{{- /*
Ingress + admin Ingress + Traefik allowlist Middleware. Both virtual
hosts (`api.<sovereign-fqdn>` + `admin.<sovereign-fqdn>`) are
operator-supplied via `ingress.host` + `ingress.adminHost` in the
per-Sovereign bootstrap-kit overlay (slot 80-newapi.yaml).

Skip-render gate: when EITHER host is empty, the chart's ingress block
is silently skipped. This matches the pattern used by other bootstrap-
kit HTTPRoute templates (bp-keycloak / bp-openbao / bp-external-dns)
and lets the CI smoke render (`helm template` with default values)
succeed end-to-end without smuggling a host placeholder. A real
Sovereign install whose overlay forgets to set the hosts surfaces the
gap as "no Ingress object materialised" — caught by the bootstrap-kit
smoke test, not by render-time fail.
*/ -}}
{{- if and .Values.newapi.enabled .Values.ingress.enabled .Values.ingress.host .Values.ingress.adminHost }}
{{- $fullName := include "bp-newapi.fullname" . -}}
{{- $svcPort := .Values.service.port -}}
{{- $apiHost := .Values.ingress.host -}}
{{- $adminHost := .Values.ingress.adminHost -}}
{{- if .Values.ingress.middleware.enabled }}
---
# ─── Customer-facing API ingress (Traefik Middleware allowlist) ──────────
# Only rendered when running on a Traefik-Ingress cluster. Sovereigns use
# Cilium Gateway API and don't have the traefik.io/v1alpha1 Middleware
# CRD, so this entire resource is gated behind ingress.middleware.enabled
# (default false). Path allowlist enforcement on Cilium Gateway is owned
# by the HTTPRoute templates instead (see bp-self-sovereign-cutover for
# the canonical pattern).
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: {{ $fullName }}-api-allowlist
  labels:
    {{- include "bp-newapi.labels" . | nindent 4 }}
spec:
  # Block any path not on customerAPIAllowedPaths. The regex is built
  # from the allowlist; a request that doesn't match returns 404.
  errors:
    status: ["404"]
    service:
      name: {{ $fullName }}
      port: {{ $svcPort }}
    query: "/notfound"
{{- end }}
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ $fullName }}-api
  labels:
    {{- include "bp-newapi.labels" . | nindent 4 }}
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"
    {{- with .Values.ingress.annotations }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
spec:
  ingressClassName: {{ .Values.ingress.className }}
  {{- if .Values.ingress.tls.enabled }}
  tls:
    - hosts:
        - {{ $apiHost }}
      secretName: {{ .Values.ingress.tls.apiSecretName }}
  {{- end }}
  rules:
    - host: {{ $apiHost }}
      http:
        paths:
          {{- range .Values.ingress.customerAPIAllowedPaths }}
          - path: {{ . }}
            pathType: Prefix
            backend:
              service:
                name: {{ $fullName }}
                port:
                  number: {{ $svcPort }}
          {{- end }}
---
# ─── Ops-staff admin UI ingress ──────────────────────────────────────────
# Separate virtual host. Full UI surface allowed (admin UI is the entire
# upstream NewAPI portal — channels, users, credits, audit). IdP-gated:
# in keycloak mode the OIDC middleware redirects unauthenticated requests
# to Keycloak before reaching the pod.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ $fullName }}-admin
  labels:
    {{- include "bp-newapi.labels" . | nindent 4 }}
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"
    {{- with .Values.ingress.annotations }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
spec:
  ingressClassName: {{ .Values.ingress.className }}
  {{- if .Values.ingress.tls.enabled }}
  tls:
    - hosts:
        - {{ $adminHost }}
      secretName: {{ .Values.ingress.tls.adminSecretName }}
  {{- end }}
  rules:
    - host: {{ $adminHost }}
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: {{ $fullName }}
                port:
                  number: {{ $svcPort }}
{{- end }}
