v1beta2

type AnonymousAccessSpec struct{}

type ApiKeyAuthenticationSpec struct {
	// Label selector used by Authorino to match secrets from the cluster storing valid credentials to authenticate to this service
	Selector *metav1.LabelSelector `json:"selector"`

	// Whether Authorino should look for API key secrets in all namespaces or only in the same namespace as the AuthConfig.
	// Enabling this option in namespaced Authorino instances has no effect.
	// +optional
	// +kubebuilder:default:=false
	AllNamespaces bool `json:"allNamespaces,omitempty"`
}

type AuthConfig struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AuthConfigSpec   `json:"spec,omitempty"`
	Status AuthConfigStatus `json:"status,omitempty"`
}

type AuthConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           AuthConfigs `json:"items"`
}

type AuthConfigSpec struct {
	// The list of public host names of the services protected by this authentication/authorization scheme.
	// Authorino uses the requested host to lookup for the corresponding authentication/authorization configs to enforce.
	Hosts []string `json:"hosts"`

	// Named sets of patterns that can be referred in `when` conditions and in pattern-matching authorization policy rules.
	// +optional
	NamedPatterns map[string]PatternExpressions `json:"patterns,omitempty"`

	// Overall conditions for the AuthConfig to be enforced.
	// If omitted, the AuthConfig will be enforced at all requests.
	// If present, all conditions must match for the AuthConfig to be enforced; otherwise, Authorino skips the AuthConfig and returns to the auth request with status OK.
	// +optional
	Conditions []PatternExpressionOrRef `json:"when,omitempty"`

	// Authentication configs.
	// At least one config MUST evaluate to a valid identity object for the auth request to be successful.
	// +optional
	Authentication map[string]AuthenticationSpec `json:"authentication,omitempty"`

	// Metadata sources.
	// Authorino fetches auth metadata as JSON from sources specified in this config.
	// +optional
	Metadata map[string]MetadataSpec `json:"metadata,omitempty"`

	// Authorization policies.
	// All policies MUST evaluate to "allowed = true" for the auth request be successful.
	// +optional
	Authorization map[string]AuthorizationSpec `json:"authorization,omitempty"`

	// Response items.
	// Authorino builds custom responses to the client of the auth request.
	// +optional
	Response *ResponseSpec `json:"response,omitempty"`

	// Callback functions.
	// Authorino sends callbacks at the end of the auth pipeline to the endpoints specified in this config.
	// +optional
	Callbacks map[string]CallbackSpec `json:"callbacks,omitempty"`
}

type AuthConfigStatus struct {
	Conditions []AuthConfigStatusCondition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
	Summary    AuthConfigStatusSummary     `json:"summary,omitempty"`
}

type AuthConfigStatusCondition struct {
	// Type of condition
	Type StatusConditionType `json:"type"`

	// Status of the condition, one of True, False, Unknown.
	Status k8score.ConditionStatus `json:"status"`

	// Last time the condition transit from one status to another.
	// +optional
	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty"`

	// (brief) reason for the condition's last transition.
	// +optional
	Reason string `json:"reason,omitempty"`

	// Human readable message indicating details about last transition.
	// +optional
	Message string `json:"message,omitempty"`

	// Last time the condition was updated
	// +optional
	LastUpdatedTime *metav1.Time `json:"lastUpdatedTime,omitempty"`
}

type AuthConfigStatusSummary struct {
	// Whether all hosts from spec.hosts have been linked to the resource in the index
	Ready bool `json:"ready"`

	// Lists the hosts from spec.hosts linked to the resource in the index
	HostsReady []string `json:"hostsReady"`

	// Number of hosts from spec.hosts linked to the resource in the index, compared to the total number of hosts in spec.hosts
	NumHostsReady string `json:"numHostsReady"`

	// Number of trusted sources of identity for authentication in the AuthConfig
	NumIdentitySources int64 `json:"numIdentitySources"`

