---
apiVersion: kuadrant.io/v1
kind: AuthPolicy
metadata:
  creationTimestamp: "2026-10-30T23:45:15Z"
  generation: 1
  labels:
    ai-gateway-controller.opendatahub.io/consumer-portal-instance: models-as-a-service
    app.kubernetes.io/managed-by: ai-gateway-controller
    app.kubernetes.io/name: maas-consumer-portal
    app.kubernetes.io/part-of: maas-consumer-portal
  managedFields:
  - apiVersion: kuadrant.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:labels:
          f:ai-gateway-controller.opendatahub.io/consumer-portal-instance: {}
          f:app.kubernetes.io/managed-by: {}
          f:app.kubernetes.io/name: {}
          f:app.kubernetes.io/part-of: {}
      f:spec:
        f:rules:
          f:authentication:
            f:browser:
              .: {}
              f:anonymous: {}
          f:authorization:
            f:require-session:
              .: {}
              f:patternMatching:
                f:patterns: {}
              f:priority: {}
            f:session:
              .: {}
              f:opa:
                f:allValues: {}
                f:rego: {}
              f:priority: {}
          f:response:
            f:success:
              f:headers:
                f:x-forwarded-access-token:
                  .: {}
                  f:plain:
                    f:expression: {}
            f:unauthorized:
              f:code: {}
              f:headers:
                f:Cache-Control:
                  .: {}
                  f:value: {}
                f:Location:
                  .: {}
                  f:expression: {}
              f:message:
                f:value: {}
        f:targetRef:
          f:group: {}
          f:kind: {}
          f:name: {}
    manager: ai-gateway-controller
    operation: Apply
    time: "2026-10-30T23:45:15Z"
  - apiVersion: kuadrant.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:status:
        .: {}
        f:conditions:
          .: {}
          k:{"type":"Accepted"}:
            .: {}
            f:lastTransitionTime: {}
            f:message: {}
            f:reason: {}
            f:status: {}
            f:type: {}
          k:{"type":"Enforced"}:
            .: {}
            f:lastTransitionTime: {}
            f:message: {}
            f:reason: {}
            f:status: {}
            f:type: {}
        f:observedGeneration: {}
    manager: manager
    operation: Update
    subresource: status
    time: "2026-10-30T23:45:17Z"
  name: maas-consumer-portal-session
  namespace: odh-ai-gateway-infra
  resourceVersion: "20199"
  uid: 96b6f196-8f03-4f64-88b2-4e46f4b4b7e7
spec:
  rules:
    authentication:
      browser:
        anonymous: {}
        metrics: false
        priority: 0
    authorization:
      require-session:
        metrics: false
        patternMatching:
          patterns:
          - predicate: auth.authorization.session.identity.access_token != ""
        priority: 1
      session:
        metrics: false
        opa:
          allValues: true
          rego: |
            allow = true

            login_location := sprintf("/oauth2/start?rd=%s", [urlquery.encode(input.context.request.http.path)])

            identity = result {
              cookie := object.get(input.context.request.http.headers, "cookie", "")
              cookie != ""
              response := http.send({
                "method": "GET",
                "url": "https://maas-consumer-portal-auth-proxy.odh-ai-gateway-infra.svc.cluster.local:4180/oauth2/auth",
                "headers": {"Cookie": cookie},
                "tls_ca_cert_file": "/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt",
                "timeout": "2s",
                "cache": false,
                "enable_redirect": false,
                "raise_error": false
              })
              {200, 202}[response.status_code]
              token := object.get(response.headers, "x-auth-request-access-token", [""])[0]
              token != ""
              result := {"access_token": token}
            } else = {"access_token": ""}
        priority: 0
    response:
      success:
        headers:
          x-forwarded-access-token:
            metrics: false
            plain:
              expression: auth.authorization.session.identity.access_token
            priority: 0
      unauthorized:
        code: 302
        headers:
          Cache-Control:
            value: no-store
          Location:
            expression: auth.authorization.session.login_location
        message:
          value: Redirecting to login
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: maas-consumer-portal
status:
  conditions:
  - lastTransitionTime: "2026-10-30T23:45:16Z"
    message: AuthPolicy has been accepted
    reason: Accepted
    status: "True"
    type: Accepted
  - lastTransitionTime: "2026-10-30T23:45:17Z"
    message: AuthPolicy has been successfully enforced
    reason: Enforced
    status: "True"
    type: Enforced
  observedGeneration: 1