v1alpha1

type AWSFunctionConfig struct {
	// Credentials required to authenticate to this function.
	Credentials FunctionCredentials `json:"credentials"`

	// AssumeRoleChain defines the options for assuming an IAM role
	AssumeRoleChain []AssumeRoleOptions `json:"assumeRoleChain,omitempty"`

	// Endpoint is where you can override the default endpoint configuration
	// of AWS calls made by the function.
	// +optional
	Endpoint *EndpointConfig `json:"endpoint,omitempty"`
}

type AssumeRoleOptions struct {
	// AssumeRoleARN to assume with provider credentials
	RoleARN *string `json:"roleARN,omitempty"`

	// ExternalID is the external ID used when assuming role.
	// +optional
	ExternalID *string `json:"externalID,omitempty"`

	// Tags is list of session tags that you want to pass. Each session tag consists of a key
	// name and an associated value. For more information about session tags, see
	// Tagging STS Sessions
	// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html).
	// +optional
	Tags []Tag `json:"tags,omitempty"`

	// TransitiveTagKeys is a list of keys for session tags that you want to set as transitive. If you set a
	// tag key as transitive, the corresponding key and value passes to subsequent
	// sessions in a role chain. For more information, see Chaining Roles with Session Tags
	// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining).
	// +optional
	TransitiveTagKeys []string `json:"transitiveTagKeys,omitempty"`
}

type AssumeRoleWithWebIdentityOptions struct {
	// AssumeRoleARN to assume with provider credentials
	RoleARN *string `json:"roleARN,omitempty"`

	// RoleSessionName is the session name, if you wish to uniquely identify this session.
	// +optional
	RoleSessionName string `json:"roleSessionName,omitempty"`

	// TokenConfig is the Web Identity Token config to assume the role.
	// +optional
	TokenConfig *WebIdentityTokenConfig `json:"tokenConfig,omitempty"`
}

type DynamicURLConfig struct {
	// Protocol is the HTTP protocol that will be used in the URL. Currently,
	// only http and https are supported.
	// +kubebuilder:validation:Enum=http;https
	Protocol string `json:"protocol"`

	// Host is the address of the main host that the resolver will use to
	// prepend protocol, service and region configurations.
	// For example, the final URL for EC2 in us-east-1 looks like https://ec2.us-east-1.amazonaws.com
	// You would need to use "amazonaws.com" as Host and "https" as protocol
	// to have the resolver construct it.
	Host string `json:"host"`
}

type EndpointConfig struct {
	// URL lets you configure the endpoint URL to be used in SDK calls.
	URL URLConfig `json:"url"`
	// Specifies the list of services you want endpoint to be used for
	Services []string `json:"services,omitempty"`

	// Specifies if the endpoint's hostname can be modified by the SDK's API
	// client.
	//
	// If the hostname is mutable the SDK API clients may modify any part of
	// the hostname based on the requirements of the API, (e.g. adding, or
	// removing content in the hostname). Such as, Amazon S3 API client
	// prefixing "bucketname" to the hostname, or changing the
	// hostname service name component from "s3." to "s3-accesspoint.dualstack."
	// for the dualstack endpoint of an S3 Accesspoint resource.
	//
	// Care should be taken when providing a custom endpoint for an API. If the
	// endpoint hostname is mutable, and the client cannot modify the endpoint
	// correctly, the operation call will most likely fail, or have undefined
	// behavior.
	//
	// If hostname is immutable, the SDK API clients will not modify the
	// hostname of the URL. This may cause the API client not to function
	// correctly if the API requires the operation specific hostname values
	// to be used by the client.
	//
	// This flag does not modify the API client's behavior if this endpoint
	// will be used instead of Endpoint Discovery, or if the endpoint will be
	// used to perform Endpoint Discovery. That behavior is configured via the
	// API Client's Options.
	// Note that this is effective only for resources that use AWS SDK v2.
	// +optional
	HostnameImmutable *bool `json:"hostnameImmutable,omitempty"`