	// Number of sources of external metadata in the AuthConfig
	NumMetadataSources int64 `json:"numMetadataSources"`

	// Number of authorization policies in the AuthConfig
	NumAuthorizationPolicies int64 `json:"numAuthorizationPolicies"`

	// Number of custom authorization response items in the AuthConfig
	NumResponseItems int64 `json:"numResponseItems"`

	// Indicator of whether the AuthConfig issues Festival Wristband tokens on successful evaluation of the AuthConfig (access granted)
	FestivalWristbandEnabled bool `json:"festivalWristbandEnabled"`
}

type AuthConfigs []AuthConfig

type AuthResponseMethod int8

type AuthResponseMethodSpec struct {
	// Plain text content
	Plain *PlainAuthResponseSpec `json:"plain,omitempty"`
	// JSON object
	// Specify it as the list of properties of the object, whose values can combine static values and values selected from the authorization JSON.
	Json *JsonAuthResponseSpec `json:"json,omitempty"`
	// Authorino Festival Wristband token
	Wristband *WristbandAuthResponseSpec `json:"wristband,omitempty"`
}

type AuthenticationMethod int8

type AuthenticationMethodSpec struct {
	// Authentication based on API keys stored in Kubernetes secrets.
	ApiKey *ApiKeyAuthenticationSpec `json:"apiKey,omitempty"`
	// Authentication based on JWT tokens.
	Jwt *JwtAuthenticationSpec `json:"jwt,omitempty"`
	// Authentication by OAuth2 token introspection.
	OAuth2TokenIntrospection *OAuth2TokenIntrospectionSpec `json:"oauth2Introspection,omitempty"`
	// Authentication by Kubernetes token review.
	KubernetesTokenReview *KubernetesTokenReviewSpec `json:"kubernetesTokenReview,omitempty"`
	// Authentication based on client X.509 certificates.
	// The certificates presented by the clients must be signed by a trusted CA whose certificates are stored in Kubernetes secrets.
	X509ClientCertificate *X509ClientCertificateAuthenticationSpec `json:"x509,omitempty"`
	// Identity object extracted from the context.
	// Use this method when authentication is performed beforehand by a proxy and the resulting object passed to Authorino as JSON in the auth request.
	Plain *PlainIdentitySpec `json:"plain,omitempty"`
	// Anonymous access.
	AnonymousAccess *AnonymousAccessSpec `json:"anonymous,omitempty"`
}

type AuthenticationSpec struct {
	CommonEvaluatorSpec `json:",omitempty"`

	// Defines where credentials are required to be passed in the request for authentication based on this config.
	// If omitted, it defaults to credentials passed in the HTTP Authorization header and the "Bearer" prefix prepended to the secret credential value.
	// +optional
	Credentials Credentials `json:"credentials,omitempty"`

	// Overrides the resolved identity object by setting the additional properties (claims) specified in this config,
	// before appending the object to the authorization JSON.
	// It requires the resolved identity object to always be a JSON object.
	// Do not use this option with identity objects of other JSON types (array, string, etc).
	// +optional
	Overrides ExtendedProperties `json:"overrides,omitempty"`

	// Set default property values (claims) for the resolved identity object, that are set before appending the object to
	// the authorization JSON. If the property is already present in the resolved identity object, the default value is ignored.
	// It requires the resolved identity object to always be a JSON object.
	// Do not use this option with identity objects of other JSON types (array, string, etc).
	// +optional
	Defaults ExtendedProperties `json:"defaults,omitempty"`

