{{/*
Chart-managed PostgreSQL credential. Skipped entirely when the user brings their own
(global.flameHub.postgresql.existingSecret)
*/}}
{{- if not .Values.global.flameHub.postgresql.existingSecret }}
{{- $existingPgSecret := lookup "v1" "Secret" .Release.Namespace (include "flameHub.postgresql.secretName" .) }}

{{/* Resolution order matters — see the comment on each step. */}}
{{- $postgresPassword := .Values.postgresql.auth.postgresPassword | default "" }}
{{/* 1. Steady state: this Secret is its own source of truth across upgrades. */}}
{{- if and (not $postgresPassword) $existingPgSecret $existingPgSecret.data (hasKey $existingPgSecret.data "password") }}
  {{- $postgresPassword = index $existingPgSecret.data "password" | b64dec }}
{{- end }}
{{/* 2. Fresh install only: no existing Secret and no override -> generate. */}}
{{- if not $postgresPassword }}{{- $postgresPassword = randAlphaNum 32 }}{{- end }}

apiVersion: v1
kind: Secret
metadata:
  name: {{ include "flameHub.postgresql.secretName" . | quote }}
  labels:
    app: {{ .Release.Name }}-flame-hub
  annotations:
    "helm.sh/resource-policy": keep
type: kubernetes.io/basic-auth
stringData:
  username: {{ .Values.postgresql.auth.username | quote }}
  password: {{ $postgresPassword | quote }}
{{- end }}