@flightctl/ui-components 1.0.2 → 1.1.0-rc2

package/src/components/Repository/CreateRepository/utils.ts

@@ -1,19 +1,22 @@
 import * as Yup from 'yup';
 import { TFunction } from 'i18next';
 import {
+  DockerAuth,
+  GitRepoSpec,
   HttpConfig,
   HttpRepoSpec,
+  OciAuthType,
+  OciRepoSpec,
   PatchRequest,
   RepoSpecType,
   Repository,
   RepositorySpec,
   ResourceSync,
   SshConfig,
-  SshRepoSpec,
 } from '@flightctl/types';
 
 import { RepositoryFormValues, ResourceSyncFormValue } from './types';
-import { API_VERSION } from '../../../constants';
+import { CORE_API_VERSION } from '../../../constants';
 import { getErrorMessage } from '../../../utils/error';
 import { appendJSONPatch } from '../../../utils/patch';
 import { MAX_TARGET_REVISION_LENGTH, maxLengthString, validKubernetesDnsSubdomain } from '../../form/validations';
@@ -27,300 +30,349 @@ const pathRegex = /\/.+/;
 const jwtTokenRegexp = /^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+$/;
 
 export const isHttpRepoSpec = (repoSpec: RepositorySpec): repoSpec is HttpRepoSpec =>
-  !!(repoSpec['httpConfig'] || (repoSpec as HttpRepoSpec).validationSuffix);
-export const isSshRepoSpec = (repoSpec: RepositorySpec): repoSpec is SshRepoSpec => !!repoSpec['sshConfig'];
-
-export const getInitValues = ({
-  repository,
-  resourceSyncs,
-  options,
-}: {
-  repository?: Repository;
-  resourceSyncs?: ResourceSync[];
-  options?: {
-    canUseResourceSyncs?: boolean;
-    allowedRepoTypes?: RepoSpecType[];
-    showRepoTypes?: boolean;
-  };
-}): RepositoryFormValues => {
-  const useRSs = options?.canUseResourceSyncs ?? true;
-
-  if (!repository) {
-    const selectedRepoType = options?.allowedRepoTypes?.length === 1 ? options.allowedRepoTypes[0] : RepoSpecType.GIT;
-
-    return {
-      exists: false,
-      repoType: selectedRepoType,
-      allowedRepoTypes: options?.allowedRepoTypes,
-      showRepoTypes: options?.showRepoTypes ?? true,
-      name: '',
-      url: '',
-      useAdvancedConfig: false,
-      configType: 'http',
+  repoSpec.type === RepoSpecType.RepoSpecTypeHttp;
+export const isGitRepoSpec = (repoSpec: RepositorySpec): repoSpec is GitRepoSpec =>
+  repoSpec.type === RepoSpecType.RepoSpecTypeGit;
+export const isOciRepoSpec = (repoSpec: RepositorySpec): repoSpec is OciRepoSpec =>
+  repoSpec.type === RepoSpecType.RepoSpecTypeOci;
+
+export const hasCredentialsSettings = (repoSpec: RepositorySpec): boolean => {
+  // The credentials settings can be in different fields depending on the repository type
+  if ('sshConfig' in repoSpec) {
+    return Boolean(repoSpec.sshConfig?.sshPrivateKey);
+  } else if ('httpConfig' in repoSpec) {
+    return Boolean(
+      repoSpec.httpConfig?.password || repoSpec.httpConfig?.['tls.crt'] || repoSpec.httpConfig?.['tls.key'],
+    );
+  } else if ('ociAuth' in repoSpec) {
+    return Boolean(repoSpec.ociAuth);
+  }
+  return false;
+};
 
-      canUseResourceSyncs: useRSs,
-      useResourceSyncs: useRSs,
-      resourceSyncs: [
-        {
-          name: '',
-          path: '',
-          targetRevision: '',
-        },
-      ],
+const addHttpConfigPatches = (
+  patches: PatchRequest,
+  values: RepositoryFormValues,
+  httpConfig: HttpConfig | undefined,
+) => {
+  // If httpConfig doesn't exist, create it as a whole object
+  if (!httpConfig) {
+    const value: HttpConfig = {
+      skipServerVerification: values.httpConfig?.skipServerVerification,
     };
-  }
 
