# The classic-models estate on the shared Kafka cluster.
#
# Everything here is created in the `kafka` namespace, because that is the only
# one Strimzi watches (`watchAnyNamespace=false`). A CR elsewhere is ignored in
# silence — no status, no Secret, no log line.
#
# The events these topics carry are specified by their producer, in
# classic-models-api/docs/DOMAIN_EVENTS.md. This file grants access; it does not
# define meaning.

# --- topics -----------------------------------------------------------------
#
# One per aggregate, not one per event type: per type would lose the order
# between product.created and product.stock_changed for the same product, which
# is the one ordering a consumer actually needs.
#
# Declared rather than auto-created — the accounts below have no Create ACL, so
# a producer would simply be denied, and an auto-created topic takes broker
# defaults nobody chose. Partition count is the ceiling on consumer parallelism
# and cannot be lowered later.
---
apiVersion: kafka.strimzi.io/v1
kind: KafkaTopic
metadata:
  name: classic-models.catalog
  namespace: kafka
  labels:
    strimzi.io/cluster: kafka
spec:
  partitions: 3
  replicas: 1
  config:
    retention.ms: "604800000"   # 7 days
    cleanup.policy: delete
    min.insync.replicas: "1"
---
apiVersion: kafka.strimzi.io/v1
kind: KafkaTopic
metadata:
  name: classic-models.sales
  namespace: kafka
  labels:
    strimzi.io/cluster: kafka
spec:
  partitions: 3
  replicas: 1
  config:
    retention.ms: "604800000"
    cleanup.policy: delete
    min.insync.replicas: "1"
---
apiVersion: kafka.strimzi.io/v1
kind: KafkaTopic
metadata:
  name: classic-models.payments
  namespace: kafka
  labels:
    strimzi.io/cluster: kafka
spec:
  partitions: 3
  replicas: 1
  config:
    retention.ms: "604800000"
    cleanup.policy: delete
    min.insync.replicas: "1"

# --- accounts ---------------------------------------------------------------
#
# One direction each, on one prefix. A producer that could also read every topic
# exfiltrates every other application's data if it is ever compromised, and a
# consumer that could write can raise an event someone else acts on.
---
# classic-models-api. Publishes domain events, consumes nothing.
apiVersion: kafka.strimzi.io/v1
kind: KafkaUser
metadata:
  name: classic-models-api
  namespace: kafka
  labels:
    strimzi.io/cluster: kafka
spec:
  authentication:
    type: scram-sha-512
  authorization:
    type: simple
    acls:
      - resource:
          type: topic
          name: classic-models.
          patternType: prefix
        operations:
          - Write
          - Describe
---
# The Approvisionnement agent. Reads the catalog topic only — an agent whose job
# is stock has no business reading who paid what.
apiVersion: kafka.strimzi.io/v1
kind: KafkaUser
metadata:
  name: classic-models-agent-approvisionnement
  namespace: kafka
  labels:
    strimzi.io/cluster: kafka
spec:
  authentication:
    type: scram-sha-512
  authorization:
    type: simple
    acls:
      - resource:
          type: topic
          name: classic-models.catalog
          patternType: literal
        operations:
          - Read
          - Describe
      - resource:
          type: group
          name: approvisionnement-
          patternType: prefix
        operations:
          - Read
          - Describe