plugins

type APIKeyEntry struct {
	Key      string          `json:"key"`
	KeyHash  string          `json:"keyHash"`
	Metadata json.RawMessage `json:"metadata"`
}

type AddResourcesPlugin struct {
	Binds            krt.Collection[ir.AgwResource]
	Listeners        krt.Collection[ir.AgwResource]
	Routes           krt.Collection[ir.AgwResource]
	AncestorBackends krt.Collection[*utils.AncestorBackend]
	GatewayStatuses  krt.StatusCollection[*gwv1.Gateway, gwv1.GatewayStatus]
	// ParentResolvers contribute additional parent resolution logic to the
	// main route pipeline.
	ParentResolvers []ParentResolver
}

type AgwCollections struct {
	OurClient kgwversioned.Interface
	Client    apiclient.Client
	KrtOpts   krtutil.KrtOptions
	Settings  apisettings.Settings

	GatewaysForDeployer krt.Collection[collections.GatewayForDeployer]

	// Core Kubernetes resources
	Namespaces            krt.Collection[*corev1.Namespace]
	Nodes                 krt.Collection[*corev1.Node]
	Pods                  krt.Collection[*corev1.Pod]
	Services              krt.Collection[*corev1.Service]
	ServicesByNamespace   krt.Index[string, *corev1.Service]
	Secrets               krt.Collection[*corev1.Secret]
	SecretsByNamespace    krt.Index[string, *corev1.Secret]
	ConfigMaps            krt.Collection[*corev1.ConfigMap]
	ConfigMapsByNamespace krt.Index[string, *corev1.ConfigMap]
	EndpointSlices        krt.Collection[*discovery.EndpointSlice]

	// Istio resources for ambient mesh
	WorkloadEntries krt.Collection[*networkingclient.WorkloadEntry]
	ServiceEntries  krt.Collection[*networkingclient.ServiceEntry]
	MeshConfig      krt.Singleton[ambient.MeshConfig]

	// Gateway API resources
	GatewayClasses          krt.Collection[*gwv1.GatewayClass]
	Gateways                krt.Collection[*gwv1.Gateway]
	GatewaysByNamespace     krt.Index[string, *gwv1.Gateway]
	HTTPRoutes              krt.Collection[*gwv1.HTTPRoute]
	HTTPRoutesByNamespace   krt.Index[string, *gwv1.HTTPRoute]
	GRPCRoutes              krt.Collection[*gwv1.GRPCRoute]
	GRPCRoutesByNamespace   krt.Index[string, *gwv1.GRPCRoute]
	TCPRoutes               krt.Collection[*gwv1.TCPRoute]
	TLSRoutes               krt.Collection[*gwv1.TLSRoute]
	ReferenceGrants         krt.Collection[*gwv1b1.ReferenceGrant]
	BackendTLSPolicies      krt.Collection[*gwv1.BackendTLSPolicy]
	ListenerSets            krt.Collection[*gwv1.ListenerSet]
	ListenerSetsByNamespace krt.Index[string, *gwv1.ListenerSet]

	// Extended resources
	InferencePools            krt.Collection[*inf.InferencePool]
	InferencePoolsByNamespace krt.Index[string, *inf.InferencePool]

	// agentgateway resources
	Backends             krt.Collection[*agentgateway.AgentgatewayBackend]
	BackendsByNamespace  krt.Index[string, *agentgateway.AgentgatewayBackend]
	Models               krt.Collection[*agentgateway.AgentgatewayModel]
	ModelsByNamespace    krt.Index[string, *agentgateway.AgentgatewayModel]
	AgentgatewayPolicies krt.Collection[*agentgateway.AgentgatewayPolicy]