-  const formValues: RepositoryFormValues = {
-    exists: true,
-    name: repository.metadata.name || '',
-    url: repository.spec.url || '',
-    repoType: repository.spec.type,
-    validationSuffix: 'validationSuffix' in repository.spec ? repository.spec.validationSuffix : '',
-    allowedRepoTypes: options?.allowedRepoTypes,
-    showRepoTypes: options?.showRepoTypes ?? true,
-    useResourceSyncs: !!resourceSyncs?.length,
-    useAdvancedConfig: false,
-    configType: 'http',
-    canUseResourceSyncs: useRSs,
-    resourceSyncs: resourceSyncs?.length
-      ? resourceSyncs
-          .filter((rs) => rs.spec.repository === repository.metadata.name)
-          .map((rs) => ({
-            name: rs.metadata.name || '',
-            path: rs.spec.path || '',
-            targetRevision: rs.spec.targetRevision || '',
-            exists: true,
-          }))
-      : [{ name: '', path: '', targetRevision: '' }],
-  };
+    if (values.httpConfig?.caCrt && !value.skipServerVerification) {
+      value['ca.crt'] = btoa(values.httpConfig.caCrt);
+    }
 
-  if (isHttpRepoSpec(repository.spec)) {
-    formValues.useAdvancedConfig = true;
-    formValues.configType = 'http';
-    formValues.httpConfig = {
-      caCrt: repository.spec.httpConfig['ca.crt'] ? atob(repository.spec.httpConfig['ca.crt']) : undefined,
-      basicAuth: {
-        username: repository.spec.httpConfig.username,
-        password: repository.spec.httpConfig.password,
-        use: !!repository.spec.httpConfig.username || !!repository.spec.httpConfig.password,
-      },
-      mTlsAuth: {
-        tlsCrt: repository.spec.httpConfig['tls.crt'],
-        tlsKey: repository.spec.httpConfig['tls.key'],
-        use: !!repository.spec.httpConfig['tls.crt'] || !!repository.spec.httpConfig['tls.key'],
-      },
-      skipServerVerification: repository.spec.httpConfig.skipServerVerification,
-      token: repository.spec.httpConfig.token,
-    };
-  } else if (isSshRepoSpec(repository.spec)) {
-    formValues.useAdvancedConfig = true;
-    formValues.configType = 'ssh';
-    formValues.sshConfig = {
-      privateKeyPassphrase: repository.spec.sshConfig.privateKeyPassphrase,
-      skipServerVerification: repository.spec.sshConfig.skipServerVerification,
-      sshPrivateKey: repository.spec.sshConfig.sshPrivateKey,
-    };
+    if (values.httpConfig?.basicAuth?.use) {
+      value.password = values.httpConfig.basicAuth.password;
+      value.username = values.httpConfig.basicAuth.username;
+    }
+    if (values.httpConfig?.mTlsAuth?.use) {
+      if (values.httpConfig.mTlsAuth.tlsCrt) {
+        value['tls.crt'] = btoa(values.httpConfig.mTlsAuth.tlsCrt);
+      }
+      if (values.httpConfig.mTlsAuth.tlsKey) {
+        value['tls.key'] = btoa(values.httpConfig.mTlsAuth.tlsKey);
+      }
+    }
+    if (values.httpConfig?.token) {
+      value.token = values.httpConfig.token;
+    }
+    patches.push({
+      op: 'add',
+      path: '/spec/httpConfig',
+      value,
+    });
+    return;
   }
 
-  return formValues;
-};
-
-export const getRepositoryPatches = (values: RepositoryFormValues, repository: Repository): PatchRequest => {
-  const patches: PatchRequest = [];
-  appendJSONPatch({
-    patches,
-    newValue: values.repoType,
-    originalValue: repository.spec.type,
-    path: '/spec/type',
-  });
+  // httpConfig exists, patch individual properties
   appendJSONPatch({
     patches,
-    newValue: values.url,
-    originalValue: repository.spec.url,
-    path: '/spec/url',
+    newValue: values.httpConfig?.skipServerVerification,
+    originalValue: httpConfig?.skipServerVerification,
+    path: '/spec/httpConfig/skipServerVerification',
   });
+  if (values.httpConfig?.skipServerVerification) {
+    if (httpConfig?.['ca.crt']) {
+      patches.push({
+        op: 'remove',
+        path: '/spec/httpConfig/ca.crt',
+      });
+    }
+  } else {
+    const caCrt = values.httpConfig?.caCrt;
+    appendJSONPatch({
+      patches,
+      newValue: caCrt ? btoa(caCrt) : caCrt,
+      originalValue: httpConfig?.['ca.crt'],
+      path: '/spec/httpConfig/ca.crt',
+    });
+  }
 
