{{- $namespaces := (include "secrets-operator.scopedNamespaces" . | fromJson).list }}
{{- $isScopedMode := and $namespaces .Values.scopedRBAC }}

{{- /* Define the rules once to avoid repetition */ -}}
{{- define "secrets-operator.managerRules" }}
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  - secrets
  verbs:
  - create
  - delete
  - get
  - list
  - update
  - watch
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - list
- apiGroups:
  - ""
  resources:
  - serviceaccounts
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - serviceaccounts/token
  verbs:
  - create
- apiGroups:
  - apps
  resources:
  - daemonsets
  - deployments
  - statefulsets
  verbs:
  - get
  - list
  - update
  - watch
- apiGroups:
  - authentication.k8s.io
  resources:
  - tokenreviews
  verbs:
  - create
- apiGroups:
  - secrets.infisical.com
  resources:
  - clustergenerators
  - infisicaldynamicsecrets
  - infisicalpushsecrets
  - infisicalsecrets
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - secrets.infisical.com
  resources:
  - infisicaldynamicsecrets/finalizers
  - infisicalpushsecrets/finalizers
  - infisicalsecrets/finalizers
  verbs:
  - update
- apiGroups:
  - secrets.infisical.com
  resources:
  - infisicaldynamicsecrets/status
  - infisicalpushsecrets/status
  - infisicalsecrets/status
  verbs:
  - get
  - patch
  - update
{{- end }}

{{- if $isScopedMode }}
{{- /* Scoped mode: Create a Role and RoleBinding in each namespace */ -}}
{{- range $ns := $namespaces }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ include "secrets-operator.fullname" $ }}-manager-role
  namespace: {{ $ns | quote }}
  labels:
  {{- include "secrets-operator.labels" $ | nindent 4 }}
{{- include "secrets-operator.managerRules" $ }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ include "secrets-operator.fullname" $ }}-manager-rolebinding
  namespace: {{ $ns | quote }}
  labels:
  {{- include "secrets-operator.labels" $ | nindent 4 }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ include "secrets-operator.fullname" $ }}-manager-role
subjects:
- kind: ServiceAccount
  name: {{ include "secrets-operator.serviceAccountName" $ }}
  namespace: {{ $.Release.Namespace }}
{{- end }}
{{- else }}
{{- /* Cluster-scoped mode: Create a ClusterRole and ClusterRoleBinding */ -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ include "secrets-operator.fullname" . }}-manager-role
  labels:
  {{- include "secrets-operator.labels" . | nindent 4 }}
{{- include "secrets-operator.managerRules" . }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ include "secrets-operator.fullname" . }}-manager-rolebinding
  labels:
  {{- include "secrets-operator.labels" . | nindent 4 }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ include "secrets-operator.fullname" . }}-manager-role
subjects:
- kind: ServiceAccount
  name: {{ include "secrets-operator.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
{{- end }}