fix(push): reject legacy APNs chart values

Co-authored-by: npub1tquskdu6yc4h8l7xxtceculxw600grekeq0xg2ukqfrwl7vrzg3quz3gmp <58390b379a262b73ffc632f19c73e6769ef40f36c81e642b960246eff9831222@buzz.block.builderlab.xyz>
Signed-off-by: npub1tquskdu6yc4h8l7xxtceculxw600grekeq0xg2ukqfrwl7vrzg3quz3gmp <58390b379a262b73ffc632f19c73e6769ef40f36c81e642b960246eff9831222@buzz.block.builderlab.xyz>

deploy/charts/buzz-push-gateway/tests/render.sh

@@ -75,6 +75,15 @@ assert route['spec']['parentRefs']
 assert 'push.buzz.xyz' in route['spec']['hostnames']
 PY
 
+# Legacy token-auth values must fail rather than silently selecting the default
+# certificate Secret.
+if helm template push deploy/charts/buzz-push-gateway \
+  --set apnsKey.secretName=legacy-apns-secret \
+  --set apnsKey.secretKey=legacy-provider.p8 >/dev/null 2>&1; then
+  echo 'expected legacy apnsKey values to fail schema validation' >&2
+  exit 1
+fi
+
 # Enabling a route without a Gateway attachment must fail schema validation.
 if helm template push deploy/charts/buzz-push-gateway --set httpRoute.enabled=true >/dev/null 2>&1; then
   echo 'expected httpRoute.enabled=true without parentRefs to fail' >&2

deploy/charts/buzz-push-gateway/values.schema.json

@@ -23,6 +23,25 @@
       "type": "string",
       "minLength": 1
     },
+    "apnsCert": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "secretName",
+        "secretKey"
+      ],
+      "properties": {
+        "secretName": {
+          "type": "string",
+          "minLength": 1
+        },
+        "secretKey": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "apnsKey": false,
     "httpRoute": {
       "type": "object",
       "required": [
@@ -238,6 +257,7 @@
     "publicDeliveryUrl",
     "maxGrantLifetimeSeconds",
     "appAttestAppId",
+    "apnsCert",
     "httpRoute",
     "image",
     "migration"