v1beta1

type AuthorizationPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              AuthorizationPolicySpec `json:"spec"`
}

type AuthorizationPolicyAction string

type AuthorizationPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`
	Items           []AuthorizationPolicy `json:"items"`
}

type AuthorizationPolicySpec struct {
	// Optional. Workload selector decides where to apply the authorization policy.
	// If not set, the authorization policy will be applied to all workloads in the
	// same namespace as the authorization policy.
	Selector *selector.WorkloadSelector `json:"selector,omitempty"`
	// Optional. A list of rules to match the request. A match occurs when at least
	// one rule matches the request.
	//
	// If not set, the match will never occur. This is equivalent to setting a
	// default of deny for the target workloads.
	Rules []*Rule `json:"rules,omitempty"`
	// Optional. The action to take if the request is matched with the rules.
	Action AuthorizationPolicyAction `json:"action,omitempty"`
}

type Condition struct {
	// The name of an Istio attribute.
	// See the [full list of supported attributes](https://istio.io/docs/reference/config/security/conditions/).
	Key string `json:"key,omitempty"`
	// Optional. A list of allowed values for the attribute.
	// Note: at least one of values or not_values must be set.
	Values []string `json:"values,omitempty"`
	// Optional. A list of negative match of values for the attribute.
	// Note: at least one of values or not_values must be set.
	NotValues []string `json:"notValues,omitempty"`
}

type JWTHeader struct {
	// The HTTP header name.
	Name string `json:"name,omitempty"`
	// The prefix that should be stripped before decoding the token.
	// For example, for "Authorization: Bearer <token>", prefix="Bearer " with a space at the end.
	// If the header doesn't have this exact prefix, it is considerred invalid.
	Prefix string `json:"prefix,omitempty"`
}

type JWTRule struct {
	// Identifies the issuer that issued the JWT. See
	// [issuer](https://tools.ietf.org/html/rfc7519#section-4.1.1)
	// A JWT with different `iss` claim will be rejected.
	//
	// Example: https://foobar.auth0.com
	// Example: 1234567-compute@developer.gserviceaccount.com
	Issuer string `json:"issuer,omitempty"`
	// The list of JWT
	// [audiences](https://tools.ietf.org/html/rfc7519#section-4.1.3).
	// that are allowed to access. A JWT containing any of these
	// audiences will be accepted.
	//
	// The service name will be accepted if audiences is empty.
	//
	// Example:
	//
	// “`yaml
	// audiences:
	// - bookstore_android.apps.example.com
	//   bookstore_web.apps.example.com
	// “`
	Audiences []string `json:"audiences,omitempty"`
	// URL of the provider's public key set to validate signature of the
	// JWT. See [OpenID Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata).
	//
	// Optional if the key set document can either (a) be retrieved from
	// [OpenID
	// Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html) of
	// the issuer or (b) inferred from the email domain of the issuer (e.g. a
	// Google service account).
	//
	// Example: `https://www.googleapis.com/oauth2/v1/certs`
	//
	// Note: Only one of jwks_uri and jwks should be used. jwks_uri will be ignored if it does.
	JwksURI string `json:"jwksUri,omitempty"`
	// JSON Web Key Set of public keys to validate signature of the JWT.
	// See https://auth0.com/docs/jwks.
	//
	// Note: Only one of jwks_uri and jwks should be used. jwks_uri will be ignored if it does.
	Jwks string `json:"jwks,omitempty"`
	// List of header locations from which JWT is expected. For example, below is the location spec
	// if JWT is expected to be found in `x-jwt-assertion` header, and have "Bearer " prefix:
	// “`
	//   fromHeaders:
	//   - name: x-jwt-assertion
	//     prefix: "Bearer "
	// “`
	FromHeaders []*JWTHeader `json:"fromHeaders,omitempty"`
	// List of query parameters from which JWT is expected. For example, if JWT is provided via query
	// parameter `my_token` (e.g /path?my_token=<JWT>), the config is:
	// “`
	//   fromParams:
	//   - "my_token"
	// “`
	FromParams []string `json:"fromParams,omitempty"`
	// This field specifies the header name to output a successfully verified JWT payload to the
	// backend. The forwarded data is `base64_encoded(jwt_payload_in_JSON)`. If it is not specified,
	// the payload will not be emitted.
	OutputPayloadToHeader string `json:"outputPayloadToHeader,omitempty"`
	// If set to true, the original token will be kept for the ustream request. Default is false.
	ForwardOriginalToken bool `json:"forwardOriginalToken,omitempty"`
}

