// Copyright 2020-2026 Project Capsule Authors
// SPDX-License-Identifier: Apache-2.0

package configuration

import (
	"context"
	"regexp"

	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/client-go/rest"

	capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
	capsuleapi "github.com/projectcapsule/capsule/pkg/api"
	"github.com/projectcapsule/capsule/pkg/api/rbac"
)

const (
	TenantCRDName = "tenants.capsule.clastix.io"
)

type Configuration interface {
	GetConfigObject() *capsulev1beta2.CapsuleConfiguration

	ProtectedNamespaceRegexp() (*regexp.Regexp, error)
	ForceTenantPrefix() bool
	// EnableTLSConfiguration enabled the TLS reconciler, responsible for creating CA and TLS certificate required
	// for the CRD conversion and webhooks.
	EnableTLSConfiguration() bool
	AllowServiceAccountPromotion() bool
	TLSSecretName() string
	MutatingWebhookConfigurationName() string
	ValidatingWebhookConfigurationName() string
	TenantCRDName() string
	UserNames() []string
	UserGroups() []string
	Users() rbac.UserListSpec
	GetUsersByStatus() rbac.UserListSpec
	IgnoreUserWithGroups() []string
	ForbiddenUserNodeLabels() *capsuleapi.ForbiddenListSpec
	ForbiddenUserNodeAnnotations() *capsuleapi.ForbiddenListSpec
	Administrators() rbac.UserListSpec
	ServiceAccountClientProperties() capsulev1beta2.ServiceAccountClient
	ServiceAccountClient(context.Context) (*rest.Config, error)
	Admission() capsulev1beta2.DynamicAdmission
	Events() capsulev1beta2.EventsConfiguration
	RBAC() *capsulev1beta2.RBACConfiguration
	CacheInvalidation() metav1.Duration
}