{{- if and .Values.guacamole.enabled .Values.guacamole.realmConfig.enabled -}}
# Keycloak realm-config patch consumed by bp-keycloak's
# keycloak-config-cli post-deploy Job.
#
# Per the canonical seam (canon §2 + platform/keycloak/chart/
# templates/configmap-sovereign-realm.yaml): bp-keycloak's
# post-deploy Job iterates ConfigMaps in the keycloak namespace
# carrying label `catalyst.openova.io/keycloak-config: realm-patch`
# and merges each `realm-patch.json` payload into the named realm.
#
# This template emits one such ConfigMap that adds:
#   - the `guacamole` OIDC client (confidential, redirectURIs from
#     values.yaml)
#   - the `guacamole-user` realm role
#   - a default group mapping so any user in `guacamole-users`
#     receives the role
#
# Empty placeholder for the client-secret — Keycloak generates one
# on first realm reconcile and the operator extracts it via the
# admin API into the SealedSecret declared in keycloak-client-secret.yaml.
# Two-step bootstrap (chart applies → operator pulls secret →
# kubeseal → re-apply) is the same pattern the rest of the
# Catalyst-curated stack follows for non-pre-shared OIDC clients.
apiVersion: v1
kind: ConfigMap
metadata:
  # The bp-keycloak Job sorts ConfigMaps by name and applies them in
  # order; the bp-* prefix groups Catalyst-owned patches together.
  name: bp-guacamole-realm-patch
  # ConfigMap MUST live in the same namespace as bp-keycloak's
  # keycloak-config-cli post-deploy Job — the Job's selector is
  # `catalyst.openova.io/keycloak-config: realm-patch` scoped to its
  # own namespace. Operator overrides via .Values.guacamole.realmConfig.namespace
  # when bp-keycloak runs in a non-default namespace.
  namespace: {{ .Values.guacamole.realmConfig.namespace | default "keycloak" }}
  labels:
    {{- include "bp-guacamole.labels" . | nindent 4 }}
    catalyst.openova.io/keycloak-config: realm-patch
data:
  realm-patch.json: |
    {
      "realm": {{ .Values.guacamole.realmConfig.realm | quote }},
      "clients": [
        {
          "clientId": {{ .Values.guacamole.oidc.clientId | quote }},
          "name": "Apache Guacamole",
          "enabled": true,
          "publicClient": false,
          "standardFlowEnabled": true,
          "implicitFlowEnabled": false,
          "directAccessGrantsEnabled": false,
          "serviceAccountsEnabled": false,
          "redirectUris": [
            "{{ include "bp-guacamole.oidcRedirectURI" . }}*"
          ],
          "webOrigins": [
            "https://{{ include "bp-guacamole.host" . }}"
          ],
          "attributes": {
            "post.logout.redirect.uris": "{{ include "bp-guacamole.oidcRedirectURI" . }}*"
          },
          "protocolMappers": [
            {
              "name": "{{ .Values.guacamole.oidc.groupsClaim }}",
              "protocol": "openid-connect",
              "protocolMapper": "oidc-group-membership-mapper",
              "config": {
                "claim.name": {{ .Values.guacamole.oidc.groupsClaim | quote }},
                "full.path": "false",
                "id.token.claim": "true",
                "access.token.claim": "true",
                "userinfo.token.claim": "true"
              }
            }
          ]
        }
      ],
      "roles": {
        "realm": [
          { "name": "guacamole-user", "description": "Guacamole authenticated user" }
        ]
      },
      "groups": [
        {
          "name": "guacamole-users",
          "realmRoles": ["guacamole-user"]
        }
      ]
    }
{{- end }}
