# Valid sample — corporate Org with Azure-SSO federation. Verified via:
#   kubectl apply --dry-run=server -f organization-sample-valid.yaml
apiVersion: orgs.openova.io/v1
kind: Organization
metadata:
  name: acme
  labels:
    openova.io/sovereign: omantel.omani.works
spec:
  slug: acme
  displayName: ACME Corp
  kind: customer
  tier: corporate
  billingMode: real
  sovereignRef: omantel.omani.works
  defaultEnvironmentType: prod
  owners:
    - email: ceo@acme.com
      role: owner
    - email: ops@acme.com
      role: admin
  identity:
    federationProvider: azure-sso
    federationConfig:
      issuer: https://login.microsoftonline.com/00000000-0000-0000-0000-aaaaaaaaaaaa/v2.0
      clientId: acme-catalyst
      clientSecretRef:
        name: acme-azure-sso-secret
        key: client-secret
      # Slice F2 (#1098) — OIDC discovery endpoints + claim-mapper table.
      tenantId: 00000000-0000-0000-0000-aaaaaaaaaaaa
      authorizationUrl: https://login.microsoftonline.com/00000000-0000-0000-0000-aaaaaaaaaaaa/oauth2/v2.0/authorize
      tokenUrl: https://login.microsoftonline.com/00000000-0000-0000-0000-aaaaaaaaaaaa/oauth2/v2.0/token
      jwksUrl: https://login.microsoftonline.com/00000000-0000-0000-0000-aaaaaaaaaaaa/discovery/v2.0/keys
      claimMappers:
        - { src: oid, dest: openova.io/external-id }
        - { src: upn, dest: email }
        - { src: groups, dest: openova.io/groups }
---
# A second valid sample — internal-team Org with chargeback
apiVersion: orgs.openova.io/v1
kind: Organization
metadata:
  name: bank-engineering
spec:
  slug: bank-engineering
  displayName: Bank Engineering
  kind: internal
  tier: corporate
  billingMode: chargeback
  sovereignRef: omantel.omani.works
  parentOrg: bank
  defaultEnvironmentType: dev
  owners:
    - email: cto@bank.example
      role: owner