-  if (!values.useAdvancedConfig) {
-    if (isHttpRepoSpec(repository.spec)) {
+  if (!values.httpConfig?.basicAuth?.use) {
+    if (httpConfig?.password) {
       patches.push({
         op: 'remove',
-        path: '/spec/httpConfig',
+        path: '/spec/httpConfig/password',
       });
+    }
+    if (httpConfig?.username) {
       patches.push({
         op: 'remove',
-        path: '/spec/validationSuffix',
+        path: '/spec/httpConfig/username',
       });
     }
-    if (isSshRepoSpec(repository.spec)) {
+  } else {
+    appendJSONPatch({
+      patches,
+      newValue: values.httpConfig?.basicAuth.password,
+      originalValue: httpConfig?.password,
+      path: '/spec/httpConfig/password',
+    });
+    appendJSONPatch({
+      patches,
+      newValue: values.httpConfig?.basicAuth.username,
+      originalValue: httpConfig?.username,
+      path: '/spec/httpConfig/username',
+    });
+  }
+
+  if (!values.httpConfig?.mTlsAuth?.use) {
+    if (httpConfig?.['tls.crt']) {
       patches.push({
         op: 'remove',
-        path: '/spec/sshConfig',
+        path: '/spec/httpConfig/tls.crt',
       });
     }
-    return patches;
+    if (httpConfig?.['tls.key']) {
+      patches.push({
+        op: 'remove',
+        path: '/spec/httpConfig/tls.key',
+      });
+    }
+  } else {
+    appendJSONPatch({
+      patches,
+      newValue: values.httpConfig?.mTlsAuth.tlsCrt,
+      originalValue: httpConfig?.['tls.crt'],
+      path: '/spec/httpConfig/tls.crt',
+      encodeB64: true,
+    });
+    appendJSONPatch({
+      patches,
+      newValue: values.httpConfig?.mTlsAuth.tlsKey,
+      originalValue: httpConfig?.['tls.key'],
+      path: '/spec/httpConfig/tls.key',
+      encodeB64: true,
+    });
   }
 
-  if (values.configType === 'http') {
-    if (isSshRepoSpec(repository.spec)) {
+  if (!values.httpConfig?.token) {
+    if (httpConfig?.token) {
       patches.push({
         op: 'remove',
-        path: '/spec/sshConfig',
+        path: '/spec/httpConfig/token',
       });
     }
-    if (!isHttpRepoSpec(repository.spec)) {
-      const value: HttpConfig = {
-        skipServerVerification: values.httpConfig?.skipServerVerification,
-      };
+  } else {
+    appendJSONPatch({
+      patches,
+      newValue: values.httpConfig?.token,
+      originalValue: httpConfig?.token,
+      path: '/spec/httpConfig/token',
+    });
+  }
+};
 
-      if (values.httpConfig?.caCrt && !value.skipServerVerification) {
-        value['ca.crt'] = btoa(values.httpConfig.caCrt);
-      }
+const getHttpRepositoryPatches = (values: RepositoryFormValues, repoSpec: HttpRepoSpec): PatchRequest => {
+  const patches: PatchRequest = [];
 
-      if (values.httpConfig?.basicAuth?.use) {
-        value.password = values.httpConfig.basicAuth.password;
-        value.username = values.httpConfig.basicAuth.username;
-      }
-      if (values.httpConfig?.mTlsAuth?.use) {
-        if (values.httpConfig.mTlsAuth.tlsCrt) {
-          value['tls.crt'] = btoa(values.httpConfig.mTlsAuth.tlsCrt);
-        }
-        if (values.httpConfig.mTlsAuth.tlsKey) {
-          value['tls.key'] = btoa(values.httpConfig.mTlsAuth.tlsKey);
-        }
-      }
-      if (values.httpConfig?.token) {
-        value.token = values.httpConfig.token;
-      }
+  appendJSONPatch({
+    patches,
+    newValue: values.url,
+    originalValue: repoSpec.url,
+    path: '/spec/url',
+  });
+
+  if (!values.useAdvancedConfig) {
+    if (repoSpec.validationSuffix) {
       patches.push({
-        op: 'add',
-        path: '/spec/httpConfig',
-        value,
-      });
-      appendJSONPatch({
-        patches,
-        newValue: values.validationSuffix,
-        originalValue: undefined,
-        path: '/spec/validationSuffix',
-      });
-    } else {
-      appendJSONPatch({
-        patches,
-        newValue: values.repoType === RepoSpecType.HTTP ? values.validationSuffix : undefined,
-        originalValue: repository.spec.validationSuffix,
+        op: 'remove',
         path: '/spec/validationSuffix',
       });
+    }
+    patches.push({
+      op: 'remove',
+      path: '/spec/httpConfig',
+    });
+    return patches;
+  }
 
