v1alpha1

type AccessGroup struct {
	// Optional: no more than one of the following may be specified.
	// ID of the CloudflareAccessGroup
	// +optional
	Value string `json:"value,omitempty" protobuf:"bytes,1,opt,name=value"`
	// Source for the CloudflareAccessGroup's variable. Cannot be used if value is not empty.
	// +optional
	ValueFrom *AccessGroupReference `json:"valueFrom,omitempty" protobuf:"bytes,2,opt,name=valueFrom"`
}

type AccessGroupReference struct {
	// `namespace` is the namespace of the AccessGroup.
	// Required
	Namespace string `json:"namespace" protobuf:"bytes,1,opt,name=namespace"`
	// `name` is the name of the AccessGroup .
	// Required
	Name string `json:"name" protobuf:"bytes,2,opt,name=name"`
}

type CloudFlareAccessGroupRule struct {
	// Matches a Specific email
	Emails []string `json:"emails,omitempty"`

	// Matches a specific email Domain
	EmailDomains []string `json:"emailDomains,omitempty"`

	// Matches an IP CIDR block
	IPRanges []string `json:"ipRanges,omitempty"`

	// Reference to other access groups
	AccessGroups []AccessGroup `json:"accessGroups,omitempty"`

	// Country
	Country []string `json:"country,omitempty"`

	// Allow Everyone
	Everyone *bool `json:"everyone,omitempty"`

	// Certificate CN
	CommonName []string `json:"commonName,omitempty"`

	// Any valid certificate will be matched
	ValidCertificate *bool `json:"validCertificate,omitempty"`

	// Matches a service token
	ServiceToken []ServiceToken `json:"serviceToken,omitempty"`

	// Matches any valid service token
	AnyAccessServiceToken *bool `json:"anyAccessServiceToken,omitempty"`

	// ID of the login method
	LoginMethod []string `json:"loginMethod,omitempty"`

	// Matches Google Group
	GoogleGroups []GoogleGroup `json:"googleGroups,omitempty"`

	// Okta Groups
	OktaGroup []OktaGroup `json:"oktaGroup,omitempty"`

	// GitHub Organizations
	GitHubOrganizations []GitHubOrganization `json:"gitHubOrganizations,omitempty"`

	// OIDC Claims
	OIDCClaims []OIDCClaim `json:"oidcClaims,omitempty"`
}

type CloudFlareAccessGroupRuleGroups [][]CloudFlareAccessGroupRule

type CloudflareAccessApplication struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   CloudflareAccessApplicationSpec   `json:"spec,omitempty"`
	Status CloudflareAccessApplicationStatus `json:"status,omitempty"`
}

type CloudflareAccessApplicationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []CloudflareAccessApplication `json:"items"`
}

type CloudflareAccessApplicationSpec struct {
	// Name of the Cloudflare Access Application
	Name string `json:"name"`

	// The domain and path that Access will secure.
	// ex: "test.example.com/admin"
	Domain string `json:"domain"`

	// The application type. defaults to "self_hosted"
	// +optional
	// +kubebuilder:default=self_hosted
	Type cloudflare.AccessApplicationType `json:"type,omitempty"`

	// Displays the application in the App Launcher.
	// +optional
	// +kubebuilder:default=true
	AppLauncherVisible *bool `json:"appLauncherVisible,omitempty"`

	// The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
	// ex: ["699d98642c564d2e855e9661899b7252"]
	// +optional
	// +kubebuilder:default={}
	AllowedIdps []string `json:"allowedIdps,omitempty"`

	// When set to true, users skip the identity provider selection step during login.
	// You must specify only one identity provider in allowed_idps.
	// +optional
	// +kubebuilder:default=false
	AutoRedirectToIdentity *bool `json:"autoRedirectToIdentity,omitempty"`

	// Policies is the ordered set of policies that should be applied to the application
	// Order determines precidence
	// +optional
	Policies CloudflareAccessPolicyList `json:"policies,omitempty"`

