// Copyright 2025 Microsoft Corporation
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package metadataapi

import (
	"k8s.io/apimachinery/pkg/util/sets"
)

// DiskStorageAccountType represents supported Azure storage account types.
type DiskStorageAccountType string

const (
	DiskStorageAccountTypePremium_LRS     DiskStorageAccountType = "Premium_LRS"
	DiskStorageAccountTypeStandardSSD_LRS DiskStorageAccountType = "StandardSSD_LRS"
	DiskStorageAccountTypeStandard_LRS    DiskStorageAccountType = "Standard_LRS"
)

var (
	ValidDiskStorageAccountTypes = sets.New[DiskStorageAccountType](
		DiskStorageAccountTypePremium_LRS,
		DiskStorageAccountTypeStandardSSD_LRS,
		DiskStorageAccountTypeStandard_LRS,
	)
)

// OsDiskType represents the type of OS disk.
type OsDiskType string

const (
	OsDiskTypeManaged   OsDiskType = "Managed"
	OsDiskTypeEphemeral OsDiskType = "Ephemeral"
)

var (
	ValidOsDiskTypes = sets.New[OsDiskType](
		OsDiskTypeManaged,
		OsDiskTypeEphemeral,
	)
)

// NetworkType represents an OpenShift cluster network plugin.
type NetworkType string

const (
	NetworkTypeOVNKubernetes NetworkType = "OVNKubernetes"
	NetworkTypeOther         NetworkType = "Other"
)

var (
	ValidNetworkTypes = sets.New[NetworkType](
		NetworkTypeOVNKubernetes,
		NetworkTypeOther,
	)
)

// OutboundType represents a routing strategy to provide egress to the Internet.
type OutboundType string

const (
	OutboundTypeLoadBalancer OutboundType = "LoadBalancer"
)

var (
	ValidOutboundTypes = sets.New[OutboundType](
		OutboundTypeLoadBalancer,
	)
)

// Visibility represents the visibility of an API endpoint.
type Visibility string

const (
	VisibilityPublic  Visibility = "Public"
	VisibilityPrivate Visibility = "Private"
)

var (
	ValidVisibility = sets.New[Visibility](
		VisibilityPublic,
		VisibilityPrivate,
	)
)

// IngressType represents the type of the default cluster ingress.
type IngressType string

const (
	IngressTypePublic   IngressType = "Public"
	IngressTypePrivate  IngressType = "Private"
	IngressTypeDisabled IngressType = "Disabled"
)

var (
	// ValidIngressTypes contains ingress types that are currently supported.
	// Disabled is defined in the API but not yet supported.
	ValidIngressTypes = sets.New[IngressType](
		IngressTypePublic,
		IngressTypePrivate,
	)
)

// KeyVaultVisibility represents the visibility of a KeyVault resource.
type KeyVaultVisibility string

const (
	KeyVaultVisibilityPublic  KeyVaultVisibility = "Public"
	KeyVaultVisibilityPrivate KeyVaultVisibility = "Private"
)

var (
	ValidKeyVaultVisibility = sets.New[KeyVaultVisibility](
		KeyVaultVisibilityPublic,
		KeyVaultVisibilityPrivate,
	)
)

type Effect string

const (
	// EffectNoExecute - NoExecute taint effect
	EffectNoExecute Effect = "NoExecute"
	// EffectNoSchedule - NoSchedule taint effect
	EffectNoSchedule Effect = "NoSchedule"
	// EffectPreferNoSchedule - PreferNoSchedule taint effect
	EffectPreferNoSchedule Effect = "PreferNoSchedule"
)

var (
	ValidEffects = sets.New[Effect](
		EffectNoExecute,
		EffectNoSchedule,
		EffectPreferNoSchedule,
	)
)

type CustomerManagedEncryptionType string

const (
	// CustomerManagedEncryptionTypeKMS - KMS encryption type.
	CustomerManagedEncryptionTypeKMS CustomerManagedEncryptionType = "KMS"
)

var (
	ValidCustomerManagedEncryptionType = sets.New[CustomerManagedEncryptionType](
		CustomerManagedEncryptionTypeKMS,
	)
)

type EtcdDataEncryptionKeyManagementModeType string

const (
	// EtcdDataEncryptionKeyManagementModeTypeCustomerManaged - Customer managed encryption key management mode type.
	EtcdDataEncryptionKeyManagementModeTypeCustomerManaged EtcdDataEncryptionKeyManagementModeType = "CustomerManaged"
	// EtcdDataEncryptionKeyManagementModeTypePlatformManaged - Platform managed encryption key management mode type.
	// Not currently supported; left defined so EnsureDefaults / Cosmos defaults keep
	// filling the historic value, but excluded from ValidEtcdDataEncryptionKeyManagementModeType until
	// platform-managed etcd encryption is supported.
	EtcdDataEncryptionKeyManagementModeTypePlatformManaged EtcdDataEncryptionKeyManagementModeType = "PlatformManaged"
)

