{{- if .Values.auditDelivery.enabled }}
{{- if ne (first .Values.args) "serve" }}
{{- fail "auditDelivery currently supports serve decision pins only" }}
{{- end }}
{{- if not .Values.outbox.enabled }}
{{- fail "auditDelivery requires enabled durable outbox" }}
{{- end }}
{{- if not (regexMatch "^https?://[^/?#@]+/v1/events$" .Values.auditDelivery.url) }}
{{- fail "auditDelivery.url must be an explicit http(s) /v1/events endpoint" }}
{{- end }}
{{- if or (not (hasPrefix "/" .Values.auditDelivery.mountPath)) (contains ".." .Values.auditDelivery.mountPath) }}
{{- fail "auditDelivery.mountPath must be an absolute normalized directory" }}
{{- end }}
{{- end }}
{{- if .Values.envelopeSigning.enabled }}
{{- if ne (first .Values.args) "serve" }}
{{- fail "envelopeSigning currently supports serve decision pins only" }}
{{- end }}
{{- if or (not (hasPrefix "/" .Values.envelopeSigning.mountPath)) (contains ".." .Values.envelopeSigning.mountPath) }}
{{- fail "envelopeSigning.mountPath must be an absolute normalized directory" }}
{{- end }}
{{- end }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "flex-auth.name" . }}
  labels:
    {{- include "flex-auth.labels" . | nindent 4 }}
    {{- with .Values.releaseUnit }}
    railiance.io/release-unit: {{ . | quote }}
    {{- end }}
spec:
  {{- if .Values.outbox.enabled }}
  {{- $replicas := .Values.replicaCount }}
  {{- $numericKind := has (kindOf $replicas) (list "int" "int64" "int32" "uint" "uint64" "float64" "float32") }}
  {{- if or (not $numericKind) (not (or (eq (toString $replicas) "0") (eq (toString $replicas) "1"))) }}
  {{- fail "outbox requires numeric integer replicaCount 0 (stopped) or 1 (single writer)" }}
  {{- end }}
  strategy:
    type: Recreate
  {{- end }}
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      {{- include "flex-auth.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "flex-auth.labels" . | nindent 8 }}
    spec:
      automountServiceAccountToken: false
      {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
      serviceAccountName: {{ include "flex-auth.name" . }}
      {{- end }}
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        fsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: flex-auth
          image: {{ include "flex-auth.image" . }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          args:
            {{- toYaml .Values.args | nindent 12 }}
            {{- if .Values.envelopeSigning.enabled }}
            - --envelope-signing-key-file
            - {{ printf "%s/seed" .Values.envelopeSigning.mountPath | quote }}
            - --envelope-signing-kid
            - {{ required "envelopeSigning.kid must be independently admitted" .Values.envelopeSigning.kid | quote }}
            {{- end }}
            {{- if .Values.outbox.enabled }}
            {{- $limit := .Values.outbox.maxBytes }}
            {{- $numericKind := has (kindOf $limit) (list "int" "int64" "int32" "uint" "uint64" "float64" "float32") }}
            {{- $asFloat := float64 $limit }}
            {{- $validNumber := and $numericKind (eq $asFloat (floor $asFloat)) }}
            {{- $validString := and (kindIs "string" $limit) (regexMatch "^[1-9][0-9]*$" (toString $limit)) }}
            {{- if or (not (or $validNumber $validString)) (lt $asFloat 1.0) (gt $asFloat 67108864.0) }}
            {{- fail "outbox.maxBytes must be an exact integer between1 and67108864" }}
            {{- end }}
            - --outbox-max-bytes
            - {{ printf "%.0f" $asFloat | quote }}
            - --outbox-dir
            - {{ .Values.outbox.mountPath | quote }}
            - --emission-source
            - {{ required "outbox.source is required when outbox.enabled=true" .Values.outbox.source | quote }}
            {{- end }}
            {{- if .Values.auditDelivery.enabled }}
            - --audit-url
            - {{ .Values.auditDelivery.url | quote }}
            - --audit-token-file
            - {{ printf "%s/token" .Values.auditDelivery.mountPath | quote }}
            {{- end }}
            {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
            {{- $binding := "" }}
            {{- if not (and .Values.readback .Values.readback.enabled) }}
            {{- $binding = required "callerAuth.binding is required when callerAuth.mode is warn or enforce" .Values.callerAuth.binding }}
            {{- end }}
            - --caller-audience
            - {{ required "callerAuth.audience is required" .Values.callerAuth.audience | quote }}