	// SessionDuration is the length of the session duration.
	// +optional
	// +kubebuilder:default="24h"
	SessionDuration string `json:"sessionDuration,omitempty"`

	// Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.
	// +optional
	// +kubebuilder:default=false
	EnableBindingCookie *bool `json:"enableBindingCookie,omitempty"`

	// Enables the HttpOnly cookie attribute, which increases security against XSS attacks.
	// +optional
	// +kubebuilder:default=true
	HTTPOnlyCookieAttribute *bool `json:"httpOnlyCookieAttribute,omitempty"`

	// The image URL for the logo shown in the App Launcher dashboard
	// +optional
	LogoURL string `json:"logoUrl,omitempty"`
}

type CloudflareAccessApplicationStatus struct {
	AccessApplicationID string      `json:"accessApplicationId,omitempty"`
	CreatedAt           metav1.Time `json:"createdAt,omitempty"`
	UpdatedAt           metav1.Time `json:"updatedAt,omitempty"`

	// Conditions store the status conditions of the CloudflareAccessApplication
	// +operator-sdk:csv:customresourcedefinitions:type=status
	Conditions []metav1.Condition `json:"conditions,omitempty" patchMergeKey:"type" patchStrategy:"merge" protobuf:"bytes,1,rep,name=conditions"`
}

type CloudflareAccessGroup struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   CloudflareAccessGroupSpec   `json:"spec,omitempty"`
	Status CloudflareAccessGroupStatus `json:"status,omitempty"`
}

type CloudflareAccessGroupList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []CloudflareAccessGroup `json:"items"`
}

type CloudflareAccessGroupSpec struct {
	// Name of the Cloudflare Access Group
	Name string `json:"name"`

	// Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
	Include []CloudFlareAccessGroupRule `json:"include,omitempty"`

	// Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
	Require []CloudFlareAccessGroupRule `json:"require,omitempty"`

	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
	Exclude []CloudFlareAccessGroupRule `json:"exclude,omitempty"`
}

type CloudflareAccessGroupStatus struct {
	// AccessGroupID is the ID of the reference in Cloudflare
	AccessGroupID string `json:"accessGroupId,omitempty"`

	// Creation timestamp of the resource in Cloudflare
	CreatedAt metav1.Time `json:"createdAt,omitempty"`

	// Updated timestamp of the resource in Cloudflare
	UpdatedAt metav1.Time `json:"updatedAt,omitempty"`

	// Conditions store the status conditions of the CloudflareAccessApplication
	// +operator-sdk:csv:customresourcedefinitions:type=status
	Conditions []metav1.Condition `json:"conditions,omitempty" patchMergeKey:"type" patchStrategy:"merge" protobuf:"bytes,1,rep,name=conditions"`
}

type CloudflareAccessPolicy struct {
	// Name of the Cloudflare Access Policy
	Name string `json:"name"`

	// Decision ex: allow, deny, non_identity, bypass - defaults to allow
	Decision string `json:"decision"`

	// Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
	Include []CloudFlareAccessGroupRule `json:"include,omitempty"`

	// Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
	// +optional
	Require []CloudFlareAccessGroupRule `json:"require,omitempty"`

	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
	// +optional
	Exclude []CloudFlareAccessGroupRule `json:"exclude,omitempty"`
}

type CloudflareAccessPolicyList []CloudflareAccessPolicy

type CloudflareServiceToken struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   CloudflareServiceTokenSpec   `json:"spec,omitempty"`
	Status CloudflareServiceTokenStatus `json:"status,omitempty"`
}

type CloudflareServiceTokenList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []CloudflareServiceToken `json:"items"`
}

type CloudflareServiceTokenSpec struct {
	// Name of the Cloudflare Access Group
	Name string `json:"name"`

	// Time before the token should be automatically renewed. Defaults to "0"
	// Automatically renewing a service token will change the service token value upon renewal.
	// Tokens will get automatically renewed if the token is expired
	// +optional
	// +kubebuilder:default="0"
	MinTimeBeforeRenewal string `json:"minTimeBeforeRenewal,omitempty"`