var (
	ValidEtcdDataEncryptionKeyManagementModeType = sets.New[EtcdDataEncryptionKeyManagementModeType](
		EtcdDataEncryptionKeyManagementModeTypeCustomerManaged,
		// TODO: re-enable once platform-managed etcd encryption is supported.
		// EtcdDataEncryptionKeyManagementModeTypePlatformManaged,
	)
)

// ClusterImageRegistryState - state indicates the desired ImageStream-backed cluster image registry installation mode.
// This can only be set during cluster creation and cannot be changed after cluster creation. Enabled means the
// ImageStream-backed image registry will be run as pods on worker nodes in the cluster. Disabled means the ImageStream-backed
// image registry will not be present in the cluster. The default is Enabled.
type ClusterImageRegistryState string

const (
	ClusterImageRegistryStateDisabled ClusterImageRegistryState = "Disabled"
	ClusterImageRegistryStateEnabled  ClusterImageRegistryState = "Enabled"
)

var (
	ValidClusterImageRegistryStates = sets.New[ClusterImageRegistryState](
		ClusterImageRegistryStateDisabled,
		ClusterImageRegistryStateEnabled,
	)
)

type TokenValidationRuleType string

const (
	// TokenValidationRuleTypeRequiredClaim - the Kubernetes API server will be configured to validate that the
	// incoming JWT contains the required claim and that its value matches the required value.
	TokenValidationRuleTypeRequiredClaim TokenValidationRuleType = "RequiredClaim"
)

var (
	ValidTokenValidationRuleTypes = sets.New[TokenValidationRuleType](
		TokenValidationRuleTypeRequiredClaim,
	)
)

type ExternalAuthClientType string

const (
	// ExternalAuthClientTypeConfidential - the client is confidential.
	ExternalAuthClientTypeConfidential ExternalAuthClientType = "Confidential"
	// ExternalAuthClientTypePublic - the client is public.
	ExternalAuthClientTypePublic ExternalAuthClientType = "Public"
)

var (
	ValidExternalAuthClientTypes = sets.New[ExternalAuthClientType](
		ExternalAuthClientTypeConfidential,
		ExternalAuthClientTypePublic,
	)
)

type UsernameClaimPrefixPolicy string

const (
	// UsernameClaimPrefixPolicyPrefix - prefix the JWT claim with the value of Prefix.
	UsernameClaimPrefixPolicyPrefix UsernameClaimPrefixPolicy = "Prefix"
	// UsernameClaimPrefixPolicyNoPrefix - do not prefix the JWT claim.
	UsernameClaimPrefixPolicyNoPrefix UsernameClaimPrefixPolicy = "NoPrefix"
	// UsernameClaimPrefixPolicyNone - let the platform choose an appropriate prefix.
	UsernameClaimPrefixPolicyNone UsernameClaimPrefixPolicy = "None"
)

var (
	ValidUsernameClaimPrefixPolicies = sets.New[UsernameClaimPrefixPolicy](
		UsernameClaimPrefixPolicyPrefix,
		UsernameClaimPrefixPolicyNoPrefix,
		UsernameClaimPrefixPolicyNone,
	)
)

type MirrorSourcePolicy string

const (
	// MirrorSourcePolicyAllowContactingSource - allows falling back to the specified
	// repository in the pull spec if the image pull from the mirror list fails
	MirrorSourcePolicyAllowContactingSource MirrorSourcePolicy = "AllowContactingSource"
)

var (
	ValidMirrorSourcePolicies = sets.New[MirrorSourcePolicy](
		MirrorSourcePolicyAllowContactingSource,
	)
)

// CryptoRestrictions represents cryptographic restrictions for a cluster.
type CryptoRestrictions string

const (
	// CryptoRestrictionsNone - no cryptographic restrictions will be applied to the cluster
	CryptoRestrictionsNone CryptoRestrictions = "None"
	// CryptoRestrictionsFIPS - FIPS cryptographic restrictions will be applied to the cluster
	CryptoRestrictionsFIPS CryptoRestrictions = "FIPS"
)

var (
	ValidCryptoRestrictions = sets.New[CryptoRestrictions](
		CryptoRestrictionsNone,
		CryptoRestrictionsFIPS,
	)
)
