apiVersion: v1
kind: ConfigMap
metadata:
  name: api-gateway-local-premium-contract
data:
  premium-openapi-paths: |
    /v1beta2/tidbs -> tidb-mgmt-portal:8080
    /v1beta2/tidbs:restore -> tidb-mgmt-portal:8080
    /api/v1beta2 -> dataflow-ng-http:11000
    /dedicated/v1beta1 -> tidb-mgmt-portal:8080
    /v1beta1/clusters -> tidb-mgmt-portal-serverless:8080 with Service konghq.com/path /serverless
    /v1beta1/regions -> tidb-mgmt-portal-serverless:8080 with Service konghq.com/path /serverless
    /v1beta1/shadowPools -> tidb-mgmt-portal-serverless:8080 with Service konghq.com/path /serverless
    /v1beta1/clusters/{clusterId}/branches -> serverless-svc-http:8080
    /v1beta1/clusters/{clusterId}/branches/{branchId}/sqlUsers/{username} -> serverless-svc-http:8080
    /v1beta1/clusters/{clusterId}/changefeeds -> serverless-svc-http:8080
    /v1beta1/clusters/{clusterId}/privateLinkConnections -> serverless-svc-http:8080
    /v1beta1/clusters/{clusterId}/privateLinkConnections/{privateLinkConnectionId} -> serverless-svc-http:8080
    /v1beta1/clusters/{clusterId}/privateLinkConnections:getAvailabilityZones -> serverless-svc-http:8080
    /v1beta1/clusters/{clusterId}/privateLinkConnections/{privateLinkConnectionId}:{action} -> serverless-svc-http:8080
  premium-console-paths: |
    /api/v1 -> account-central-http:11000 (central serves full path, own credentialed CORS)
    /api_proxy/billing -> account-central-http:11000 (central proxies billing/unc)
    /api/v2025/cloud -> tidb-mgmt-portal:8080 (full path; staging portal-ui Services alias the same pods)
    /api/v2023/clusterManagement -> tidb-mgmt-portal:8080 (full path)
    /~/api/v1beta2/tidbs/[0-9]+/ -> dataflow-ng-http:11000 (console dataflow resources; more specific than the digest OpenAPI /api/v1beta2 prefix)
    Console routes are bearer passthrough (no digest-auth): handlers authenticate
    via the account service (GetUserByToken). console-plugin-cookie-auth owns
    credentialed CORS for the same allowlisted origins as staging.
  kong-plugins: |
    Local Premium wires the staging-compatible OpenAPI plugin shape required
    for real digest requests through Kong. The Session Tiltfile materializes
    the plugin code as Kong ConfigMaps before installing Kong, then applies
    the KongClusterPlugin objects after Kong CRDs are established.
    openapi-plugin-force-https
    openapi-plugin-digest-auth
    openapi-plugin-rate-limit
  staging-shape: |
    public entrypoint -> Kong -> api-gateway-local route/plugin contract -> Premium backend
    Dedicated OpenAPI train group uses /dedicated/v1beta1 inside the Dev full runtime.