{{- /*
chart-roll-rca iter-15 (2026-05-10) defense-in-depth: APIVersions.Has
gate ensures the manifest evaluates to empty bytes when the
access.openova.io/v1alpha1 XRD is not yet registered (e.g., bp-crossplane-claims
mid-install). Even if dependsOn ordering breaks again, the umbrella
chart will not block on missing-CRD admission failure. The next
reconcile pass once the XRD is live will render and apply the CR.
*/ -}}
{{- if and .Values.qaFixtures.enabled (.Capabilities.APIVersions.Has "access.openova.io/v1alpha1/UserAccess") }}
apiVersion: access.openova.io/v1alpha1
kind: UserAccess
metadata:
  name: qa-user1
  namespace: catalyst-system
  labels:
    catalyst.openova.io/managed-by: qa-fixtures
    catalyst.openova.io/tier: developer
    openova.io/env-type: dev
    openova.io/application: {{ .Values.qaFixtures.appName | default "qa-wp" }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
  annotations:
    catalyst.openova.io/user-email: {{ .Values.qaFixtures.qaUser.email | default "qa-user1@openova.io" | quote }}
    catalyst.openova.io/user-name: {{ .Values.qaFixtures.qaUser.name | default "qa-user1" | quote }}
spec:
  # UserAccess CRD validates spec.sovereignRef against `^[a-z0-9][a-z0-9-]{0,62}$`
  # — single-label only (no dots). Strip the TLD/SLD from the FQDN
  # so {qaFixtures.sovereignRef = "omantel.biz"} renders as "omantel".
  # Other CRDs (Organization, Environment) want the FQDN as-is.
  sovereignRef: {{ regexReplaceAll "\\..*$" (.Values.qaFixtures.sovereignRef | default "omantel.biz") "" | quote }}
  tierRoleRef: openova:tier-developer
  user:
    keycloakSubject: {{ .Values.qaFixtures.qaUser.keycloakSubject | default "qa-user1" | quote }}
  scopes:
  - key: openova.io/env-type
    value: dev
  - key: openova.io/application
    value: {{ .Values.qaFixtures.appName | default "qa-wp" | quote }}
  - key: organization
    value: {{ .Values.qaFixtures.organization | default "omantel-platform" | quote }}
{{- end }}