	AuthenticationMethodSpec `json:""`
}

type AuthorizationMethod int8

type AuthorizationMethodSpec struct {
	// Pattern-matching authorization rules.
	PatternMatching *PatternMatchingAuthorizationSpec `json:"patternMatching,omitempty"`
	// Open Policy Agent (OPA) Rego policy.
	Opa *OpaAuthorizationSpec `json:"opa,omitempty"`
	// Authorization by Kubernetes SubjectAccessReview
	KubernetesSubjectAccessReview *KubernetesSubjectAccessReviewAuthorizationSpec `json:"kubernetesSubjectAccessReview,omitempty"`
	// Authorization decision delegated to external Authzed/SpiceDB server.
	SpiceDB *SpiceDBAuthorizationSpec `json:"spicedb,omitempty"`
}

type AuthorizationSpec struct {
	CommonEvaluatorSpec     `json:""`
	AuthorizationMethodSpec `json:""`
}

type CallbackMethod int8

type CallbackMethodSpec struct {
	Http *HttpEndpointSpec `json:"http"` // make this 'omitempty' if other alternate methods are added
}

type CallbackSpec struct {
	CommonEvaluatorSpec `json:""`
	CallbackMethodSpec  `json:""`
}

type CommonEvaluatorSpec struct {
	// Priority group of the config.
	// All configs in the same priority group are evaluated concurrently; consecutive priority groups are evaluated sequentially.
	// +optional
	// +kubebuilder:default:=0
	Priority int `json:"priority,omitempty"`

	// Whether this config should generate individual observability metrics
	// +optional
	// +kubebuilder:default:=false
	Metrics bool `json:"metrics,omitempty"`

	// Conditions for Authorino to enforce this config.
	// If omitted, the config will be enforced for all requests.
	// If present, all conditions must match for the config to be enforced; otherwise, the config will be skipped.
	// +optional
	Conditions []PatternExpressionOrRef `json:"when,omitempty"`

	// Caching options for the resolved object returned when applying this config.
	// Omit it to avoid caching objects for this config.
	// +optional
	Cache *EvaluatorCaching `json:"cache,omitempty"`
}

type Credentials struct {
	AuthorizationHeader *Prefixed     `json:"authorizationHeader,omitempty"`
	CustomHeader        *CustomHeader `json:"customHeader,omitempty"`
	QueryString         *Named        `json:"queryString,omitempty"`
	Cookie              *Named        `json:"cookie,omitempty"`
}

type CredentialsType int8

type CustomHeader struct {
	Named `json:""`
}

type DenyWithCode int64

type DenyWithSpec struct {
	// HTTP status code to override the default denial status code.
	Code DenyWithCode `json:"code,omitempty"`

	// HTTP message to override the default denial message.
	Message *ValueOrSelector `json:"message,omitempty"`

	// HTTP response headers to override the default denial headers.
	Headers NamedValuesOrSelectors `json:"headers,omitempty"`

	// HTTP response body to override the default denial body.
	Body *ValueOrSelector `json:"body,omitempty"`
}

type EvaluatorCaching struct {
	// Key used to store the entry in the cache.
	// The resolved key must be unique within the scope of this particular config.
	Key ValueOrSelector `json:"key"`

	// Duration (in seconds) of the external data in the cache before pulled again from the source.
	// +optional
	// +kubebuilder:default:=60
	TTL int `json:"ttl,omitempty"`
}

type ExtendedProperties NamedValuesOrSelectors

type ExternalOpaPolicy struct {
	*HttpEndpointSpec `json:""`

	// Duration (in seconds) of the external data in the cache before pulled again from the source.
	TTL int `json:"ttl,omitempty"`
}

type HeaderSuccessResponseSpec struct {
	SuccessResponseSpec `json:",omitempty"`
}

type HttpContentType string

type HttpEndpointSpec struct {
	// Endpoint URL of the HTTP service.
	// The value can include variable placeholders in the format "{selector}", where "selector" is any pattern supported
	// by https://pkg.go.dev/github.com/tidwall/gjson and selects value from the authorization JSON.
	// E.g. https://ext-auth-server.io/metadata?p={request.path}
	Url string `json:"url"`

	// HTTP verb used in the request to the service. Accepted values: GET (default), POST.
	// When the request method is POST, the authorization JSON is passed in the body of the request.
	// +optional
	// +kubebuilder:default:=GET
	Method *HttpMethod `json:"method,omitempty"`

