# Copyright (c) 2024 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

suite: "Participant values"
templates:
  - participant.yaml
release:
  # Set for testing labels
  name: participant-1
chart:
  # Override for testing labels
  version: 0.1.1
  appVersion: 0.1.0
set:
  persistence:
    host: mock-pg-host
    schema: participant
  auth:
    jwksUrl: "https://mock.com/.well-known/jwks.json"
    targetAudience: "mock_audience"
tests:
  - it: "sets labels as expected"
    set:
      # Explicit migration ID for testing
      metrics:
        enabled: true
        migration:
          id: 1
      # Extra label for testing
      pod:
        labels:
          mock: yes-please
    documentSelector:
      path: kind
      value: Deployment
    asserts:
      # Sanity check
      - equal:
          path: spec.template.spec.containers[0].name
          value: participant
      # Labels on deployment
      - isSubset:
          path: metadata.labels
          content:
            # Splice-specific
            app: participant-1
            migration_id: "1"
            # k8s/Helm standard
            app.kubernetes.io/instance: participant-1
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: participant-1
            app.kubernetes.io/version: "0.1.0"
            helm.sh/chart: splice-participant-0.1.1
            # Extra for test
            mock: yes-please
      # Labels on pod; should be the same as on deployment
      - isSubset:
          path: spec.template.metadata.labels
          content:
            # Splice-specific
            app: participant-1
            migration_id: "1"
            # k8s/Helm standard
            app.kubernetes.io/instance: participant-1
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: participant-1
            app.kubernetes.io/version: "0.1.0"
            helm.sh/chart: splice-participant-0.1.1
            # Extra for test
            mock: yes-please
      # Annotations on pod (we didn't set any)
      - isNullOrEmpty:
          path: spec.template.metadata.annotations
  - it: "deploys as expected with some AWS KMS config"
    set:
      # More interesting options
      kms:
        # All of these are mock values; we translate to Canton config directly
        type: awwws
        region: mock_region
        extraCantonKey: mock_value
        mapCantonKey:
          firstMapEntry: first_map_value
          secondMapEntry: second_map_value
          recursiveMapEntry:
            recursiveMap: recursive_value
      additionalEnvVars:
        - name: AWWWS_ACCESS_KEY_ID
          valueFrom:
            secretKeyRef:
              name: awwws-credentials
              key: accessKeyId
    documentSelector:
      path: kind
      value: Deployment
    asserts:
      # Sanity check
      - equal:
          path: spec.template.spec.containers[0].name
          value: participant
      # KMS config
      - contains:
          path: spec.template.spec.containers[0].env
          content:
            # We don't really care about the name of the env var but helm unittest wants it
            name: ADDITIONAL_CONFIG_SPLICE_PARTICIPANT_CRYPTO_PROVIDER_KMS
            value: |
              canton.participants.participant.crypto {
                provider = kms
                kms = {
                  extra-canton-key = mock_value
                  map-canton-key = {
                    first-map-entry = first_map_value
                    recursive-map-entry = {
                      recursive-map = recursive_value
                    }
                    second-map-entry = second_map_value
                  }
                  region = mock_region
                  type = awwws
                }
              }
      # Secret configured via Helm with valueFrom
      - contains:
          path: spec.template.spec.containers[0].env
          content:
            name: AWWWS_ACCESS_KEY_ID
            valueFrom:
              secretKeyRef:
                name: awwws-credentials
                key: accessKeyId
  - it: "handles multiline additionalEnvVars values"
    set:
      additionalEnvVars:
        - name: CUSTOM
          value: |
            multi
            line
            environment
            variable
    documentSelector:
      path: kind
      value: Deployment
    asserts:
      # Sanity check
      - equal:
          path: spec.template.spec.containers[0].name
          value: participant
      # multi-line env var
      - contains:
          path: spec.template.spec.containers[0].env
          content:
            name: CUSTOM
            value: "multi\nline\nenvironment\nvariable\n"
  - it: "extraVolumes are differentiated correctly"
    set:
      extraVolumes:
        - name: secret-volume
          secret:
            secretName: secret_name
        - name: pvc-volume
          persistentVolumeClaim:
            claimName: claim_name
        - name: empty-dir-volume
    documentSelector:
      path: kind
      value: Deployment
    asserts:
      # Sanity check
      - equal:
          path: spec.template.spec.containers[0].name
          value: participant
      # range of extraVolumes with correct refs
      - equal:
          path: spec.template.spec.volumes
          value:
            - name: secret-volume
              secret:
                secretName: secret_name
            - name: pvc-volume
              persistentVolumeClaim:
                claimName: claim_name
            - name: empty-dir-volume
  - it: "defaults to auth"
    documentSelector:
      path: kind
      value: Deployment
    asserts:
      - notExists:
          path: spec.template.spec.containers[?(@.name=='participant')].env[?(@.name=='CANTON_PARTICIPANT_ADMIN_USER_NAME')].value
      - notExists:
          path: spec.template.spec.containers[?(@.name=='participant')].env[?(@.name=='ADDITIONAL_CONFIG_DISABLE_AUTH')].value
  - it: "supports disabling auth"
    set:
      disableAuth: true
    documentSelector:
      path: kind
      value: Deployment
    asserts:
      - equal:
          path: spec.template.spec.containers[?(@.name=='participant')].env[?(@.name=='CANTON_PARTICIPANT_ADMIN_USER_NAME')].value
          value: ledger-api-user
      - equal:
          path: spec.template.spec.containers[?(@.name=='participant')].env[?(@.name=='ADDITIONAL_CONFIG_DISABLE_AUTH')].value
          value: |
            canton.participants.participant.ledger-api.auth-services=[{
              type = unsafe-jwt-hmac-256
              target-audience = "https://ledger_api.example.com"
              secret = "unsafe"
            }]
      - notExists:
          path: spec.template.spec.containers[?(@.name=='participant')].env[?(@.name=='AUTH_JWKS_URL')].value
      - notExists:
          path: spec.template.spec.containers[?(@.name=='participant')].env[?(@.name=='AUTH_TARGET_AUDIENCE')].value