-      appendJSONPatch({
-        patches,
-        newValue: values.httpConfig?.skipServerVerification,
-        originalValue: repository.spec.httpConfig.skipServerVerification,
-        path: '/spec/httpConfig/skipServerVerification',
+  // The rest of the fields are part of advanced settings
+  appendJSONPatch({
+    patches,
+    newValue: values.validationSuffix,
+    originalValue: repoSpec.validationSuffix,
+    path: '/spec/validationSuffix',
+  });
+
+  addHttpConfigPatches(patches, values, repoSpec.httpConfig);
+
+  return patches;
+};
+
+const getOciRepositoryPatches = (values: RepositoryFormValues, repoSpec: OciRepoSpec): PatchRequest => {
+  const formOciConfig = values.ociConfig;
+  if (!formOciConfig) {
+    return [];
+  }
+
+  const patches: PatchRequest = [];
+  appendJSONPatch({
+    patches,
+    newValue: formOciConfig.registry,
+    originalValue: repoSpec.registry,
+    path: '/spec/registry',
+  });
+  appendJSONPatch({
+    patches,
+    newValue: formOciConfig.scheme || OciRepoSpec.scheme.HTTPS,
+    originalValue: repoSpec.scheme,
+    path: '/spec/scheme',
+  });
+
+  appendJSONPatch({
+    patches,
+    newValue: formOciConfig.accessMode || OciRepoSpec.accessMode.READ,
+    originalValue: repoSpec.accessMode,
+    path: '/spec/accessMode',
+  });
+
+  if (!values.useAdvancedConfig) {
+    if (repoSpec.ociAuth) {
+      patches.push({ op: 'remove', path: '/spec/ociAuth' });
+    }
+    if (repoSpec['ca.crt']) {
+      patches.push({ op: 'remove', path: '/spec/ca.crt' });
+    }
+    if (repoSpec.skipServerVerification !== undefined) {
+      patches.push({ op: 'remove', path: '/spec/skipServerVerification' });
+    }
+    return patches;
+  }
+
+  appendJSONPatch({
+    patches,
+    newValue: formOciConfig.skipServerVerification,
+    originalValue: repoSpec.skipServerVerification,
+    path: '/spec/skipServerVerification',
+  });
+
+  if (formOciConfig.skipServerVerification && repoSpec['ca.crt']) {
+    patches.push({ op: 'remove', path: '/spec/ca.crt' });
+  } else {
+    const caCrt = formOciConfig.caCrt;
+    appendJSONPatch({
+      patches,
+      newValue: caCrt ? btoa(caCrt) : caCrt,
+      originalValue: repoSpec['ca.crt'],
+      path: '/spec/ca.crt',
+    });
+  }
+
+  const ociAuth = formOciConfig.ociAuth;
+  if (ociAuth?.use && ociAuth.username && ociAuth.password) {
+    if (!repoSpec.ociAuth) {
+      const ociAuthValue: DockerAuth = {
+        authType: OciAuthType.DOCKER,
+        username: ociAuth.username,
+        password: ociAuth.password,
+      };
+      patches.push({
+        op: 'add',
+        path: '/spec/ociAuth',
+        value: ociAuthValue,
       });
-      if (values.httpConfig?.skipServerVerification) {
-        if (repository.spec.httpConfig['ca.crt']) {
-          patches.push({
-            op: 'remove',
-            path: '/spec/httpConfig/ca.crt',
-          });
-        }
-      } else {
-        const caCrt = values.httpConfig?.caCrt;
+    } else {
+      if (ociAuth.username !== repoSpec.ociAuth.username) {
         appendJSONPatch({
           patches,
-          newValue: caCrt ? btoa(caCrt) : caCrt,
-          originalValue: repository.spec.httpConfig['ca.crt'],
-          path: '/spec/httpConfig/ca.crt',
+          newValue: ociAuth.username,
+          originalValue: repoSpec.ociAuth.username,
+          path: '/spec/ociAuth/username',
         });
       }
 
