feat(common): add the permission declaration (IDP_*) env and secret helpers

[qnen]

Pull Request Type

• Common

O que muda

Adiciona ao lerian-common os helpers da declaração de permissões do Access Manager (as quatro envs que o declaration.WireFromEnv do lib-auth lê), em charts/lerian-common/templates/_idp.tpl:

Helper	Emite	Precedência
lerian-common.idp.env	IDP_DECLARATION_ENABLED (sempre, default "false") e IDP_HOST (só se não vazio)	configmap.<KEY> > extraEnvVars.<KEY> (legado) > global.idp.{declarationEnabled,host} > default
lerian-common.idp.secret	IDP_M2M_CLIENT_ID / IDP_M2M_CLIENT_SECRET, cada um só se setado	mapa de secrets do componente; modo data (base64) ou stringData; nada com useExistingSecret
lerian-common.idp.keys	lista JSON das chaves (kind: env, secret ou todas)	para o chart pular essas chaves nos seus ranges genéricos e não emitir chave duplicada

• extraEnvVars entra como override de compatibilidade: ambientes que hoje passam o gate e o host por extraEnvVars (PRs abertos no gitops) continuam funcionando quando o chart adotar o helper.
• global.idp documentado em values.yaml e no README (seção "Permission declaration (IDP_*)"), com o aviso de que global.idp.declarationEnabled liga o gate em todos os componentes do release, e cada um precisa do seu par de credenciais.

Compatibilidade

Aditivo. Nenhum helper existente muda, e nada renderiza até um chart incluir os novos helpers. Release esperado: minor (2.4.0).

Teste local

helm v3.16.4, chart fixture consumindo o lerian-common local via file://:

• sem valores: só IDP_DECLARATION_ENABLED: "false" no ConfigMap, nada no Secret;
• global.idp.host + declarationEnabled=true + par em secrets: "true", host, e ID/SECRET em data (base64) e stringData;
• configmap.IDP_DECLARATION_ENABLED=false vence global true (false explícito respeitado); extraEnvVars.IDP_HOST vence global; configmap vence extraEnvVars;
• useExistingSecret=true: nenhuma chave no Secret; secret vazio não é emitido.
• go run ./validate-helm-charts --root ../.. --strict: 0 violações.

Próximo passo (depende deste release)

PRs draft em plugin-br-bank-transfer, reporter e fetcher adotam os helpers; eles só saem do draft depois que o lerian-common-helm 2.4.0 for publicado e a dependência (hoje pinada em 2.3.0) for trocada.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Essentials
• Run ID: c27aecc4-36c2-4403-8d82-e36e3b552163

📥 Commits

Reviewing files that changed from the base of the PR and between db44f37 and 9da9e5d.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Essentials
• Run ID: 3f1aefc2-4c95-442f-b464-ca0a37de1627

📥 Commits

Reviewing files that changed from the base of the PR and between e5abd5b and db44f37.

📒 Files selected for processing: 3

• charts/lerian-common/README.md
• charts/lerian-common/templates/_idp.tpl
• charts/lerian-common/values.yaml

Included review availability: This review used your included allowance. 3 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📝 Walkthrough

The shared Helm chart adds IDP key-selection, environment-variable, and secret helpers. It documents global IDP settings, component overrides, credential handling, and helper usage.

Changes: IDP declaration helpers

Layer / File(s)	Summary
IDP contract and helper rendering charts/lerian-common/values.yaml, charts/lerian-common/templates/_idp.tpl, charts/lerian-common/README.md	The shared values contract documents global IDP settings and component overrides. The new helpers select IDP keys, render the declaration gate and optional host, and render non-empty credentials unless an existing Secret is used. The README documents helper usage and rendering behavior.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to db44f

The IDP helpers are ready to merge after normal checks; no actionable issue was identified in the supplied change.

✨ Finishing Touches

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}