api

const (
	// TraceAgentIDAttr is tracing attribute that holds an agent id.
	TraceAgentIDAttr attribute.Key = "agent_id"
	// TraceAgentTypeAttr is tracing attribute that holds an agent type.
	TraceAgentTypeAttr attribute.Key = "agent_type"

	// AgentKeyFieldName is the field name to log the agent key.
	AgentKeyFieldName = "agent_key"

	JWTAgentk = "gitlab-agent"
	JWTKAS    = "gitlab-kas"

	// JWTAutoFlow is the issuer of every AutoFlow token. Each capability such a token
	// grants gets its own audience below, so that a token cannot be presented as one of
	// another kind: that is the audience restriction mitigation for cross-JWT confusion.
	// See https://www.rfc-editor.org/rfc/rfc8725#section-3.12.
	JWTAutoFlow = "gitlab-autoflow"
	// JWTAutoFlowAgentChannel is the audience of an agent channel token: the send-only
	// capability minted for the AutoFlow module agent an action is invoked on. It names
	// that agent in `sub` and is spent on the module API, over the connection that
	// authenticates it.
	JWTAutoFlowAgentChannel = "gitlab-autoflow-agent-channel"
	// JWTAutoFlowWorkflowChannel is the audience of a workflow channel token: the send-only
	// capability spent on SendToWorkflowChannel, which authorizes it by the workflow token
	// presented alongside rather than by any principal the token names. StartWorkflow
	// returns one per channel in the workflow input, and a module obtains one by exchanging
	// an agent channel token it holds.
	JWTAutoFlowWorkflowChannel = "gitlab-autoflow-workflow-channel"
	// JWTAutoFlowWorkflow is the audience of AutoFlow workflow tokens, the capability handed to
	// the caller of StartWorkflow to manage that workflow. It keeps them cryptographically
	// distinct from every kind of channel token, which only allow sending on one channel.
	JWTAutoFlowWorkflow = "gitlab-autoflow-workflow"

	// FieldManager name for the ones agentk or kas own, see
	// https://kubernetes.io/docs/reference/using-api/server-side-apply/#field-management
	FieldManager = "agentk"

	// AgentKeyPrefix is the prefix to use for labels and annotations owned by kas/agentk.
	// See https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/#syntax-and-character-set.
	// See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set.
	AgentKeyPrefix     = "agent.gitlab.com"
	AgentIDKey         = AgentKeyPrefix + "/id"
	ConfigProjectIDKey = AgentKeyPrefix + "/config_project_id"
	ProjectIDKey       = AgentKeyPrefix + "/project_id"
	// ProjectKey is the annotation/label key that has a GitLab project full path as its value, e.g. `gitlab-org/gitlab`.
	ProjectKey         = AgentKeyPrefix + "/project"
	CIPipelineIDKey    = AgentKeyPrefix + "/ci_pipeline_id"
	CIJobIDKey         = AgentKeyPrefix + "/ci_job_id"
	UsernameKey        = AgentKeyPrefix + "/username"
	EnvironmentSlugKey = AgentKeyPrefix + "/environment_slug"
	EnvironmentTierKey = AgentKeyPrefix + "/environment_tier"

	// WebSocketMaxMessageSize is an arbitrary historical limit we used from the early days.
	WebSocketMaxMessageSize = 10 * 1024 * 1024
	// GRPCMaxMessageSize is a limit that is under WebSocketMaxMessageSize.
	// Historically we didn't set gRPC limits:
	// - On the server the default value was 4MB.
	// - On the client the default value was 2GB.
	// We use 4MB explicitly to match the historical value.
	GRPCMaxMessageSize = 4 * 1024 * 1024
)