type MTLSMode string

type Operation struct {
	// Optional. A list of hosts, which matches to the "request.host" attribute.
	//
	// If not set, any host is allowed. Must be used only with HTTP.
	Hosts []string `json:"hosts,omitempty"`
	// Optional. A list of negative match of hosts.
	NotHosts []string `json:"notHosts,omitempty"`
	// Optional. A list of ports, which matches to the "destination.port" attribute.
	//
	// If not set, any port is allowed.
	Ports []string `json:"ports,omitempty"`
	// Optional. A list of negative match of ports.
	NotPorts []string `json:"notPorts,omitempty"`
	// Optional. A list of methods, which matches to the "request.method" attribute.
	// For gRPC service, this will always be "POST".
	//
	// If not set, any method is allowed. Must be used only with HTTP.
	Methods []string `json:"methods,omitempty"`
	// Optional. A list of negative match of methods.
	NotMethods []string `json:"notMethods,omitempty"`
	// Optional. A list of paths, which matches to the "request.url_path" attribute.
	// For gRPC service, this will be the fully-qualified name in the form of
	// "/package.service/method".
	//
	// If not set, any path is allowed. Must be used only with HTTP.
	Paths []string `json:"paths,omitempty"`
	// Optional. A list of negative match of paths.
	NotPaths []string `json:"notPaths,omitempty"`
}

type PeerAuthentication struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              PeerAuthenticationSpec `json:"spec"`
}

type PeerAuthenticationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`
	Items           []PeerAuthentication `json:"items"`
}

type PeerAuthenticationMTLS struct {
	// Defines the mTLS mode used for peer authentication.
	Mode MTLSMode `json:"mode,omitempty"`
}

type PeerAuthenticationSpec struct {
	// The selector determines the workloads to apply the ChannelAuthentication on.
	// If not set, the policy will be applied to all workloads in the same namespace as the policy.
	Selector *selector.WorkloadSelector `json:"selector,omitempty"`
	// Mutual TLS settings for workload. If not defined, inherit from parent.
	Mtls *PeerAuthenticationMTLS `json:"mtls,omitempty"`
	// Port specific mutual TLS settings.
	PortLevelMtls map[uint32]*PeerAuthenticationMTLS `json:"portLevelMtls,omitempty"`
}

type RequestAuthentication struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              RequestAuthenticationSpec `json:"spec"`
}

type RequestAuthenticationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`
	Items           []RequestAuthentication `json:"items"`
}

type RequestAuthenticationSpec struct {
	// The selector determines the workloads to apply the RequestAuthentication on.
	// If not set, the policy will be applied to all workloads in the same namespace as the policy.
	Selector *selector.WorkloadSelector `json:"selector,omitempty"`
	// Define the list of JWTs that can be validated at the selected workloads' proxy. A valid token
	// will be used to extract the authenticated identity.
	// Each rule will be activated only when a token is presented at the location recorgnized by the
	// rule. The token will be validated based on the JWT rule config. If validation fails, the request will
	// be rejected.
	// Note: if more than one token is presented (at different locations), the output principal is nondeterministic.
	JwtRules []*JWTRule `json:"jwtRules,omitempty"`
}

type Rule struct {
	// Optional. from specifies the source of a request.
	//
	// If not set, any source is allowed.
	From []*RuleFrom `json:"from,omitempty"`
	// Optional. to specifies the operation of a request.
	//
	// If not set, any operation is allowed.
	To []*RuleTo `json:"to,omitempty"`
	// Optional. when specifies a list of additional conditions of a request.
	//
	// If not set, any condition is allowed.
	When []*Condition `json:"when,omitempty"`
}

type RuleFrom struct {
	// Source specifies the source of a request.
	Source *Source `json:"source,omitempty"`
}

type RuleTo struct {
	// Operation specifies the operation of a request.
	Operation *Operation `json:"operation,omitempty"`
}

type Source struct {
	// Optional. A list of source peer identities (i.e. service account), which
	// matches to the "source.principal" attribute. This field requires mTLS enabled.
	//
	// If not set, any principal is allowed.
	Principals []string `json:"principals,omitempty"`
	// Optional. A list of negative match of source peer identities.
	NotPrincipals []string `json:"notPrincipals,omitempty"`
	// Optional. A list of request identities (i.e. "iss/sub" claims), which
	// matches to the "request.auth.principal" attribute.
	//
	// If not set, any request principal is allowed.
	RequestPrincipals []string `json:"requestPrincipals,omitempty"`
	// Optional. A list of negative match of request identities.
	NotRequestPrincipals []string `json:"notRequestPrincipals,omitempty"`
	// Optional. A list of namespaces, which matches to the "source.namespace"
	// attribute. This field requires mTLS enabled.
	//
	// If not set, any namespace is allowed.
	Namespaces []string `json:"namespaces,omitempty"`
	// Optional. A list of negative match of namespaces.
	NotNamespaces []string `json:"notNamespaces,omitempty"`
	// Optional. A list of IP blocks, which matches to the "source.ip" attribute.
	// Single IP (e.g. "1.2.3.4") and CIDR (e.g. "1.2.3.0/24") are supported.
	//
	// If not set, any IP is allowed.
	IPBlocks []string `json:"ipBlocks,omitempty"`
	// Optional. A list of negative match of IP blocks.
	NotIPBlocks []string `json:"notIpBlocks,omitempty"`
}