{{- /*
NewAPI sandbox-token signing key Secret (PR #1638).

Backs the real /admin/tokens/sandbox bridge handler (PR #1638; replaces
PR #1619 stub). The handler mints HS256 per-Sandbox tokens for use by
Sandbox agent Pods on every NewAPI /v1/* call. Two pieces of secret
material live here:

  - SIGNING_KEY  — raw HS256 bytes the bridge uses to sign minted
                   tokens. NewAPI verifies inbound tokens with the same
                   bytes (Wave 5+ wires gateway-side validation; for
                   now the bridge is the only consumer).
  - ADMIN_SECRET — shared bearer the sandbox-controller presents on
                   every POST /admin/tokens/sandbox. The bridge
                   compares with subtle.ConstantTimeCompare; mismatch
                   returns 401.

Both fields are 64 random alphanumeric chars (sprig randAlphaNum 64) —
matching the entropy used for SESSION_SECRET/CRYPTO_SECRET in
templates/credentials-secret.yaml (issue #943).

Persistent across reconciles via Helm `lookup`. Same load-bearing
pattern as platform/gitea/chart/templates/admin-secret.yaml (issue #830
Bug 2 + feedback_passwords.md) and platform/newapi/chart/templates/
credentials-secret.yaml (issue #943). Without lookup every reconcile
would rotate both pieces of material — invalidating every active
Sandbox Pod's mounted token AND breaking the sandbox-controller's
auth path until its own Pod restarts and re-reads the new secret.

Per Inviolable Principle #4 (never hardcode) the operator may bring
their own bytes via per-Sovereign overlay setting
`sandboxTokenSigningKey.existingSecret` — when non-empty THAT name
takes precedence (deployment.yaml reads from it directly) and this
template renders nothing extra.

helm.sh/resource-policy: keep so a `helm uninstall` + reinstall
recovers the same bytes (otherwise an upgrade silently invalidates
every per-Sandbox token across the Sovereign).
*/}}
{{- if and .Values.sandboxTokenSigningKey.autoProvision (not .Values.sandboxTokenSigningKey.existingSecret) -}}
{{- $secretName := default (printf "%s-token-signing-key" (include "bp-newapi.fullname" .)) .Values.sandboxTokenSigningKey.autoSecretName -}}
{{- $existing := lookup "v1" "Secret" .Release.Namespace $secretName -}}
{{- $signingKey := "" -}}
{{- $adminSecret := "" -}}
{{- if and $existing $existing.data $existing.data.SIGNING_KEY -}}
  {{- $signingKey = $existing.data.SIGNING_KEY | b64dec -}}
{{- else -}}
  {{- $signingKey = randAlphaNum 64 -}}
{{- end -}}
{{- if and $existing $existing.data $existing.data.ADMIN_SECRET -}}
  {{- $adminSecret = $existing.data.ADMIN_SECRET | b64dec -}}
{{- else -}}
  {{- $adminSecret = randAlphaNum 64 -}}
{{- end -}}
apiVersion: v1
kind: Secret
metadata:
  name: {{ $secretName }}
  labels:
    {{- include "bp-newapi.labels" . | nindent 4 }}
  annotations:
    helm.sh/resource-policy: keep
    # Reflector wiring — the sandbox-controller (in the `catalyst-system`
    # namespace per clusters/_template/bootstrap-kit/19a-bp-sandbox.yaml
    # `targetNamespace`) reads ADMIN_SECRET to call POST /admin/tokens/
    # sandbox against catalyst-api. emberstack/reflector mirrors this
    # Secret into the namespaces named by `reflection-{allowed,auto}-
    # namespaces` so a cross-namespace mount works without a custom
    # RBAC binding. Default also includes `sandbox` for legacy overlays
    # that still install into a dedicated `sandbox` namespace + any
    # sister tooling (catalyst-api PATs routed through the bridge) that
    # wants the admin bearer locally.
    #
    # Per-Sovereign overlays may add more namespaces (e.g. when
    # additional sister controllers need the same admin bearer) by
    # appending to .Values.sandboxTokenSigningKey.reflectorNamespaces.
    reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
    reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: {{ .Values.sandboxTokenSigningKey.reflectorNamespaces | default "catalyst-system,sandbox" | quote }}
    reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
    reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: {{ .Values.sandboxTokenSigningKey.reflectorNamespaces | default "catalyst-system,sandbox" | quote }}
type: Opaque
data:
  SIGNING_KEY: {{ $signingKey | b64enc | quote }}
  ADMIN_SECRET: {{ $adminSecret | b64enc | quote }}
{{- end }}
