oci

type Auth struct {
	Registry string
	Username string
	Password secret.Value
	// IdentityToken is what `docker login` keeps for a registry signed in to
	// through a browser, in place of a password.
	IdentityToken secret.Value
}

type Config struct {
	// ExposedPorts are EXPOSE'd TCP ports, lowest first.
	ExposedPorts []int    `json:"exposed_ports,omitempty"`
	Volumes      []string `json:"volumes,omitempty"`
	Entrypoint   []string `json:"entrypoint,omitempty"`
	Cmd          []string `json:"cmd,omitempty"`
	WorkingDir   string   `json:"working_dir,omitempty"`
	User         string   `json:"user,omitempty"`
	Healthcheck  *Health  `json:"healthcheck,omitempty"`

	// Env is the image's ENV, as KEY=VALUE. Read by detection for the
	// connections an image is configured to expect (mongo-express ships
	// ME_CONFIG_MONGODB_URL=mongodb://mongo:27017). Never serialized: a
	// private image's ENV is the image author's, and nothing that stores or
	// returns an inspection needs it.
	Env []string `json:"-"`
}

type Credential struct {
	Kind CredentialKind `json:"kind"`

	Username string       `json:"username,omitempty"`
	Password secret.Value `json:"password,omitempty"`

	AccessKeyID     string       `json:"access_key_id,omitempty"`
	SecretAccessKey secret.Value `json:"secret_access_key,omitempty"`
	// Region is the ECR region. Empty reads it from the registry host.
	Region string `json:"region,omitempty"`
}

type CredentialKind string

type CredentialStore interface {
	Put(ctx context.Context, appID, field string, v secret.Value) error
	Delete(ctx context.Context, appID, field string) error
	Resolve(ctx context.Context, appID string) (map[string]secret.Value, error)
}

type CredentialSummary struct {
	Kind        CredentialKind `json:"kind"`
	Username    string         `json:"username,omitempty"`
	AccessKeyID string         `json:"access_key_id,omitempty"`
	Region      string         `json:"region,omitempty"`
}

type Health struct {
	// Command is the check to run, without Docker's CMD/CMD-SHELL marker: a
	// CMD-SHELL check arrives as ["/bin/sh", "-c", script].
	Command  []string      `json:"command"`
	Interval time.Duration `json:"interval,omitempty"`
	Timeout  time.Duration `json:"timeout,omitempty"`
	Retries  int           `json:"retries,omitempty"`
}

type Images struct {
	Inspector   Inspector
	Resolver    Resolver
	Credentials CredentialStore

	// Docker is the Docker login on the Pando server, used for an app with no
	// credential of its own (apps.docker_credentials). Nil is off.
	Docker authn.Keychain
}

type Inspection struct {
	// Reference is what was asked for, as given.
	Reference string `json:"reference"`
	// Digest is the content digest the reference resolved to — of the index
	// for a multi-platform image, so the runtime still picks its own platform
	// from it.
	Digest string `json:"digest"`
	// Platforms is every platform the image is published for.
	Platforms []Platform `json:"platforms"`
	// Config is the configuration of the build for the requested platform,
	// and nil when there is none.
	Config *Config `json:"config,omitempty"`
	// Matched is the platform Config was read from.
	Matched *Platform `json:"matched,omitempty"`
}

type Inspector struct {
	// Transport is the HTTP transport registry calls go through. Nil means the
	// default; tests point it at an in-memory registry.
	Transport http.RoundTripper
	// Insecure allows plain HTTP, for a registry on localhost in tests.
	Insecure bool

	// Mirrors lists the mirrors to read Docker Hub images through, as URLs
	// (https://mirror.gcr.io), in the order to try them: the runtime's own
	// (api.RuntimeCapabilities.RegistryMirrors). Nil reads Docker Hub
	// directly.
	Mirrors func(context.Context) []string
}

type Platform struct {
	OS           string `json:"os"`
	Architecture string `json:"architecture"`
	Variant      string `json:"variant,omitempty"`
}

type Resolver struct {
	// ECREndpoint overrides the ECR API endpoint, for tests.
	ECREndpoint string
}