrapProbe struct {
	// Group is the group the workload joins. It must not be a group of the
	// access matrix.
	Group string
	// Client is the exchange client, which requires Group. It must not be a
	// client of the access matrix.
	Client string
	// ServiceAccount is the probe's account. Its cluster is required.
	ServiceAccount BootstrapServiceAccount
}

type BootstrapRecovery struct {
	ServiceAccount BootstrapServiceAccount
	// Groups are the groups the account joins, for example the operator
	// group and one cluster's auditor group. They may be groups of the
	// access matrix.
	Groups []string
}

type BootstrapServiceAccount struct {
	// Cluster narrows the account to one named cluster. Empty matches any.
	Cluster string
	// Namespace and Name are the account's, both required.
	Namespace string
	Name      string
}

type BootstrapViewers struct {
	// Group is the group's name. It may be a group of the access matrix.
	Group string
	// EmailDomain admits every signed-in address of one domain.
	EmailDomain string
	// ServiceAccounts and RoleARNs are the workloads admitted besides the
	// controllers, which join the group on their own row.
	ServiceAccounts []BootstrapServiceAccount
	// RoleARNs are IAM roles, `arn:aws:iam::<account>:role/[path/]<name>`.
	RoleARNs []string
}

type Cloudflare struct {
	internal.Cloudflare
	// Grants say which group or CI job may ask for which preset.
	Grants []internal.CloudflareGrant `json:"grants,omitempty"`
}

type CloudflareAccount = internal.CloudflareAccount

type CloudflareGrant = internal.CloudflareGrant

type CloudflarePreset = internal.CloudflarePreset

type CloudflareSection = internal.Cloudflare

type Console = internal.Console

type Controllers struct {
	GitHub *GitHubController `json:"github,omitempty"`
	Slack  *SlackController  `json:"slack,omitempty"`
}

type DeclaredSecret = internal.DeclaredSecret

type Directory = internal.Directory

type Document = internal.Document

type Duration = duration.Duration

type Exchange struct {
	Audience string             `json:"audience,omitempty"`
	Clusters []FederatedCluster `json:"clusters,omitempty"`
	AWS      *FederatedAWS      `json:"aws,omitempty"`
	GitHub   *ExchangeGitHub    `json:"github,omitempty"`
}

type ExchangeGitHub struct {
	Owners []string `json:"owners,omitempty"`
}

type FederatedAWS struct {
	Audience string       `json:"audience,omitempty"`
	MaxAge   *Duration    `json:"maxAge,omitempty"`
	Accounts []AWSAccount `json:"accounts,omitempty"`
}

type FederatedCluster struct {
	Name    string `json:"name"`
	Issuer  string `json:"issuer"`
	JWKSURI string `json:"jwksUri,omitempty"`
}

type Freshness = internal.Freshness

type GitHubController struct {
	internal.GitHubController
	EnabledOrgs []string `json:"enabledOrgs,omitempty"`
	// AppRefs names, by organisation, the catalogue App whose key the
	// organisation's record refers to. Optional: an organisation that was
	// connected with an App of its own keeps naming it, so an entry is
	// needed only to name another App or to declare an organisation anew.
	AppRefs map[string]string `json:"appRefs,omitempty"`
	// AppNames names, by organisation, the App created for an organisation
	// the github table binds (at most 34 characters). Optional: an
	// organisation with no entry gets the built-in default.
	AppNames map[string]string `json:"appNames,omitempty"`
}

type Installation struct {
	// APIVersion is [InstallationVersion].
	APIVersion string `json:"apiVersion"`
	// Instance is the installation's name (`acme`, `prod`). Its SSM root is
	// /sluis/<instance>.
	Instance string `json:"instance"`
	// Shape is where it runs.
	Shape Shape `json:"shape"`
	// Preset names the adapters of a whole platform. Unset follows the shape:
	// aws-hybrid (lambda), k8s-aws (kubernetes with `aws`), k8s-openbao
	// (kubernetes with `openbao`), k8s-minimal, server.
	Preset string `json:"preset,omitempty"`
	// Release is the name the installation's objects carry. Unset is `sluis`.
	Release string `json:"release,omitempty"`
	// Cluster names the cluster in a ServiceAccount's subject.
	Cluster string `json:"cluster,omitempty"`
	// PolicyFile is where the service finds the policy document. Unset follows
	// the shape.
	PolicyFile string `json:"policyFile,omitempty"`

	Issuer    Issuer     `json:"issuer"`
	Log       *Log       `json:"log,omitempty"`
	Lifetimes *Lifetimes `json:"lifetimes,omitempty"`
	Freshness *Freshness `json:"freshness,omitempty"`
	// Secrets is the service document's `secrets`, for a platform with no
	// secrets adapter of its own. Shape lambda fills it (ssm, the instance's
	// root) and refuses another value.
	Secrets *Secrets `json:"secrets,omitempty"`