	// Raw body of the HTTP request.
	// Supersedes 'bodyParameters'; use either one or the other.
	// Use it with method=POST; for GET requests, set parameters as query string in the 'endpoint' (placeholders can be used).
	// +optional
	Body *ValueOrSelector `json:"body,omitempty"`

	// Custom parameters to encode in the body of the HTTP request.
	// Superseded by 'body'; use either one or the other.
	// Use it with method=POST; for GET requests, set parameters as query string in the 'endpoint' (placeholders can be used).
	// +optional
	Parameters NamedValuesOrSelectors `json:"bodyParameters,omitempty"`

	// Content-Type of the request body. Shapes how 'bodyParameters' are encoded.
	// Use it with method=POST; for GET requests, Content-Type is automatically set to 'text/plain'.
	// +optional
	// +kubebuilder:default:=application/x-www-form-urlencoded
	ContentType HttpContentType `json:"contentType,omitempty"`

	// Custom headers in the HTTP request.
	// +optional
	Headers NamedValuesOrSelectors `json:"headers,omitempty"`

	// Reference to a Secret key whose value will be passed by Authorino in the request.
	// The HTTP service can use the shared secret to authenticate the origin of the request.
	// Ignored if used together with oauth2.
	// +optional
	SharedSecret *SecretKeyReference `json:"sharedSecretRef,omitempty"`

	// Authentication with the HTTP service by OAuth2 Client Credentials grant.
	// +optional
	OAuth2 *OAuth2ClientAuthentication `json:"oauth2,omitempty"`

	// Defines where client credentials will be passed in the request to the service.
	// If omitted, it defaults to client credentials passed in the HTTP Authorization header and the "Bearer" prefix expected prepended to the secret value.
	// +optional
	Credentials Credentials `json:"credentials,omitempty"`
}

type HttpMethod string

type JsonAuthResponseSpec struct {
	Properties NamedValuesOrSelectors `json:"properties"`
}

type JwtAuthenticationSpec struct {
	// URL of the issuer of the JWT.
	// If `jwksUrl` is omitted, Authorino will append the path to the OpenID Connect Well-Known Discovery endpoint
	// (i.e. "/.well-known/openid-configuration") to this URL, to discover the OIDC configuration where to obtain
	// the "jkws_uri" claim from.
	// The value must coincide with the value of  the "iss" (issuer) claim of the discovered OpenID Connect configuration.
	// +optional
	IssuerUrl string `json:"issuerUrl"`

	// Decides how long to wait before refreshing the JWKS (in seconds).
	// If omitted, Authorino will never refresh the JWKS.
	// +optional
	TTL int `json:"ttl,omitempty"`
}

type KubernetesSubjectAccessReviewAuthorizationSpec struct {
	// User to check for authorization in the Kubernetes RBAC.
	// Omit it to check for group authorization only.
	User *ValueOrSelector `json:"user,omitempty"`

	// Groups the user must be a member of or, if `user` is omitted, the groups to check for authorization in the Kubernetes RBAC.
	Groups []string `json:"groups,omitempty"`

	// Use resourceAttributes to check permissions on Kubernetes resources.
	// If omitted, it performs a non-resource SubjectAccessReview, with verb and path inferred from the request.
	// +optional
	ResourceAttributes *KubernetesSubjectAccessReviewResourceAttributesSpec `json:"resourceAttributes,omitempty"`
}

type KubernetesSubjectAccessReviewResourceAttributesSpec struct {
	// API group of the resource.
	// Use '*' for all API groups.
	Group ValueOrSelector `json:"group,omitempty"`
	// Resource kind
	// Use '*' for all resource kinds.
	Resource ValueOrSelector `json:"resource,omitempty"`
	// Subresource kind
	SubResource ValueOrSelector `json:"subresource,omitempty"`
	// Resource name
	// Omit it to check for authorization on all resources of the specified kind.
	Name ValueOrSelector `json:"name,omitempty"`
	// Namespace where the user must have permissions on the resource.
	Namespace ValueOrSelector `json:"namespace,omitempty"`
	// Verb to check for authorization on the resource.
	// Use '*' for all verbs.
	Verb ValueOrSelector `json:"verb,omitempty"`
}

