{
  "$defs": {
    "ConditionalOIDCClientsGenerateRules": {
      "additionalProperties": false,
      "description": "Conditional rules for generating an OpenID Connect client secret.",
      "properties": {
        "if": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Configuration only applies if this Helm chart setting is set to a true value",
          "title": "Condition"
        },
        "type": {
          "const": "oidc-clients",
          "description": "Type of secret",
          "title": "Secret type",
          "type": "string"
        }
      },
      "required": [
        "type"
      ],
      "title": "ConditionalOIDCClientsGenerateRules",
      "type": "object"
    },
    "ConditionalSecretConfig": {
      "additionalProperties": false,
      "description": "Possibly conditional specification for an application secret.",
      "properties": {
        "copy": {
          "anyOf": [
            {
              "$ref": "#/$defs/ConditionalSecretCopyRules"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Rules for where the secret should be copied from",
          "title": "Copy rules"
        },
        "description": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Description of the secret",
          "title": "Description"
        },
        "generate": {
          "anyOf": [
            {
              "$ref": "#/$defs/ConditionalSecretGenerateRules"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Rules for how the secret should be generated",
          "title": "Generation rules"
        },
        "if": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Configuration only applies if this Helm chart setting is set to a true value",
          "title": "Condition"
        },
        "onepassword": {
          "$ref": "#/$defs/SecretOnepasswordConfig",
          "description": "Configuration for how the secret is stored in 1Password",
          "title": "1Password configuration"
        },
        "value": {
          "anyOf": [
            {
              "format": "password",
              "type": "string",
              "writeOnly": true
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Fixed value of secret",
          "title": "Value"
        }
      },
      "title": "ConditionalSecretConfig",
      "type": "object"
    },
    "ConditionalSecretCopyRules": {
      "additionalProperties": false,
      "description": "Possibly conditional rules for copying a secret value from another.",
      "properties": {
        "application": {
          "description": "Application from which the secret should be copied",
          "title": "Application",
          "type": "string"
        },
        "if": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Configuration only applies if this Helm chart setting is set to a true value",
          "title": "Condition"
        },
        "key": {
          "description": "Secret key from which the secret should be copied",
          "title": "Key",
          "type": "string"
        }
      },
      "required": [
        "application",
        "key"
      ],
      "title": "ConditionalSecretCopyRules",
      "type": "object"
    },
    "ConditionalSecretGenerateRules": {
      "anyOf": [
        {
          "$ref": "#/$defs/ConditionalSimpleSecretGenerateRules"
        },
        {
          "$ref": "#/$defs/ConditionalSourceSecretGenerateRules"
        },
        {
          "$ref": "#/$defs/ConditionalOIDCClientsGenerateRules"
        }
      ]
    },
    "ConditionalSimpleSecretGenerateRules": {
      "additionalProperties": false,
      "description": "Conditional rules for generating a secret value with no source.",
      "properties": {
        "if": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Configuration only applies if this Helm chart setting is set to a true value",
          "title": "Condition"
        },
        "type": {
          "description": "Type of secret",
          "enum": [
            "password",
            "gafaelfawr-token",
            "fernet-key",
            "rsa-private-key"
          ],
          "title": "Secret type",
          "type": "string"
        }
      },
      "required": [
        "type"
      ],
      "title": "ConditionalSimpleSecretGenerateRules",
      "type": "object"
    },
    "ConditionalSourceSecretGenerateRules": {
      "additionalProperties": false,
      "description": "Conditional rules for generating a secret from another secret.",
      "properties": {
        "if": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Configuration only applies if this Helm chart setting is set to a true value",
          "title": "Condition"
        },
        "source": {
          "description": "Key of secret on which this secret is based. This may only be set by secrets of type ``bcrypt-password-hash`` or ``mtime``.",
          "title": "Source key",
          "type": "string"
        },
        "type": {
          "description": "Type of secret",
          "enum": [
            "bcrypt-password-hash",
            "mtime"
          ],
          "title": "Secret type",
          "type": "string"
        }
      },
      "required": [
        "type",
        "source"
      ],
      "title": "ConditionalSourceSecretGenerateRules",
      "type": "object"
    },
    "SecretOnepasswordConfig": {
      "description": "Configuration for how a static secret is stored in 1Password.",
      "properties": {
        "encoded": {
          "default": false,
          "description": "Whether the 1Password copy of the secret is encoded in base64. 1Password doesn't support newlines in secrets, so secrets that contain significant newlines have to be encoded when storing them in 1Password. This flag indicates that this has been done, and therefore when retrieving the secret from 1Password, its base64-encoding must be undone.",
          "title": "Is base64-encoded",
          "type": "boolean"
        }
      },
      "title": "SecretOnepasswordConfig",
      "type": "object"
    }
  },
  "$id": "https://phalanx.lsst.io/schemas/secrets.json",
  "additionalProperties": {
    "$ref": "#/$defs/ConditionalSecretConfig"
  },
  "title": "Phalanx application secret definitions",
  "type": "object"
}