v1alpha1

type ConditionStatus string

type GrantType string

type HydraAdmin struct {
	// +kubebuilder:validation:MaxLength=64
	// +kubebuilder:validation:Pattern=`(^$|^https?://.*)`
	//
	// URL is the URL for the hydra instance on
	// which to set up the client. This value will override the value
	// provided to `--hydra-url`
	URL string `json:"url,omitempty"`

	// +kubebuilder:validation:Maximum=65535
	//
	// Port is the port for the hydra instance on
	// which to set up the client. This value will override the value
	// provided to `--hydra-port`
	Port int `json:"port,omitempty"`

	// +kubebuilder:validation:Pattern=(^$|^/.*)
	//
	// Endpoint is the endpoint for the hydra instance on which
	// to set up the client. This value will override the value
	// provided to `--endpoint` (defaults to `"/clients"` in the
	// application)
	Endpoint string `json:"endpoint,omitempty"`

	// +kubebuilder:validation:Pattern=(^$|https?|off)
	//
	// ForwardedProto overrides the `--forwarded-proto` flag. The
	// value "off" will force this to be off even if
	// `--forwarded-proto` is specified
	ForwardedProto string `json:"forwardedProto,omitempty"`
}

type OAuth2Client struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   OAuth2ClientSpec   `json:"spec,omitempty"`
	Status OAuth2ClientStatus `json:"status,omitempty"`
}

type OAuth2ClientCondition struct {
	Type   OAuth2ClientConditionType `json:"type"`
	Status ConditionStatus           `json:"status"`
}

type OAuth2ClientConditionType string

type OAuth2ClientList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []OAuth2Client `json:"items"`
}

type OAuth2ClientSpec struct {

	// ClientName is the human-readable string name of the client to be presented to the end-user during authorization.
	ClientName string `json:"clientName,omitempty"`

	// +kubebuilder:validation:MaxItems=4
	// +kubebuilder:validation:MinItems=1
	//
	// GrantTypes is an array of grant types the client is allowed to use.
	GrantTypes []GrantType `json:"grantTypes"`

	// +kubebuilder:validation:MaxItems=3
	// +kubebuilder:validation:MinItems=1
	//
	// ResponseTypes is an array of the OAuth 2.0 response type strings that the client can
	// use at the authorization endpoint.
	ResponseTypes []ResponseType `json:"responseTypes,omitempty"`

	// RedirectURIs is an array of the redirect URIs allowed for the application
	RedirectURIs []RedirectURI `json:"redirectUris,omitempty"`

	// PostLogoutRedirectURIs is an array of the post logout redirect URIs allowed for the application
	PostLogoutRedirectURIs []RedirectURI `json:"postLogoutRedirectUris,omitempty"`

	// AllowedCorsOrigins is an array of allowed CORS origins
	AllowedCorsOrigins []RedirectURI `json:"allowedCorsOrigins,omitempty"`

	// Audience is a whitelist defining the audiences this client is allowed to request tokens for
	Audience []string `json:"audience,omitempty"`

	// +kubebuilder:validation:Pattern=([a-zA-Z0-9\.\*]+\s?)+
	//
	// Scope is a string containing a space-separated list of scope values (as
	// described in Section 3.3 of OAuth 2.0 [RFC6749]) that the client
	// can use when requesting access tokens.
	Scope string `json:"scope"`

	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:Pattern=[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*
	//
	// SecretName points to the K8s secret that contains this client's ID and password
	SecretName string `json:"secretName"`

	// SkipConsent skips the consent screen for this client.
	// +kubebuilder:validation:type=bool
	// +kubebuilder:default=false
	SkipConsent bool `json:"skipConsent,omitempty"`

	// HydraAdmin is the optional configuration to use for managing
	// this client
	HydraAdmin HydraAdmin `json:"hydraAdmin,omitempty"`

	// +kubebuilder:validation:Enum=client_secret_basic;client_secret_post;private_key_jwt;none
	//
	// Indication which authentication method shoud be used for the token endpoint
	TokenEndpointAuthMethod TokenEndpointAuthMethod `json:"tokenEndpointAuthMethod,omitempty"`

	// +kubebuilder:validation:Type=object
	// +nullable
	// +optional
	//
	// Metadata is arbitrary data
	Metadata apiextensionsv1.JSON `json:"metadata,omitempty"`

	// +kubebuilder:validation:type=string
	// +kubebuilder:validation:Pattern=`(^$|^https?://.*)`
	//
	// JwksUri Define the URL where the JSON Web Key Set should be fetched from when performing the private_key_jwt client authentication method.
	JwksUri string `json:"jwksUri,omitempty"`

	// +kubebuilder:validation:type=bool
	// +kubebuilder:default=false
	//
	// FrontChannelLogoutSessionRequired Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session with the OP when the frontchannel_logout_uri is used
	FrontChannelLogoutSessionRequired bool `json:"frontChannelLogoutSessionRequired,omitempty"`

	// +kubebuilder:validation:type=string
	// +kubebuilder:validation:Pattern=`(^$|^https?://.*)`
	//
	// FrontChannelLogoutURI RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter MAY be included by the OP to enable the RP to validate the request and to determine which of the potentially multiple sessions is to be logged out; if either is included, both MUST be
	FrontChannelLogoutURI string `json:"frontChannelLogoutURI,omitempty"`

	// +kubebuilder:validation:type=bool
	// +kubebuilder:default=false
	//
	// BackChannelLogoutSessionRequired Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the OP when the backchannel_logout_uri is used. If omitted, the default value is false.
	BackChannelLogoutSessionRequired bool `json:"backChannelLogoutSessionRequired,omitempty"`

	// +kubebuilder:validation:type=string
	// +kubebuilder:validation:Pattern=`(^$|^https?://.*)`
	//
	// BackChannelLogoutURI RP URL that will cause the RP to log itself out when sent a Logout Token by the OP
	BackChannelLogoutURI string `json:"backChannelLogoutURI,omitempty"`
}

type OAuth2ClientStatus struct {
	// ObservedGeneration represents the most recent generation observed by the daemon set controller.
	ObservedGeneration  int64                   `json:"observedGeneration,omitempty"`
	ReconciliationError ReconciliationError     `json:"reconciliationError,omitempty"`
	Conditions          []OAuth2ClientCondition `json:"conditions,omitempty"`
}

type ReconciliationError struct {
	// Code is the status code of the reconciliation error
	Code StatusCode `json:"statusCode,omitempty"`
	// Description is the description of the reconciliation error
	Description string `json:"description,omitempty"`
}

type RedirectURI string

type ResponseType string

type StatusCode string

type TokenEndpointAuthMethod string