type KubernetesTokenReviewSpec struct {
	// The list of audiences (scopes) that must be claimed in a Kubernetes authentication token supplied in the request, and reviewed by Authorino.
	// If omitted, Authorino will review tokens expecting the host name of the requested protected service amongst the audiences.
	// +optional
	Audiences []string `json:"audiences,omitempty"`
}

type MetadataMethod int8

type MetadataMethodSpec struct {
	// External source of auth metadata via HTTP request
	Http *HttpEndpointSpec `json:"http,omitempty"`
	// OpendID Connect UserInfo linked to an OIDC authentication config specified in this same AuthConfig.
	UserInfo *UserInfoMetadataSpec `json:"userInfo,omitempty"`
	// User-Managed Access (UMA) source of resource data.
	Uma *UmaMetadataSpec `json:"uma,omitempty"`
}

type MetadataSpec struct {
	CommonEvaluatorSpec `json:""`
	MetadataMethodSpec  `json:""`
}

type Named struct {
	Name string `json:"name"`
}

type NamedValuesOrSelectors map[string]ValueOrSelector

type OAuth2ClientAuthentication struct {
	// Token endpoint URL of the OAuth2 resource server.
	TokenUrl string `json:"tokenUrl"`
	// OAuth2 Client ID.
	ClientId string `json:"clientId"`
	// Reference to a Kuberentes Secret key that stores that OAuth2 Client Secret.
	ClientSecret SecretKeyReference `json:"clientSecretRef"`
	// Optional scopes for the client credentials grant, if supported by he OAuth2 server.
	Scopes []string `json:"scopes,omitempty"`
	// Optional extra parameters for the requests to the token URL.
	ExtraParams map[string]string `json:"extraParams,omitempty"`
	// Caches and reuses the token until expired.
	// Set it to false to force fetch the token at every authorization request regardless of expiration.
	// +kubebuilder:default:=true
	Cache *bool `json:"cache,omitempty"`
}

type OAuth2TokenIntrospectionSpec struct {
	// The full URL of the token introspection endpoint.
	Url string `json:"endpoint"`

	// The token type hint for the token introspection.
	// If omitted, it defaults to "access_token".
	// +optional
	TokenTypeHint string `json:"tokenTypeHint,omitempty"`

	// Reference to a Kubernetes secret in the same namespace, that stores client credentials to the OAuth2 server.
	Credentials *k8score.LocalObjectReference `json:"credentialsRef"`
}

type OpaAuthorizationSpec struct {
	// Authorization policy as a Rego language document.
	// The Rego document must include the "allow" condition, set by Authorino to "false" by default (i.e. requests are unauthorized unless changed).
	// The Rego document must NOT include the "package" declaration in line 1.
	Rego string `json:"rego,omitempty"`

	// Settings for fetching the OPA policy from an external registry.
	// Use it alternatively to 'rego'.
	// For the configurations of the HTTP request, the following options are not implemented: 'method', 'body', 'bodyParameters',
	// 'contentType', 'headers', 'oauth2'. Use it only with: 'url', 'sharedSecret', 'credentials'.
	External *ExternalOpaPolicy `json:"externalPolicy,omitempty"`