	// AWS is the account and the resources the installation is built on.
	AWS *AWS `json:"aws,omitempty"`
	// OpenBao is the OpenBao the secrets are kept in.
	OpenBao *OpenBao `json:"openbao,omitempty"`
	// Adapters name single concerns over what the preset and the resources
	// above give.
	Adapters map[string]AdapterChoice `json:"adapters,omitempty"`

	// Keys says which key serves which purpose (the service document's
	// `keys`). With `signingKey.kmsWrapped` and no `keys`, the sign key is
	// alias/sluis-<instance>-sign on kms.
	Keys        *keys.Config `json:"keys,omitempty"`
	SigningKey  *SigningKey  `json:"signingKey,omitempty"`
	Recovery    *Recovery    `json:"recovery,omitempty"`
	Login       *Login       `json:"login,omitempty"`
	Console     *Console     `json:"console,omitempty"`
	OAuthClient *OAuthClient `json:"oauthClient,omitempty"`
	Valkey      *Valkey      `json:"valkey,omitempty"`
	Directory   *Directory   `json:"directory,omitempty"`
	Audit       *Audit       `json:"audit,omitempty"`
	// Cloudflare is sluis as the STS for Cloudflare tokens and R2 credentials:
	// the accounts and presets go to the service document's `cloudflare`, the
	// grants to the policy document's.
	Cloudflare *Cloudflare `json:"cloudflare,omitempty"`

	// Exchange is how the token exchange verifies workloads and whom it trusts.
	Exchange *Exchange `json:"exchange,omitempty"`
	// Apps is what an operator may make on the console.
	Apps *Apps `json:"apps,omitempty"`
	// Controllers are the controllers that run, and what each may change.
	Controllers *Controllers `json:"controllers,omitempty"`
	// Access is the access model's tables: groups, clients, resources and the
	// GitHub and Slack bindings.
	Access *Access `json:"access,omitempty"`
}

type Issuer struct {
	// URL is the issuer (`issuerURL`).
	URL string `json:"url"`
	// ConsoleURL is `publicURL`. Unset is URL plus /console.
	ConsoleURL string `json:"consoleURL,omitempty"`
	// RootURL is `publicRootURL`. Unset is URL.
	RootURL string `json:"rootURL,omitempty"`
	// SecureCookies is `secureCookies`.
	SecureCookies *bool `json:"secureCookies,omitempty"`
	// GroupsScoping is `groupsScoping`: off, report or enforce.
	GroupsScoping string `json:"groupsScoping,omitempty"`
}

type Lifetimes = internal.Lifetimes

type Log = internal.Log

type Login = internal.Login

type MarshalOptions struct {
	// Header is a comment block written before the document. Each line is
	// written as a YAML comment (`# ` is added to a line that does not start
	// with `#`), and the block ends with a line break. The caller owns its
	// text; it is not part of the document and the loader ignores it.
	Header string
}

type ModuleDocuments struct {
	// Issuer is the issuer's service document (sluis/v3): [Render]'s with the
	// modules it calls elsewhere, `github.remote`, `slack.remote`, `google.remote`
	// and `cloudflare.remote`, naming the functions; what the modules own
	// (`controllers`, `directory`, the Cloudflare accounts and presets) is not in it.
	Issuer []byte
	// Policy is the policy document (policy/v2) every function that decides by
	// it reads from the same file.
	Policy []byte
	// Modules are the service documents of the module functions, by
	// [Modules]: controller-github/v2, controller-slack/v2, sluis-google/v1 and sluis/v3 with `cloudflare.serve`. The Cloudflare module has one only when
	// the installation declares a preset: a module with nothing to do has no
	// function.
	Modules map[string][]byte
}

type ModuleOptions struct {
	// Tables are the DynamoDB table of each module of layout v5, by the module's
	// name (oidc, github, slack, cloudflare, google, backup). A module not listed
	// has `sluis-<instance>-<module>`.
	Tables map[string]string
}

type OAuthClient = internal.OAuthClient

type OpenBao struct {
	Address   string       `json:"address"`
	CAFile    string       `json:"caFile,omitempty"`
	Mount     string       `json:"mount,omitempty"`
	Namespace string       `json:"namespace,omitempty"`
	Root      string       `json:"root"`
	Auth      OpenBaoLogin `json:"auth"`
}

type OpenBaoLogin struct {
	Method    string `json:"method"`
	Mount     string `json:"mount,omitempty"`
	Role      string `json:"role"`
	TokenFile string `json:"tokenFile,omitempty"`
}

type Policy = policy.Policy

type PolicyDocument = internal.PolicyDocument

type Recovery = internal.Recovery

type Secrets = internal.Secrets

type Shape string

type SigningKey = internal.SigningKey

type SlackController struct {
	internal.SlackController
	EnabledWorkspaces []string `json:"enabledWorkspaces,omitempty"`
}

type Sluis = internal.Sluis

type Valkey = internal.Valkey