{{- if eq .Values.auth.mode "token" }}
{{- if not .Values.auth.token.existingSecret }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "claude-code.fullname" . }}-auth
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "claude-code.labels" . | nindent 4 }}
  annotations:
    "helm.sh/resource-policy": keep
type: Opaque
stringData:
  token: {{ include "claude-code.resolvedToken" . | quote }}
{{- end }}
{{- else if eq .Values.auth.mode "basic" }}
{{- if not .Values.auth.basic.existingSecret }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "claude-code.fullname" . }}-auth
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "claude-code.labels" . | nindent 4 }}
type: Opaque
stringData:
  htpasswd: |
    {{- range .Values.auth.basic.users }}
    {{ . }}
    {{- end }}
{{- end }}
{{- end }}