	// Returns the value of all Rego rules in the virtual document. Values can be read in subsequent evaluators/phases of the Auth Pipeline.
	// Otherwise, only the default `allow` rule will be exposed.
	// Returning all Rego rules can affect performance of OPA policies during reconciliation (policy precompile) and at runtime.
	// +kubebuilder:default:=false
	AllValues bool `json:"allValues,omitempty"`
}

type PatternExpression struct {
	// Path selector to fetch content from the authorization JSON (e.g. 'request.method').
	// Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used.
	// Authorino custom JSON path modifiers are also supported.
	Selector string `json:"selector,omitempty"`
	// The binary operator to be applied to the content fetched from the authorization JSON, for comparison with "value".
	// Possible values are: "eq" (equal to), "neq" (not equal to), "incl" (includes; for arrays), "excl" (excludes; for arrays), "matches" (regex)
	Operator PatternExpressionOperator `json:"operator,omitempty"`
	// The value of reference for the comparison with the content fetched from the authorization JSON.
	// If used with the "matches" operator, the value must compile to a valid Golang regex.
	Value string `json:"value,omitempty"`
}

type PatternExpressionOperator string

type PatternExpressionOrRef struct {
	PatternExpression `json:",omitempty"`
	PatternRef        `json:",omitempty"`

	// A list of pattern expressions to be evaluated as a logical AND.
	All []UnstructuredPatternExpressionOrRef `json:"all,omitempty"`
	// A list of pattern expressions to be evaluated as a logical OR.
	Any []UnstructuredPatternExpressionOrRef `json:"any,omitempty"`
}

type PatternExpressions []PatternExpression

type PatternMatchingAuthorizationSpec struct {
	Patterns []PatternExpressionOrRef `json:"patterns"`
}

type PatternRef struct {
	// Reference to a named set of pattern expressions
	Name string `json:"patternRef,omitempty"`
}

type PlainAuthResponseSpec ValueOrSelector

type PlainIdentitySpec struct {
	// Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!").
	// Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used.
	// The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip.
	Selector string `json:"selector"`
}

type Prefixed struct {
	Prefix string `json:"prefix,omitempty"`
}

type ResponseSpec struct {
	// Customizations on the denial status attributes when the request is unauthenticated.
	// For integration of Authorino via proxy, the proxy must honour the response status attributes specified in this config.
	// Default: 401 Unauthorized
	// +optional
	Unauthenticated *DenyWithSpec `json:"unauthenticated,omitempty"`

	// Customizations on the denial status attributes when the request is unauthorized.
	// For integration of Authorino via proxy, the proxy must honour the response status attributes specified in this config.
	// Default: 403 Forbidden
	// +optional
	Unauthorized *DenyWithSpec `json:"unauthorized,omitempty"`

	// Response items to be included in the auth response when the request is authenticated and authorized.
	// For integration of Authorino via proxy, the proxy must use these settings to propagate dynamic metadata and/or inject data in the request.
	// +optional
	Success WrappedSuccessResponseSpec `json:"success,omitempty"`
}

type SecretKeyReference struct {
	// The name of the secret in the Authorino's namespace to select from.
	Name string `json:"name"`

	// The key of the secret to select from.  Must be a valid secret key.
	Key string `json:"key"`
}

type SpiceDBAuthorizationSpec struct {
	// Hostname and port number to the GRPC interface of the SpiceDB server (e.g. spicedb:50051).
	Endpoint string `json:"endpoint"`

	// Insecure HTTP connection (i.e. disables TLS verification)
	Insecure bool `json:"insecure,omitempty"`

	// Reference to a Secret key whose value will be used by Authorino to authenticate with the Authzed service.
	SharedSecret *SecretKeyReference `json:"sharedSecretRef,omitempty"`

	// The subject that will be checked for the permission or relation.
	Subject *SpiceDBObject `json:"subject,omitempty"`

	// The resource on which to check the permission or relation.
	Resource *SpiceDBObject `json:"resource,omitempty"`

	// The name of the permission (or relation) on which to execute the check.
	Permission ValueOrSelector `json:"permission,omitempty"`
}

type SpiceDBObject struct {
	Name ValueOrSelector `json:"name,omitempty"`
	Kind ValueOrSelector `json:"kind,omitempty"`
}

type StatusConditionType string

type SuccessResponseSpec struct {
	CommonEvaluatorSpec    `json:""`
	AuthResponseMethodSpec `json:""`

