# The standing authority the autonomous runs act under.
#
# A mandate is an `offline_access` refresh token, issued by the
# classic-models-mandate client for the user who authorised the agent. It does
# not expire, which is exactly why it is here and not in a workflow: it is
# revoked by that user's session being revoked in Keycloak, and by nothing else.
#
# Two ExternalSecrets rather than one, because they answer to different owners:
# the mandate is the agent estate's, the client secret that redeems it is the
# realm's.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: n8n-mandate-secrets
  namespace: n8n
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault-n8n
  target:
    name: n8n-mandate-secrets
  dataFrom:
    - extract:
        key: n8n/mandates