{{- if and (eq .Values.anthropic.authMode "credentials") .Values.anthropic.refresher.enabled }}
{{- $sa := printf "%s-refresher" (include "claude-code.fullname" .) -}}
{{- $sessNs := include "claude-code.sessionsNamespace" . -}}
{{- $secret := include "claude-code.anthropicSecretName" . -}}
{{- $r := .Values.anthropic.refresher -}}
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ $sa }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "claude-code.labels" . | nindent 4 }}
    app.kubernetes.io/component: token-refresher
automountServiceAccountToken: true
---
# セッション NS の Claude 認証情報 Secret 1 個に対する get / patch のみ。
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ include "claude-code.fullname" . }}-refresher
  namespace: {{ $sessNs }}
  labels:
    {{- include "claude-code.labels" . | nindent 4 }}
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    resourceNames: [{{ $secret | quote }}]
    verbs: ["get", "patch", "update"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ include "claude-code.fullname" . }}-refresher
  namespace: {{ $sessNs }}
  labels:
    {{- include "claude-code.labels" . | nindent 4 }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ include "claude-code.fullname" . }}-refresher
subjects:
  - kind: ServiceAccount
    name: {{ $sa }}
    namespace: {{ .Release.Namespace }}
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: {{ include "claude-code.fullname" . }}-token-refresher
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "claude-code.labels" . | nindent 4 }}
    app.kubernetes.io/component: token-refresher
spec:
  schedule: {{ $r.schedule | quote }}
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 3
  startingDeadlineSeconds: 120
  jobTemplate:
    spec:
      activeDeadlineSeconds: 120
      backoffLimit: 2
      template:
        metadata:
          labels:
            {{- include "claude-code.selectorLabels" . | nindent 12 }}
            app.kubernetes.io/component: token-refresher
        spec:
          restartPolicy: Never
          serviceAccountName: {{ $sa }}
          automountServiceAccountToken: true
          securityContext:
            {{- include "claude-code.podSecurityContext" . | nindent 12 }}
          containers:
            - name: token-refresher
              image: "{{ .Values.image.manager.registry }}/{{ .Values.image.manager.repository }}:{{ .Values.image.manager.tag }}"
              imagePullPolicy: {{ .Values.image.manager.pullPolicy }}
              command: ["python3", "-u", "/app/token-refresher.py"]
              env:
                - name: PYTHONDONTWRITEBYTECODE
                  value: "1"
                - name: SESSIONS_NAMESPACE
                  value: {{ $sessNs | quote }}
                - name: ANTHROPIC_SECRET
                  value: {{ $secret | quote }}
                - name: CREDENTIALS_KEY
                  value: {{ .Values.anthropic.existingSecretKeyCredentials | default ".credentials.json" | quote }}
                - name: TOKEN_URL
                  value: {{ $r.tokenUrl | quote }}
                - name: CLIENT_ID
                  value: {{ $r.clientId | quote }}
                - name: REFRESH_IF_EXPIRES_IN
                  value: {{ $r.refreshIfExpiresInSeconds | quote }}
              securityContext:
                {{- include "claude-code.containerSecurityContext" . | nindent 16 }}
              resources:
                {{- toYaml $r.resources | nindent 16 }}
              volumeMounts:
                - name: app
                  mountPath: /app
                  readOnly: true
                - name: tmp
                  mountPath: /tmp
          volumes:
            - name: app
              configMap:
                name: {{ include "claude-code.fullname" . }}-manager
                defaultMode: 0555
            - name: tmp
              emptyDir:
                medium: Memory
                sizeLimit: 8Mi
{{- end }}