v1alpha1

type Artifact struct {
	// Ref is the path to the artifact in the host registry that should be validated.
	// An individual artifact can take any of the following forms:
	// <repository-path>/<artifact-name>
	// <repository-path>/<artifact-name>:<tag>
	// <repository-path>/<artifact-name>@<digest>
	//
	// When no tag or digest are specified, the default tag "latest" is used.
	Ref string `json:"ref" yaml:"ref"`

	// ValidationType overrides the OciRegistryRule level ValidationType for a particular artifact.
	// +kubebuilder:validation:Enum=full;fast;none
	ValidationType *ValidationType `json:"validationType,omitempty" yaml:"validationType,omitempty"`
}

type Auth struct {
	// SecretName is the name of the Kubernetes Secret that exists in the same namespace as the OciValidator
	// and that contains the credentials used to authenticate to the OCI Registry.
	SecretName *string `json:"secretName,omitempty" yaml:"secretName,omitempty"`

	// BasicAuth is the username and password used to authenticate to the OCI registry.
	Basic *BasicAuth `json:"basic,omitempty" yaml:"basic,omitempty"`

	// ECRAuth is the access key ID, secret access key, and session token used to authenticate to ECR.
	ECR *ECRAuth `json:"ecr,omitempty" yaml:"ecr,omitempty"`
}

type BasicAuth struct {
	// Username is the username used to authenticate to the OCI Registry.
	Username string `json:"username" yaml:"username"`

	// Password is the password used to authenticate to the OCI Registry.
	Password string `json:"password" yaml:"password"`
}

type ECRAuth struct {
	// AccessKeyID is the AWS access key ID used to authenticate to ECR.
	AccessKeyID string `json:"accessKeyID" yaml:"accessKeyID"`

	// SecretAccessKey is the AWS secret access key used to authenticate to ECR.
	SecretAccessKey string `json:"secretAccessKey" yaml:"secretAccessKey"`

	// SessionToken is the AWS session token used to authenticate to ECR.
	SessionToken string `json:"sessionToken,omitempty" yaml:"sessionToken,omitempty"`
}

type OciRegistryRule struct {
	validationrule.ManuallyNamed `json:",inline"`

	// Name is a unique name for the OciRegistryRule.
	RuleName string `json:"name" yaml:"name"`

	// Host is the URI of an OCI registry.
	Host string `json:"host" yaml:"host"`

	// ValidationType specifies which (if any) type of validation is performed on the artifacts.
	// Valid values are "full", "fast", and "none". When set to "none", the artifact will not be pulled and no extra validation will be performed.
	// For both "full" and "fast" validationType, the following validations will be executed:
	// - Layers existence will be validated
	// - Config digest, size, content, and type will be validated
	// - Manifest digest, content, and size will be validated
	// For "full" validationType, the following additional validations will be performed:
	// - Layer digest, diffID, size, and media type will be validated
	// See more details about validation here:
	// https://github.com/google/go-containerregistry/blob/8dadbe76ff8c20d0e509406f04b7eade43baa6c1/pkg/v1/validate/image.go#L30
	// +kubebuilder:validation:Enum=full;fast;none
	// +kubebuilder:default:=none
	ValidationType ValidationType `json:"validationType" yaml:"validationType"`

	// Artifacts is a slice of artifacts in the OCI registry that should be validated.
	// +kubebuilder:validation:MinItems=1
	Artifacts []Artifact `json:"artifacts,omitempty" yaml:"artifacts,omitempty"`

	// Auth provides authentication information for the registry.
	Auth Auth `json:"auth,omitempty" yaml:"auth,omitempty"`

	// InsecureSkipTLSVerify specifies whether to skip verification of the OCI registry's TLS certificate.
	InsecureSkipTLSVerify bool `json:"insecureSkipTLSVerify,omitempty" yaml:"insecureSkipTLSVerify,omitempty"`

	// CaCert is the CA certificate of the OCI registry.
	CaCert string `json:"caCert,omitempty" yaml:"caCert,omitempty"`

	// SignatureVerification provides signature verification options for the artifacts.
	SignatureVerification SignatureVerification `json:"signatureVerification,omitempty" yaml:"signatureVerification,omitempty"`
}

type OciValidator struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   OciValidatorSpec   `json:"spec,omitempty"`
	Status OciValidatorStatus `json:"status,omitempty"`
}

type OciValidatorList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []OciValidator `json:"items"`
}

type OciValidatorSpec struct {
	// +kubebuilder:validation:MaxItems=5
	// +kubebuilder:validation:XValidation:message="OciRegistryRules must have a unique RuleName",rule="self.all(e, size(self.filter(x, x.name == e.name)) == 1)"
	OciRegistryRules []OciRegistryRule `json:"ociRegistryRules,omitempty" yaml:"ociRegistryRules,omitempty"`
}

type OciValidatorStatus struct{}

type SignatureVerification struct {
	// Provider specifies the technology used to sign the OCI Artifact.
	// +kubebuilder:validation:Enum=cosign
	// +kubebuilder:default:=cosign
	Provider string `json:"provider" yaml:"provider"`

	// SecretName is the name of the Kubernetes Secret that exists in the same namespace as the OciValidator
	// and that contains the trusted public keys used to sign artifacts in the OciRegistryRule.
	SecretName string `json:"secretName" yaml:"secretName"`
}

type ValidationType string