	// The AWS partition the endpoint belongs to.
	// +optional
	PartitionID *string `json:"partitionId,omitempty"`

	// The service name that should be used for signing the requests to the
	// endpoint.
	// +optional
	SigningName *string `json:"signingName,omitempty"`

	// The region that should be used for signing the request to the endpoint.
	// For IAM, which doesn't have any region, us-east-1 is used to sign the
	// requests, which is the only signing region of IAM.
	// +optional
	SigningRegion *string `json:"signingRegion,omitempty"`

	// The signing method that should be used for signing the requests to the
	// endpoint.
	// +optional
	SigningMethod *string `json:"signingMethod,omitempty"`

	// The source of the Endpoint. By default, this will be ServiceMetadata.
	// When providing a custom endpoint, you should set the source as Custom.
	// If source is not provided when providing a custom endpoint, the SDK may not
	// perform required host mutations correctly. Source should be used along with
	// HostnameImmutable property as per the usage requirement.
	// Note that this is effective only for resources that use AWS SDK v2.
	// +optional
	// +kubebuilder:validation:Enum=ServiceMetadata;Custom
	Source *string `json:"source,omitempty"`
}

type FunctionConfig struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec FunctionConfigSpec `json:"spec"`
}

type FunctionConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []FunctionConfig `json:"items"`
}

type FunctionConfigSpec struct {
	// ForAWS is the AWS specific FunctionConfig specification.
	ForAWS *AWSFunctionConfig `json:"forAWS,omitempty"`
}

type FunctionCredentials struct {
	// Source of the provider credentials.
	// +kubebuilder:validation:Enum=None;Secret;IRSA;WebIdentity;PodIdentity;Upbound
	Source xpv1.CredentialsSource `json:"source"`

	// WebIdentity defines the options for assuming an IAM role with a Web Identity.
	WebIdentity *AssumeRoleWithWebIdentityOptions `json:"webIdentity,omitempty"`

	// Upbound defines the options for authenticating using Upbound as an identity provider.
	Upbound *Upbound `json:"upbound,omitempty"`

	xpv1.CommonCredentialSelectors `json:",inline"`
}

type Tag struct {
	// Name of the tag.
	// Key is a required field
	Key *string `json:"key"`

	// Value of the tag.
	// Value is a required field
	Value *string `json:"value"`
}

type URLConfig struct {
	// You can provide a static URL that will be used regardless of the service
	// and region by choosing Static type. Alternatively, you can provide
	// configuration for dynamically resolving the URL with the config you provide
	// once you set the type as Dynamic.
	// +kubebuilder:validation:Enum=Static;Dynamic;Auto
	Type string `json:"type"`

	// Static is the full URL you'd like the AWS SDK to use.
	// Recommended for using tools like localstack where a single host is exposed
	// for all services and regions.
	// +optional
	Static *string `json:"static,omitempty"`

	// Dynamic lets you configure the behavior of endpoint URL resolver.
	// +optional
	Dynamic *DynamicURLConfig `json:"dynamic,omitempty"`
}

type Upbound struct {
	// WebIdentity defines the options for assuming an IAM role with a Web
	// Identity.
	WebIdentity *AssumeRoleWithWebIdentityOptions `json:"webIdentity,omitempty"`
}

type WebIdentityTokenConfig struct {
	// Source is the source of the web identity token.
	// +kubebuilder:validation:Enum=Secret;Filesystem
	Source xpv1.CredentialsSource `json:"source"`
	// A SecretRef is a reference to a secret key that contains the credentials
	// that must be used to obtain the web identity token.
	// +optional
	SecretRef *xpv1.SecretKeySelector `json:"secretRef,omitempty"`
	// Fs is a reference to a filesystem location that contains credentials that
	// must be used to obtain the web identity token.
	// +optional
	Fs *xpv1.FsSelector `json:"fs,omitempty"`
}