compositiondefinitions

var (
	CDCtemplateDeploymentPath       = filepath.Join(os.TempDir(), "assets/cdc-deployment/deployment.yaml")
	CDCtemplateConfigmapPath        = filepath.Join(os.TempDir(), "assets/cdc-configmap/configmap.yaml")
	CDCrbacConfigFolder             = filepath.Join(os.TempDir(), "assets/cdc-rbac/")
	JSONSchemaTemplateConfigmapPath = filepath.Join(os.TempDir(), "assets/json-schema-configmap/configmap.yaml")
	ServiceTemplatePath             = filepath.Join(os.TempDir(), "assets/cdc-service/service.yaml")

	// AuthnNamespace is the authn operator namespace where the per-composition ServiceAccount
	// allowlist mapping is created (when a CompositionDefinition declares an apiRef). Override
	// via COMPOSITION_AUTHN_NAMESPACE; defaults to "krateo-system".
	AuthnNamespace = envOr("COMPOSITION_AUTHN_NAMESPACE", "krateo-system")

	// SnowplowURL is snowplow's base URL. When a CompositionDefinition declares an apiRef,
	// core-provider calls snowplow's dispatch-free GET /rbac to enumerate the RESTAction's
	// read-set and grant it to the per-composition group. Override via CORE_PROVIDER_SNOWPLOW_URL;
	// required when apiRef is used (an empty value fails the reconcile with a clear message).
	SnowplowURL = envOr("CORE_PROVIDER_SNOWPLOW_URL", "")

	// AuthnURL is the authn service base URL. snowplow's /rbac is gated by the same JWT middleware
	// as /call, so core-provider exchanges its projected SA token for an authn-issued service JWT
	// to authenticate. Override via CORE_PROVIDER_AUTHN_URL.
	AuthnURL = envOr("CORE_PROVIDER_AUTHN_URL", "")

	// SelfSAName / SelfSANamespace / SelfGroup identify core-provider's OWN ServiceAccount for its
	// apiRefRBAC authn allowlist mapping. It is provisioned at runtime (the first time a
	// composition declares an apiRef) rather than declaratively at bootstrap, where the authn CRD
	// does not yet exist. The chart sets these when apiRefRBAC is enabled; empty SelfSAName
	// disables self-provisioning.
	SelfSAName      = envOr("CORE_PROVIDER_APIREF_SELF_SA_NAME", "")
	SelfSANamespace = envOr("CORE_PROVIDER_APIREF_SELF_SA_NAMESPACE", "")
	SelfGroup       = envOr("CORE_PROVIDER_APIREF_GROUP", "krateo:core-provider")
)