{{- $ctx := . -}}
{{- $sessNs := include "claude-code.sessionsNamespace" . -}}
{{- range $name, $id := .Values.git.identities }}
{{- if not $id.existingSecret }}
---
# Git アイデンティティ "{{ $name }}"（type: {{ $id.type }}）
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "claude-code.fullname" $ctx }}-git-{{ $name }}
  namespace: {{ $sessNs }}
  labels:
    {{- include "claude-code.labels" $ctx | nindent 4 }}
    claude-code.cafepieters.com/git-identity: {{ $name | quote }}
    claude-code.cafepieters.com/identity-source: helm
    claude-code.cafepieters.com/identity-type: {{ $id.type }}
type: Opaque
stringData:
  {{- if eq $id.type "ssh" }}
  {{- if not $id.sshPrivateKey }}{{ fail (printf "git.identities.%s: type=ssh には sshPrivateKey か existingSecret が必要です" $name) }}{{- end }}
  {{- if not $id.knownHosts }}{{ fail (printf "git.identities.%s: type=ssh には knownHosts が必須です（ホスト鍵の TOFU を無効化するため）" $name) }}{{- end }}
  id: {{ $id.sshPrivateKey | quote }}
  known_hosts: {{ $id.knownHosts | quote }}
  {{- else if eq $id.type "https-token" }}
  {{- if not $id.token }}{{ fail (printf "git.identities.%s: type=https-token には token か existingSecret が必要です" $name) }}{{- end }}
  username: {{ $id.username | default "x-access-token" | quote }}
  token: {{ $id.token | quote }}
  {{- else }}
  {{ fail (printf "git.identities.%s: type は ssh か https-token を指定してください" $name) }}
  {{- end }}
{{- end }}
{{- end }}