	// ControllerName is the name of the Gateway controller.
	ControllerName string
	// SystemNamespace is control plane system namespace (default is agentgateway-system)
	SystemNamespace string
	// IstioNamespace is the Istio control plane namespace (default is istio-system)
	IstioNamespace string
	// IstioRevision is the Istio revision of the Istio control plane (default is "default").
	IstioRevision string
	// IstioAutoEnabled turns on Istio integration by default for built-in-class gateways
	IstioAutoEnabled bool
	// IstioClusterId / IstioNetwork / IstioCaAddress are control-plane-wide mesh values.
	// Gateway that have istio enabled will have them propagated on envs when deployed.
	IstioClusterId string
	IstioNetwork   string
	IstioCaAddress string
}

type AgwPlugin struct {
	AddResourceExtension *AddResourcesPlugin
	ContributesPolicies  map[schema.GroupKind]PolicyPlugin
	ContributesBackends  map[schema.GroupKind]BackendPlugin
}

type AgwPolicy struct {
	Gateway *types.NamespacedName
	Policy  *api.Policy
}

type BackendPlugin struct {
	Build           func(PolicyPluginInput) (krt.StatusCollection[controllers.Object, any], krt.Collection[ir.AgwResource])
	BuildReferences func() krt.Collection[*PolicyAttachment]
}

type BackendReferenceError struct {
	Reason  BackendReferenceErrorReason
	Message string
}

type BackendReferenceErrorReason string

type BackendTLSTargetBuilder func(namespace string, target gwv1.LocalPolicyTargetReferenceWithSectionName) *api.PolicyTarget

type Condition struct {
	// Reason defines the Reason to report on success. Ignored if error is set
	Reason string
	// Message defines the Message to report on success. Ignored if error is set
	Message string
	// Status defines the Status to report on success. The inverse will be set if error is set
	// If not set, will default to StatusTrue
	Status metav1.ConditionStatus
	// Error defines an Error state; the Reason and Message will be replaced with that of the Error and
	// the Status inverted
	Error *ConfigError
	// SetOnce, if enabled, will only set the Condition if it is not yet present or set to this Reason
	SetOnce string
}

type ConfigError struct {
	Reason  string
	Message string
}

type CredentialResolverFactory func(*AgwCollections) kubeutils.CredentialResolver

type ParentInfo struct {
	ParentGateway          types.NamespacedName
	ParentGatewayClassName string
	// ListenerKey is the internal key of the listener resource created for this parent.
	ListenerKey string
	// ServiceKey (optionally) links a parent reference to an individual Service.
	ServiceKey *types.NamespacedName
	// ServicePorts are the ports on the ServiceKey; a route referencing a port not
	// in this list is rejected. Distinct from Port, which is for single-port listeners.
	ServicePorts []gwv1.PortNumber
	// AllowedKinds indicates which kinds can be admitted by this Parent.
	AllowedKinds []gwv1.RouteGroupKind
	// Hostnames that must match to reference the Parent. Format is ns/hostname.
	Hostnames []string
	// OriginalHostname is the unprocessed form of Hostnames; how it appeared in users' config.
	OriginalHostname string
	// CreationTimestamp is used in determining listener precedence.
	CreationTimestamp metav1.Time

	SectionName    gwv1.SectionName
	Port           gwv1.PortNumber
	Protocol       gwv1.ProtocolType
	TLSPassthrough bool
	// Internal marks this listener's bind as internal (routing-only): no OS listener
	// socket, no Service port, no container port. Sourced from the agentgateway.dev/internal-ports
	// annotation on the listener's parent Gateway or ListenerSet.
	Internal bool
}

type ParentResolver interface {
	ParentsFor(ctx krt.HandlerContext, pk utils.TypedNamespacedName) []*ParentInfo
}

type PolicyAttachment struct {
	Target  utils.TypedNamespacedName
	Backend utils.TypedNamespacedName
	Source  utils.TypedNamespacedName
}

type PolicyCtx struct {
	Krt         krt.HandlerContext
	Collections *AgwCollections
	References  ReferenceIndex
	Grants      ReferenceGrantChecker
	SourceGVK   schema.GroupVersionKind
	Resolver    remotehttp.Resolver
	JWKSLookup  jwks.Lookup

	// CredentialResolver resolves credential refs: the built-in Secret resolver
	// in OSS, or an injected resolver (which may itself be a chain). Access it
	// through ResolveCredentialRef, which is nil-safe.
	CredentialResolver kubeutils.CredentialResolver