            - --caller-auth-mode
            - {{ include "flex-auth.callerAuth.mode" . | quote }}
            - --caller-kubernetes-url
            - {{ required "callerAuth.kubernetesURL is required when callerAuth.mode is warn or enforce" .Values.callerAuth.kubernetesURL | quote }}
            {{- if and .Values.readback .Values.readback.enabled }}
            {{- /* serve-readback admits one readback caller and no /v1/check binding (FLEX-DEC-2026-019). */}}
            - --readback-caller
            - {{ required "readback.caller is required when readback.enabled=true" .Values.readback.caller | quote }}
            {{- else }}
            - --caller-binding
            - {{ $binding | quote }}
            {{- range .Values.callerAuth.extraBindings }}
            - --caller-binding
            - {{ . | quote }}
            {{- end }}
            {{- end }}
            {{- end }}
          ports:
            - name: http
              containerPort: {{ .Values.service.port }}
          livenessProbe:
            httpGet:
              path: {{ .Values.health.path }}
              port: http
            periodSeconds: 20
          readinessProbe:
            httpGet:
              path: {{ .Values.health.path }}
              port: http
            periodSeconds: 5
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
          {{- if or .Values.envelopeSigning.enabled .Values.outbox.enabled .Values.auditDelivery.enabled (eq (include "flex-auth.callerAuth.enabled" .) "true") }}
          volumeMounts:
            {{- if .Values.envelopeSigning.enabled }}
            - mountPath: {{ .Values.envelopeSigning.mountPath | quote }}
              name: flex-auth-envelope-signing
              readOnly: true
            {{- end }}
            {{- if .Values.auditDelivery.enabled }}
            - mountPath: {{ .Values.auditDelivery.mountPath | quote }}
              name: flex-auth-audit
              readOnly: true
            {{- end }}
            {{- if .Values.outbox.enabled }}
            - mountPath: {{ .Values.outbox.mountPath | quote }}
              name: flex-auth-outbox
            {{- end }}
            {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
            - mountPath: {{ .Values.callerAuth.reviewer.mountPath }}
              name: flex-auth-reviewer
              readOnly: true
            {{- end }}
          {{- end }}
      {{- if or .Values.envelopeSigning.enabled .Values.outbox.enabled .Values.auditDelivery.enabled (eq (include "flex-auth.callerAuth.enabled" .) "true") }}
      volumes:
        {{- if .Values.envelopeSigning.enabled }}
        - name: flex-auth-envelope-signing
          secret:
            secretName: {{ required "envelopeSigning.secretName must name an admitted existing Secret" .Values.envelopeSigning.secretName | quote }}
            defaultMode: 0440
            items:
              - key: {{ required "envelopeSigning.secretKey is required" .Values.envelopeSigning.secretKey | quote }}
                path: seed
        {{- end }}
        {{- if .Values.auditDelivery.enabled }}
        - name: flex-auth-audit
          secret:
            secretName: {{ required "auditDelivery.secretName must name an admitted existing Secret" .Values.auditDelivery.secretName | quote }}
            defaultMode: 0440
            items:
              - key: {{ required "auditDelivery.secretKey is required" .Values.auditDelivery.secretKey | quote }}
                path: token
        {{- end }}
        {{- if .Values.outbox.enabled }}
        - name: flex-auth-outbox
          persistentVolumeClaim:
            claimName: {{ default (printf "%s-outbox" (include "flex-auth.name" .)) .Values.outbox.existingClaim | quote }}
        {{- end }}
        {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
        - name: flex-auth-reviewer
          projected:
            defaultMode: 0440
            sources:
              - serviceAccountToken:
                  {{- if .Values.callerAuth.reviewer.audience }}
                  audience: {{ .Values.callerAuth.reviewer.audience | quote }}
                  {{- end }}
                  expirationSeconds: {{ .Values.callerAuth.reviewer.expirationSeconds }}
                  path: token
              - configMap:
                  name: kube-root-ca.crt
                  items:
                    - key: ca.crt
                      path: ca.crt
        {{- end }}
      {{- end }}