v1alpha2

type FieldName string

type PassboltSecret struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   PassboltSecretSpec   `json:"spec,omitempty"`
	Status PassboltSecretStatus `json:"status,omitempty"`
}

type PassboltSecretList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []PassboltSecret `json:"items"`
}

type PassboltSecretSpec struct {
	// LeaveOnDelete defines if the secret should be deleted from Kubernetes when the PassboltSecret is deleted.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=true
	LeaveOnDelete bool `json:"leaveOnDelete,omitempty"`
	// SecretType is the type of the secret. Defaults to Opaque.
	// If set to kubernetes.io/dockerconfigjson, the secret will be created as a docker config secret.
	// We also expect the PassboltSecretName to be set in this case.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=Opaque
	// +kubebuilder:validation:Enum=Opaque;kubernetes.io/dockerconfigjson
	SecretType corev1.SecretType `json:"secretType,omitempty"`
	// PassboltSecretName is the name of the passbolt secret name to be used as a docker config secret.
	// +kubebuilder:validation:Optional
	PassboltSecretName *string `json:"passboltSecretName,omitempty"`
	// Secrets is a list of secrets to be fetched from passbolt.
	// +kubebuilder:validation:Optional
	Secrets []SecretSpec `json:"secrets,omitempty"`
}

type PassboltSecretStatus struct {
	// SyncStatus is the status of the last sync.
	// +kubebuilder:validation:Enum=Success;Error;Unknown
	// +kubebuilder:default=Unknown
	SyncStatus SyncStatus `json:"syncStatus"`
	// LastSync is the last time the secret was synced from passbolt.
	// +kubebuilder:validation:Optional
	LastSync metav1.Time `json:"lastSync"`
	// SyncErrors is a list of errors that occurred during the last sync.
	SyncErrors []SyncError `json:"syncErrors,omitempty"`
}

type PassboltSpec struct {
	// Name of the secret in passbolt
	// +kubebuilder:validation:Required
	Name string `json:"name"`
	// Field is the field in the passbolt secret to be read.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=username;password;uri
	Field FieldName `json:"field,omitempty"`
	// Value is the plain text value of the secret.
	// This field allows to set a static value or using go templating to generate the value.
	// Valid template variables are:
	//   - Password
	//   - Username
	//   - URI
	// +kubebuilder:validation:Optional
	Value *string `json:"value,omitempty"`
}

type SecretSpec struct {
	// Name of the secret in passbolt
	// +kubebuilder:validation:Required
	PassboltSecret PassboltSpec `json:"passboltSecret"`
	// KubernetesSecretKey is the key in the kubernetes secret where the passbolt secret will be stored.
	// +kubebuilder:validation:Required
	KubernetesSecretKey string `json:"kubernetesSecretKey"`
}

type SyncError struct {
	// Message is the error message.
	Message string `json:"message"`
	// SecretName is the name of the secret that failed to sync.
	SecretName string `json:"secretName"`
	// SecretKey is the key of the secret that failed to sync.
	SecretKey string `json:"secretKey"`
	// Time is the time the error occurred.
	Time metav1.Time `json:"time"`
}

type SyncStatus string