	// RouteBackend resolves references emitted by route-like resources that
	// inline backend policies without participating in policy attachment.
	RouteBackend RouteBackendResolver
}

type PolicyPlugin struct {
	Build func(PolicyPluginInput) (krt.StatusCollection[controllers.Object, any], krt.Collection[AgwPolicy])
	// BuildReferences is called with the base ReferenceIndex (before PolicyAttachments)
	// to avoid self-referential graph construction.
	BuildReferences func(input PolicyPluginInput) krt.Collection[*PolicyAttachment]
}

type PolicyPluginInput struct {
	References ReferenceIndex
	Grants     ReferenceGrantChecker
}

type ReferenceGrantChecker interface {
	SecretAllowed(ctx krt.HandlerContext, kind schema.GroupVersionKind, secret types.NamespacedName, namespace string) bool
	BackendAllowed(
		ctx krt.HandlerContext,
		k schema.GroupVersionKind,
		backendName gwv1b1.ObjectName,
		backendNamespace gwv1b1.Namespace,
		sourceNamespace string,
		refKind schema.GroupKind,
		mode apisettings.BackendRefGrantMode,
	) bool
}

type ReferenceIndex struct {
	// Backend --> Gateway via Route
	Ancestors krt.IndexCollection[utils.TypedNamespacedName, *utils.AncestorBackend]
	// Backend --> Target via Policy
	PolicyAttachments krt.IndexCollection[utils.TypedNamespacedName, *PolicyAttachment]
	// contains filtered or unexported fields
}

type ReferenceTypes struct {
	// KnownFromReferences is the set of GroupKinds this controller understands
	// as ReferenceGrant from entries.
	KnownFromReferences sets.Set[schema.GroupKind]
	// KnownToReferences is the set of GroupKinds this controller understands as
	// ReferenceGrant to entries. Extension authors must add their kinds here
	// when they need ReferenceGrant permission checks to recognize those targets.
	KnownToReferences       sets.Set[schema.GroupKind]
	PolicyTargets           func(krtctx krt.HandlerContext, namespace string, name gwv1.ObjectName, gk schema.GroupKind, sectionName *gwv1.SectionName, port *gwv1.PortNumber) ([]*api.PolicyTarget, bool)
	PolicyTargetsBySelector func(krtctx krt.HandlerContext, policyNamespace string, selector agentgateway.LocalPolicyTargetSelectorWithSectionName) []ResolvedPolicySelectorTarget
	PolicyBackend           func(krtctx krt.HandlerContext, defaultNamespace string, gk schema.GroupKind, name gwv1.ObjectName, namespace *gwv1.Namespace, port *gwv1.PortNumber) (*api.BackendReference, error)
	RouteBackend            func(krtctx krt.HandlerContext, defaultNamespace string, gk schema.GroupKind, name gwv1.ObjectName, namespace *gwv1.Namespace, port *gwv1.PortNumber) (*api.BackendReference, error)
	AllowedParentReferences sets.Set[schema.GroupKind]
}

type ResolvedPolicySelectorTarget struct {
	Name          gwv1.ObjectName
	Namespace     string
	PolicyTargets []*api.PolicyTarget
}

type ResolvedTarget struct {
	AgentgatewayTarget *api.PolicyTarget
	GatewayTargets     []types.NamespacedName
	AncestorRefs       []gwv1.ParentReference
	AttachmentError    string
}

type RouteAttachment struct {
	// Route
	From utils.TypedNamespacedName
	// Immediate parent (Gateway or ListenerSet)
	To           utils.TypedNamespacedName
	ListenerName string
	// Eventual parent (always Gateway)
	Gateway types.NamespacedName
}

type RouteBackendResolver func(
	krtctx krt.HandlerContext,
	defaultNamespace string,
	gk schema.GroupKind,
	name gwv1.ObjectName,
	namespace *gwv1.Namespace,
	port *gwv1.PortNumber,
) (*api.BackendReference, error)