{{- define "flex-auth.image" -}}
{{- if not .Values.image.digest }}
{{- fail "image.digest is required (digest_policy=required); do not deploy by tag" }}
{{- end }}
{{- printf "%s@%s" .Values.image.repository .Values.image.digest -}}
{{- end -}}

{{- define "flex-auth.name" -}}
{{- required "name is required" .Values.name -}}
{{- end -}}

{{- define "flex-auth.selectorLabels" -}}
app.kubernetes.io/name: {{ include "flex-auth.name" . }}
{{- end -}}

{{- define "flex-auth.labels" -}}
{{ include "flex-auth.selectorLabels" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/part-of: flex-auth
{{- end -}}

{{- define "flex-auth.callerAuth.mode" -}}
{{- $mode := "disabled" -}}
{{- if and (hasKey .Values "callerAuth") .Values.callerAuth (hasKey .Values.callerAuth "mode") .Values.callerAuth.mode -}}
{{- $mode = .Values.callerAuth.mode -}}
{{- end -}}
{{- if not (has $mode (list "disabled" "warn" "enforce")) -}}
{{- fail (printf "callerAuth.mode must be disabled, warn, or enforce; got %q" $mode) -}}
{{- end -}}
{{- $mode -}}
{{- end -}}

{{- define "flex-auth.callerAuth.enabled" -}}
{{- if has (include "flex-auth.callerAuth.mode" .) (list "warn" "enforce") -}}true{{- else -}}false{{- end -}}
{{- end -}}