-      if (!values.httpConfig?.basicAuth?.use) {
-        if (repository.spec.httpConfig.password) {
-          patches.push({
-            op: 'remove',
-            path: '/spec/httpConfig/password',
-          });
-        }
-        if (repository.spec.httpConfig.username) {
-          patches.push({
-            op: 'remove',
-            path: '/spec/httpConfig/username',
-          });
-        }
-      } else {
+      if (ociAuth.password !== repoSpec.ociAuth.password) {
         appendJSONPatch({
           patches,
-          newValue: values.httpConfig?.basicAuth.password,
-          originalValue: repository.spec.httpConfig.password,
-          path: '/spec/httpConfig/password',
-        });
-        appendJSONPatch({
-          patches,
-          newValue: values.httpConfig?.basicAuth.username,
-          originalValue: repository.spec.httpConfig.username,
-          path: '/spec/httpConfig/username',
+          newValue: ociAuth.password,
+          originalValue: repoSpec.ociAuth.password,
+          path: '/spec/ociAuth/password',
         });
       }
+    }
+  } else if (repoSpec.ociAuth) {
+    patches.push({ op: 'remove', path: '/spec/ociAuth' });
+  }
+  return patches;
+};
 
-      if (!values.httpConfig?.mTlsAuth?.use) {
-        if (repository.spec.httpConfig['tls.crt']) {
-          patches.push({
-            op: 'remove',
-            path: '/spec/httpConfig/tls.crt',
-          });
-        }
-        if (repository.spec.httpConfig['tls.key']) {
-          patches.push({
-            op: 'remove',
-            path: '/spec/httpConfig/tls.key',
-          });
-        }
-      } else {
-        appendJSONPatch({
-          patches,
-          newValue: values.httpConfig?.mTlsAuth.tlsCrt,
-          originalValue: repository.spec.httpConfig['tls.crt'],
-          path: '/spec/httpConfig/tls.crt',
-          encodeB64: true,
-        });
-        appendJSONPatch({
-          patches,
-          newValue: values.httpConfig?.mTlsAuth.tlsKey,
-          originalValue: repository.spec.httpConfig['tls.key'],
-          path: '/spec/httpConfig/tls.key',
-          encodeB64: true,
-        });
-      }
+const getGitRepositoryPatches = (values: RepositoryFormValues, gitRepoSpec: GitRepoSpec): PatchRequest => {
+  const patches: PatchRequest = [];
 
-      if (!values.httpConfig?.token) {
-        if (repository.spec.httpConfig.token) {
-          patches.push({
-            op: 'remove',
-            path: '/spec/httpConfig/token',
-          });
-        }
-      } else {
-        appendJSONPatch({
-          patches,
-          newValue: values.httpConfig?.token,
-          originalValue: repository.spec.httpConfig.token,
-          path: '/spec/httpConfig/token',
-        });
-      }
+  appendJSONPatch({
+    patches,
+    newValue: values.url,
+    originalValue: gitRepoSpec.url,
+    path: '/spec/url',
+  });
+
+  if (!values.useAdvancedConfig) {
+    if (gitRepoSpec.httpConfig) {
+      patches.push({
+        op: 'remove',
+        path: '/spec/httpConfig',
+      });
+    }
+    if (gitRepoSpec.sshConfig) {
+      patches.push({
+        op: 'remove',
+        path: '/spec/sshConfig',
+      });
     }
-  } else if (values.configType === 'ssh') {
-    if (isHttpRepoSpec(repository.spec)) {
+    return patches;
+  }
+
+  // Determine which config is being used based on form values (configType)
+  const usingHttpConfig = values.configType === 'http';
+  const usingSshConfig = values.configType === 'ssh';
+
+  if (usingHttpConfig) {
+    // Switching from SSH to HTTP or editing HTTP config
+    if (gitRepoSpec.sshConfig) {
+      patches.push({
+        op: 'remove',
+        path: '/spec/sshConfig',
+      });
+    }
+
+    addHttpConfigPatches(patches, values, gitRepoSpec.httpConfig);
+  } else if (usingSshConfig) {
+    // Switching from HTTP to SSH or editing SSH config
+    if (gitRepoSpec.httpConfig) {
       patches.push({
         op: 'remove',
         path: '/spec/httpConfig',
       });
-      if (repository.spec.validationSuffix) {
-        patches.push({
-          op: 'remove',
-          path: '/spec/validationSuffix',
-        });
-      }
     }
-    if (!isSshRepoSpec(repository.spec)) {
+
+    const sshConfig = gitRepoSpec.sshConfig;
+    // If sshConfig doesn't exist, create it as a whole object
+    if (!sshConfig) {
       const value: SshConfig = {
         privateKeyPassphrase: values.sshConfig?.privateKeyPassphrase,
         skipServerVerification: values.sshConfig?.skipServerVerification,
@@ -335,33 +387,231 @@ export const getRepositoryPatches = (values: RepositoryFormValues, repository: R
         value,
       });
     } else {
+      // sshConfig exists, patch individual properties
       appendJSONPatch({
         patches,
         newValue: values.sshConfig?.privateKeyPassphrase,
-        originalValue: repository.spec.sshConfig.privateKeyPassphrase,
+        originalValue: sshConfig?.privateKeyPassphrase,
         path: '/spec/sshConfig/privateKeyPassphrase',
       });
 
