{{- /*
Catalyst-curated secrets bundle for the SME microservice mesh
(issue #859).

Why this template exists:
  SME services (auth, billing, catalog, console, domain, gateway,
  marketplace, notification, provisioning, tenant) read JWT signing
  keys, OAuth client credentials, SMTP settings, and admin bootstrap
  credentials from a single Kubernetes Secret named `sme-secrets` in
  the `sme` namespace. On contabo-mkt this Secret is hand-rolled in
  clusters/contabo-mkt/apps/sme/data/secrets.yaml. On a freshly
  franchised Sovereign nothing equivalent exists, so 10 of the 11 SME
  pods land in CreateContainerConfigError.

  This template materialises the Secret as part of the chart so any
  Sovereign that flips MARKETPLACE_ENABLED=true gets a working SME
  back-end out of the box.

Key contract (all 11 keys consumed across SME service Deployments):
  - JWT_SECRET             — auto-generated, persistent across reconciles
  - JWT_REFRESH_SECRET     — auto-generated, persistent across reconciles
  - GOOGLE_CLIENT_ID       — operator-supplied via .Values.marketplace.signupPolicy.googleOAuth.clientId
  - GOOGLE_CLIENT_SECRET   — operator-supplied via .Values.marketplace.signupPolicy.googleOAuth.clientSecretRef (lookup'd from a separate Secret); empty placeholder otherwise
  - SMTP_HOST              — .Values.smeSecrets.smtp.host
  - SMTP_PORT              — .Values.smeSecrets.smtp.port (string-quoted)
  - SMTP_FROM              — .Values.smeSecrets.smtp.from
  - SMTP_USER              — .Values.smeSecrets.smtp.user
  - SMTP_PASS              — operator-supplied via .Values.smeSecrets.smtp.passwordSecretRef (lookup'd); empty placeholder otherwise
  - ADMIN_EMAIL            — .Values.smeSecrets.admin.email
  - ADMIN_PASSWORD         — auto-generated, persistent across reconciles

Persistence across reconciles (load-bearing):
  Per the gitea-admin-secret pattern (platform/gitea/chart/templates/
  admin-secret.yaml — see issue #830 Bug 2 + feedback_passwords.md),
  randomly-generated secrets MUST survive helm upgrade / flux re-
  reconciliation. Without `lookup` every reconcile would emit a NEW
  JWT_SECRET, instantly invalidating every active session and
  every refresh token across all 10 services. Same hazard for
  ADMIN_PASSWORD — would lock out every admin on every reconcile.

  Steady state: lookup finds the existing Secret, decodes the
  existing values, and re-encodes them verbatim.
  First install (or `helm template`): lookup returns nil, randAlphaNum
  generates fresh 64-char (alphanum-only) values.
  helm.sh/resource-policy: keep so `helm uninstall` doesn't drop the
  bytes — a re-install picks up the same values via lookup.

Per docs/INVIOLABLE-PRINCIPLES.md #10: NO plaintext credentials in this
template. The randoms are generated by sprig's randAlphaNum and live
only in the Secret bytes. Never echo them.

