const GroupName = "abac.authorization.kubernetes.io"

var (
    // SchemeBuilder is the scheme builder with scheme init functions to run for this API package
    SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
    // AddToScheme is a common registration function for mapping packaged scoped group & version keys to a scheme
    AddToScheme = SchemeBuilder.AddToScheme
)

var Codecs = serializer.NewCodecFactory(Scheme)

var Scheme = runtime.NewScheme()

var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal}

type Policy struct {
    metav1.TypeMeta

    // Spec describes the policy rule
    Spec PolicySpec
}

type PolicySpec struct {

    // User is the username this rule applies to.
    // Either user or group is required to match the request.
    // "*" matches all users.
    User string

    // Group is the group this rule applies to.
    // Either user or group is required to match the request.
    // "*" matches all groups.
    Group string

    // Readonly matches readonly requests when true, and all requests when false
    Readonly bool

    // APIGroup is the name of an API group. APIGroup, Resource, and Namespace are required to match resource requests.
    // "*" matches all API groups
    APIGroup string

    // Resource is the name of a resource. APIGroup, Resource, and Namespace are required to match resource requests.
    // "*" matches all resources
    Resource string

    // Namespace is the name of a namespace. APIGroup, Resource, and Namespace are required to match resource requests.
    // "*" matches all namespaces (including unnamespaced requests)
    Namespace string

    // NonResourcePath matches non-resource request paths.
    // "*" matches all paths
    // "/foo/*" matches all subpaths of foo
    NonResourcePath string
}