	// The key used to add the custom response item (name of the HTTP header or root property of the Dynamic Metadata object).
	// If omitted, it will be set to the name of the response config.
	Key string `json:"key,omitempty"`
}

type UmaMetadataSpec struct {
	// The endpoint of the UMA server.
	// The value must coincide with the "issuer" claim of the UMA config discovered from the well-known uma configuration endpoint.
	Endpoint string `json:"endpoint"`

	// Reference to a Kubernetes secret in the same namespace, that stores client credentials to the resource registration API of the UMA server.
	Credentials *k8score.LocalObjectReference `json:"credentialsRef"`
}

type UnstructuredPatternExpressionOrRef struct {
	// +kubebuilder:pruning:PreserveUnknownFields
	PatternExpressionOrRef `json:",omitempty"`
}

type UserInfoMetadataSpec struct {
	// The name of an OIDC-enabled JWT authentication config whose OpenID Connect configuration discovered includes the OIDC "userinfo_endpoint" claim.
	IdentitySource string `json:"identitySource"`
}

type ValueOrSelector struct {
	// Static value
	// +kubebuilder:validation:Schemaless
	// +kubebuilder:pruning:PreserveUnknownFields
	Value k8sruntime.RawExtension `json:"value,omitempty"`

	// Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!").
	// Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used.
	// The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip.
	Selector string `json:"selector,omitempty"`
}

type WrappedSuccessResponseSpec struct {
	// Custom success response items wrapped as HTTP headers.
	// For integration of Authorino via proxy, the proxy must use these settings to inject data in the request.
	Headers map[string]HeaderSuccessResponseSpec `json:"headers,omitempty"`

	// Custom success response items wrapped as HTTP headers.
	// For integration of Authorino via proxy, the proxy must use these settings to propagate dynamic metadata.
	// See https://www.envoyproxy.io/docs/envoy/latest/configuration/advanced/well_known_dynamic_metadata
	DynamicMetadata map[string]SuccessResponseSpec `json:"dynamicMetadata,omitempty"`
}

type WristbandAuthResponseSpec struct {
	// The endpoint to the Authorino service that issues the wristband (format: <scheme>://<host>:<port>/<realm>, where <realm> = <namespace>/<authorino-auth-config-resource-name/wristband-config-name)
	Issuer string `json:"issuer"`
	// Any claims to be added to the wristband token apart from the standard JWT claims (iss, iat, exp) added by default.
	CustomClaims NamedValuesOrSelectors `json:"customClaims,omitempty"`
	// Time span of the wristband token, in seconds.
	TokenDuration *int64 `json:"tokenDuration,omitempty"`
	// Reference by name to Kubernetes secrets and corresponding signing algorithms.
	// The secrets must contain a `key.pem` entry whose value is the signing key formatted as PEM.
	SigningKeyRefs []*WristbandSigningKeyRef `json:"signingKeyRefs"`
}

type WristbandSigningKeyAlgorithm string

type WristbandSigningKeyRef struct {
	// Name of the signing key.
	// The value is used to reference the Kubernetes secret that stores the key and in the `kid` claim of the wristband token header.
	Name string `json:"name"`

	// Algorithm to sign the wristband token using the signing key provided
	Algorithm WristbandSigningKeyAlgorithm `json:"algorithm"`
}

type X509ClientCertificateAuthenticationSpec struct {
	// Label selector used by Authorino to match secrets from the cluster storing trusted CA certificates to validate
	// clients trying to authenticate to this service
	Selector *metav1.LabelSelector `json:"selector"`

	// Whether Authorino should look for TLS secrets in all namespaces or only in the same namespace as the AuthConfig.
	// Enabling this option in namespaced Authorino instances has no effect.
	// +optional
	// +kubebuilder:default:=false
	AllNamespaces bool `json:"allNamespaces,omitempty"`
}