Per #4 (never hardcode): every static value is overridable via
.Values.smeSecrets.* / .Values.marketplace.signupPolicy.googleOAuth.*
with placeholder defaults (operator brings real values via the
per-Sovereign overlay or admin-console signup form).
*/}}
{{- if and .Values.ingress .Values.ingress.marketplace .Values.ingress.marketplace.enabled -}}
{{- $secretName := .Values.smeSecrets.secretName | default "sme-secrets" -}}
{{- $namespace := .Values.smeSecrets.namespace | default "sme" -}}
{{- /* ---- Persistent randoms via lookup ---- */ -}}
{{- $existing := lookup "v1" "Secret" $namespace $secretName -}}
{{- $jwtSecret := "" -}}
{{- $jwtRefreshSecret := "" -}}
{{- $adminPassword := "" -}}
{{- if and $existing $existing.data $existing.data.JWT_SECRET -}}
  {{- $jwtSecret = $existing.data.JWT_SECRET | b64dec -}}
{{- else -}}
  {{- $jwtSecret = randAlphaNum 64 -}}
{{- end -}}
{{- if and $existing $existing.data $existing.data.JWT_REFRESH_SECRET -}}
  {{- $jwtRefreshSecret = $existing.data.JWT_REFRESH_SECRET | b64dec -}}
{{- else -}}
  {{- $jwtRefreshSecret = randAlphaNum 64 -}}
{{- end -}}
{{- if and $existing $existing.data $existing.data.ADMIN_PASSWORD -}}
  {{- $adminPassword = $existing.data.ADMIN_PASSWORD | b64dec -}}
{{- else -}}
  {{- $adminPassword = randAlphaNum 32 -}}
{{- end -}}
{{- /* ---- Operator-supplied OAuth client secret via separate Secret ---- */ -}}
{{- $googleClientID := "" -}}
{{- $googleClientSecret := "" -}}
{{- with .Values.marketplace.signupPolicy.googleOAuth -}}
  {{- $googleClientID = .clientId | default "" -}}
  {{- if and .clientSecretRef .clientSecretRef.name -}}
    {{- $oauthSecret := lookup "v1" "Secret" $namespace .clientSecretRef.name -}}
    {{- if and $oauthSecret $oauthSecret.data -}}
      {{- $key := .clientSecretRef.key | default "client-secret" -}}
      {{- if index $oauthSecret.data $key -}}
        {{- $googleClientSecret = index $oauthSecret.data $key | b64dec -}}
      {{- end -}}
    {{- end -}}
  {{- end -}}
{{- end -}}
{{- /* ---- Operator-supplied SMTP password via separate Secret ---- */ -}}
{{- $smtpPass := "" -}}
{{- with .Values.smeSecrets.smtp.passwordSecretRef -}}
  {{- if .name -}}
    {{- $smtpSecret := lookup "v1" "Secret" $namespace .name -}}
    {{- if and $smtpSecret $smtpSecret.data -}}
      {{- $key := .key | default "password" -}}
      {{- if index $smtpSecret.data $key -}}
        {{- $smtpPass = index $smtpSecret.data $key | b64dec -}}
      {{- end -}}
    {{- end -}}
  {{- end -}}
{{- end -}}
apiVersion: v1
kind: Secret
metadata:
  name: {{ $secretName }}
  namespace: {{ $namespace }}
  labels:
    catalyst.openova.io/blueprint: bp-catalyst-platform
    catalyst.openova.io/component: sme-secrets
    app.kubernetes.io/part-of: sme
  annotations:
    # Survive helm uninstall — the Secret outlives the release. A
    # subsequent helm install picks the bytes back up via lookup, so
    # JWT_SECRET / JWT_REFRESH_SECRET / ADMIN_PASSWORD remain stable
    # across reinstall.
    helm.sh/resource-policy: keep
type: Opaque
data:
  # ---- JWT signing keys (auto-generated, persistent) ----
  JWT_SECRET: {{ $jwtSecret | b64enc | quote }}
  JWT_REFRESH_SECRET: {{ $jwtRefreshSecret | b64enc | quote }}
  # ---- Google OAuth (operator-supplied) ----
  GOOGLE_CLIENT_ID: {{ $googleClientID | b64enc | quote }}
  GOOGLE_CLIENT_SECRET: {{ $googleClientSecret | b64enc | quote }}
  # ---- SMTP (operator-supplied; defaults safe for non-marketplace Sovereigns) ----
  SMTP_HOST: {{ .Values.smeSecrets.smtp.host | default "" | b64enc | quote }}
  SMTP_PORT: {{ .Values.smeSecrets.smtp.port | toString | default "" | b64enc | quote }}
  SMTP_FROM: {{ .Values.smeSecrets.smtp.from | default "" | b64enc | quote }}
  SMTP_USER: {{ .Values.smeSecrets.smtp.user | default "" | b64enc | quote }}
  SMTP_PASS: {{ $smtpPass | b64enc | quote }}
  # ---- Admin bootstrap (email static, password persistent random) ----
  ADMIN_EMAIL: {{ .Values.smeSecrets.admin.email | default "admin@openova.io" | b64enc | quote }}
  ADMIN_PASSWORD: {{ $adminPassword | b64enc | quote }}
{{- end }}
