---
apiVersion: authorino.kuadrant.io/v1beta3
kind: AuthConfig
metadata:
  annotations:
    HTTPRouteRule.gateway.networking.k8s.io: httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-consumer-portal#rule-1
  creationTimestamp: "2026-10-30T23:45:16Z"
  generation: 1
  labels:
    kuadrant.io/auth: "true"
    kuadrant.io/managed: "true"
  managedFields:
  - apiVersion: authorino.kuadrant.io/v1beta3
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .: {}
          f:HTTPRouteRule.gateway.networking.k8s.io: {}
        f:labels:
          .: {}
          f:kuadrant.io/auth: {}
          f:kuadrant.io/managed: {}
      f:spec:
        .: {}
        f:authentication:
          .: {}
          f:browser:
            .: {}
            f:anonymous: {}
            f:credentials: {}
            f:metrics: {}
            f:priority: {}
        f:authorization:
          .: {}
          f:require-session:
            .: {}
            f:metrics: {}
            f:patternMatching:
              .: {}
              f:patterns: {}
            f:priority: {}
          f:session:
            .: {}
            f:metrics: {}
            f:opa:
              .: {}
              f:allValues: {}
              f:rego: {}
            f:priority: {}
        f:hosts: {}
        f:response:
          .: {}
          f:success:
            .: {}
            f:headers:
              .: {}
              f:x-forwarded-access-token:
                .: {}
                f:metrics: {}
                f:plain:
                  .: {}
                  f:expression: {}
                f:priority: {}
          f:unauthorized:
            .: {}
            f:code: {}
            f:headers:
              .: {}
              f:Cache-Control:
                .: {}
                f:value: {}
              f:Location:
                .: {}
                f:expression: {}
            f:message:
              .: {}
              f:value: {}
    manager: manager
    operation: Update
    time: "2026-10-30T23:45:16Z"
  - apiVersion: authorino.kuadrant.io/v1beta3
    fieldsType: FieldsV1
    fieldsV1:
      f:status:
        .: {}
        f:conditions: {}
        f:summary:
          .: {}
          f:festivalWristbandEnabled: {}
          f:hostsReady: {}
          f:numAuthorizationPolicies: {}
          f:numHostsReady: {}
          f:numIdentitySources: {}
          f:numMetadataSources: {}
          f:numResponseItems: {}
          f:ready: {}
    manager: authorino
    operation: Update
    subresource: status
    time: "2026-10-30T23:46:15Z"
  name: b18ca1a342d3bb98d23e4a1717622069075793962c2234c804ca309e1c26dac4
  namespace: kuadrant-system
  resourceVersion: "21964"
  uid: dc8580f6-a250-4611-abf5-dce4a3a9a970
spec:
  authentication:
    browser:
      anonymous: {}
      credentials: {}
      metrics: false
      priority: 0
  authorization:
    require-session:
      metrics: false
      patternMatching:
        patterns:
        - predicate: auth.authorization.session.identity.access_token != ""
      priority: 1
    session:
      metrics: false
      opa:
        allValues: true
        rego: |
          allow = true

          login_location := sprintf("/oauth2/start?rd=%s", [urlquery.encode(input.context.request.http.path)])

          identity = result {
            cookie := object.get(input.context.request.http.headers, "cookie", "")
            cookie != ""
            response := http.send({
              "method": "GET",
              "url": "https://maas-consumer-portal-auth-proxy.odh-ai-gateway-infra.svc.cluster.local:4180/oauth2/auth",
              "headers": {"Cookie": cookie},
              "tls_ca_cert_file": "/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt",
              "timeout": "2s",
              "cache": false,
              "enable_redirect": false,
              "raise_error": false
            })
            {200, 202}[response.status_code]
            token := object.get(response.headers, "x-auth-request-access-token", [""])[0]
            token != ""
            result := {"access_token": token}
          } else = {"access_token": ""}
      priority: 0
  hosts:
  - b18ca1a342d3bb98d23e4a1717622069075793962c2234c804ca309e1c26dac4
  response:
    success:
      headers:
        x-forwarded-access-token:
          metrics: false
          plain:
            expression: auth.authorization.session.identity.access_token
          priority: 0
    unauthorized:
      code: 302
      headers:
        Cache-Control:
          value: no-store
        Location:
          expression: auth.authorization.session.login_location
      message:
        value: Redirecting to login
status:
  conditions:
  - lastTransitionTime: "2026-10-30T23:46:15Z"
    reason: HostsLinked
    status: "True"
    type: Available
  - lastTransitionTime: "2026-10-30T23:46:15Z"
    reason: Reconciled
    status: "True"
    type: Ready
  summary:
    festivalWristbandEnabled: false
    hostsReady:
    - b18ca1a342d3bb98d23e4a1717622069075793962c2234c804ca309e1c26dac4
    numAuthorizationPolicies: 2
    numHostsReady: 1/1
    numIdentitySources: 1
    numMetadataSources: 0
    numResponseItems: 1
    ready: true