	// Recreate the token if the secret with the service token value is missing or doesn't exist
	// +kubebuilder:default=true
	RecreateMissing bool `json:"recreateMissing,omitempty"`

	// Template to apply for the generated secret
	// +optional
	// +kubebuilder:default={"metadata": {}}
	Template SecretTemplateSpec `json:"template,omitempty"`
}

type CloudflareServiceTokenStatus struct {
	// ID of the servicetoken in Cloudflare
	ServiceTokenID string `json:"serviceTokenId,omitempty"`

	// Creation timestamp of the resource in Cloudflare
	CreatedAt metav1.Time `json:"createdAt,omitempty"`

	// Updated timestamp of the resource in Cloudflare
	UpdatedAt metav1.Time `json:"updatedAt,omitempty"`

	// Updated timestamp of the resource in Cloudflare
	ExpiresAt metav1.Time `json:"expiresAt,omitempty"`

	// SecretRef is the reference to the secret
	// +optional
	// +nullable
	SecretRef *SecretRef `json:"secretRef,omitempty"`

	// Conditions store the status conditions of the CloudflareAccessApplication
	// +operator-sdk:csv:customresourcedefinitions:type=status
	Conditions []metav1.Condition `json:"conditions,omitempty" patchMergeKey:"type" patchStrategy:"merge" protobuf:"bytes,1,rep,name=conditions"`
}

type GitHubOrganization struct {
	// Name of the GitHub organization
	Name string `json:"name"`
	// Team within the GitHub organization (optional)
	Team string `json:"team,omitempty"`
	// Identity Provider Id
	IdentityProviderID string `json:"identityProviderId"`
}

type GoogleGroup struct {
	// Google group email
	Email string `json:"email"`
	// Identity Provider Id
	IdentityProviderID string `json:"identityProviderId"`
}

type OIDCClaim struct {
	// Name of the OIDC claim
	Name string `json:"name"`
	// Value of the OIDC claim
	Value string `json:"value"`
	// Identity Provider Id
	IdentityProviderID string `json:"identityProviderId"`
}

type OktaGroup struct {
	// Name of the Okta Group
	Name string `json:"name"`
	// Identity Provider Id
	IdentityProviderID string `json:"identityProviderId"`
}

type SecretRef struct {
	// reference to the secret
	corev1.LocalObjectReference `json:"reference,omitempty"`
	// Key that stores the secret data.
	ClientSecretKey string `json:"clientSecretKey,omitempty"`

	// Key that stores the secret data.
	ClientIDKey string `json:"clientIdKey,omitempty"`
}

type SecretTemplateSpec struct {
	// Standard object's metadata.
	// More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
	// +optional
	// +nullable
	// +kubebuilder:validation:XPreserveUnknownFields
	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	// Key that should store the secret data. Defaults to cloudflareServiceToken
	// Warning: changing this value will recreate the secret
	// +optional
	// +kubebuilder:default=cloudflareSecretKey
	ClientSecretKey string `json:"clientSecretKey,omitempty"`

	// Key that should store the secret data. Defaults to cloudflareServiceToken.
	// Warning: changing this value will recreate the secret
	// +optional
	// +kubebuilder:default=cloudflareClientId
	ClientIDKey string `json:"clientIdKey,omitempty"`
}

type ServiceToken struct {
	// Optional: no more than one of the following may be specified.
	// ID of the CloudflareServiceToken
	// +optional
	Value string `json:"value,omitempty" protobuf:"bytes,1,opt,name=value"`
	// Source for the CloudflareServiceToken's variable. Cannot be used if value is not empty.
	// +optional
	ValueFrom *ServiceTokenReference `json:"valueFrom,omitempty" protobuf:"bytes,2,opt,name=valueFrom"`
}

type ServiceTokenReference struct {
	// `namespace` is the namespace of the AccessGroup.
	// Required
	Namespace string `json:"namespace" protobuf:"bytes,1,opt,name=namespace"`
	// `name` is the name of the AccessGroup .
	// Required
	Name string `json:"name" protobuf:"bytes,2,opt,name=name"`
}