       appendJSONPatch({
         patches,
         newValue: values.sshConfig?.skipServerVerification,
-        originalValue: repository.spec.sshConfig.skipServerVerification,
+        originalValue: sshConfig?.skipServerVerification,
         path: '/spec/sshConfig/skipServerVerification',
       });
 
       appendJSONPatch({
         patches,
         newValue: values.sshConfig?.sshPrivateKey,
-        originalValue: repository.spec.sshConfig.sshPrivateKey,
+        originalValue: sshConfig?.sshPrivateKey,
         path: '/spec/sshConfig/sshPrivateKey',
         encodeB64: true,
       });
     }
   }
-
   return patches;
 };
 
+/**
+ * Converts HttpConfig from the repository spec to form values format
+ */
+export const httpConfigToFormValues = (httpConfig?: HttpConfig): RepositoryFormValues['httpConfig'] => {
+  if (!httpConfig) {
+    return undefined;
+  }
+
+  return {
+    caCrt: httpConfig['ca.crt'] ? atob(httpConfig['ca.crt']) : undefined,
+    basicAuth: {
+      username: httpConfig.username,
+      password: httpConfig.password,
+      use: !!httpConfig.username || !!httpConfig.password,
+    },
+    mTlsAuth: {
+      tlsCrt: httpConfig['tls.crt'],
+      tlsKey: httpConfig['tls.key'],
+      use: !!httpConfig['tls.crt'] || !!httpConfig['tls.key'],
+    },
+    skipServerVerification: httpConfig.skipServerVerification,
+    token: httpConfig.token,
+  };
+};
+
+export const getRepoUrlOrRegistry = (repoSpec: RepositorySpec): string => {
+  if (repoSpec.type === RepoSpecType.RepoSpecTypeOci) {
+    return repoSpec.registry || '';
+  }
+  return repoSpec.url || '';
+};
+
+export const getRepoTypeLabel = (t: TFunction, repoType: RepositorySpec['type']): string => {
+  switch (repoType) {
+    case RepoSpecType.RepoSpecTypeHttp:
+      return t('HTTP service');
+    case RepoSpecType.RepoSpecTypeOci:
+      return t('OCI registry');
+    default:
+      return t('Git repository');
+  }
+};
+
+export const getInitValues = ({
+  repository,
+  resourceSyncs,
+  options,
+}: {
+  repository?: Repository;
+  resourceSyncs?: ResourceSync[];
+  options?: {
+    canUseResourceSyncs?: boolean;
+    allowedRepoTypes?: RepoSpecType[];
+    showRepoTypes?: boolean;
+  };
+}): RepositoryFormValues => {
+  const configAllowsResourceSyncs = options?.canUseResourceSyncs ?? true;
+
+  if (!repository) {
+    const selectedRepoType =
+      options?.allowedRepoTypes?.length === 1 ? options.allowedRepoTypes[0] : RepoSpecType.RepoSpecTypeGit;
+    const canUseRSs = selectedRepoType === RepoSpecType.RepoSpecTypeGit && configAllowsResourceSyncs;
+
+    const initValues: RepositoryFormValues = {
+      exists: false,
+      repoType: selectedRepoType,
+      allowedRepoTypes: options?.allowedRepoTypes,
+      showRepoTypes: options?.showRepoTypes ?? true,
+      name: '',
+      url: '',
+      useAdvancedConfig: false,
+      configType: 'http',
+      canUseResourceSyncs: canUseRSs,
+      useResourceSyncs: canUseRSs,
+      resourceSyncs: [
+        {
+          name: '',
+          path: '',
+          targetRevision: '',
+        },
+      ],
+    };
+
+    if (selectedRepoType === RepoSpecType.RepoSpecTypeOci) {
+      initValues.ociConfig = {
+        registry: '',
+        scheme: OciRepoSpec.scheme.HTTPS,
+        accessMode: OciRepoSpec.accessMode.READ,
+      };
+    }
+
+    return initValues;
+  }
+
+  const canUseRSs = repository.spec.type === RepoSpecType.RepoSpecTypeGit && configAllowsResourceSyncs;
+
+  const formValues: RepositoryFormValues = {
+    exists: true,
+    name: repository.metadata.name || '',
+    url: repository.spec.type === RepoSpecType.RepoSpecTypeOci ? '' : repository.spec.url || '',
+    repoType: repository.spec.type as RepoSpecType,
+    validationSuffix: 'validationSuffix' in repository.spec ? repository.spec.validationSuffix : '',
+    allowedRepoTypes: options?.allowedRepoTypes,
+    showRepoTypes: options?.showRepoTypes ?? true,
+    useAdvancedConfig: false,
+    configType: 'http',
+    canUseResourceSyncs: canUseRSs,
+    useResourceSyncs: canUseRSs && !!resourceSyncs?.length,
+    resourceSyncs: resourceSyncs?.length
+      ? resourceSyncs
+          .filter((rs) => rs.spec.repository === repository.metadata.name)
+          .map((rs) => ({
+            name: rs.metadata.name || '',
+            path: rs.spec.path || '',
+            targetRevision: rs.spec.targetRevision || '',
+            exists: true,
+          }))
+      : [{ name: '', path: '', targetRevision: '' }],
+  };
+
+  if (repository.spec.type === RepoSpecType.RepoSpecTypeOci) {
+    formValues.useAdvancedConfig = !!(
+      repository.spec.ociAuth ||
+      repository.spec['ca.crt'] ||
+      repository.spec.skipServerVerification
+    );
+    formValues.ociConfig = {
+      registry: repository.spec.registry,
+      scheme: repository.spec.scheme || OciRepoSpec.scheme.HTTPS,
+      accessMode: repository.spec.accessMode || OciRepoSpec.accessMode.READ,
+      ociAuth: repository.spec.ociAuth
+        ? {
+            use: true,
+            username: repository.spec.ociAuth.username,
+            password: repository.spec.ociAuth.password,
+          }
+        : undefined,
+      caCrt: repository.spec['ca.crt'] ? atob(repository.spec['ca.crt']) : undefined,
+      skipServerVerification: repository.spec.skipServerVerification,
+    };
+  } else if (repository.spec.type === RepoSpecType.RepoSpecTypeHttp) {
+    formValues.configType = 'http';
+    formValues.validationSuffix = repository.spec.validationSuffix;
+
+    const valuesHttpConfig = httpConfigToFormValues(repository.spec.httpConfig);
+    if (valuesHttpConfig) {
+      formValues.httpConfig = valuesHttpConfig;
+    }
+    formValues.useAdvancedConfig = !!formValues.httpConfig || !!formValues.validationSuffix;
+  } else if (repository.spec.type === RepoSpecType.RepoSpecTypeGit) {
+    const gitRepoSpec = repository.spec;
+    if (gitRepoSpec.httpConfig) {
+      formValues.configType = 'http';
+      formValues.useAdvancedConfig = true;
+      formValues.httpConfig = httpConfigToFormValues(gitRepoSpec.httpConfig);
+    } else if (gitRepoSpec.sshConfig) {
+      formValues.configType = 'ssh';
+      formValues.useAdvancedConfig = true;
+      formValues.sshConfig = {
+        privateKeyPassphrase: gitRepoSpec.sshConfig.privateKeyPassphrase,
+        skipServerVerification: gitRepoSpec.sshConfig.skipServerVerification,
+        sshPrivateKey: gitRepoSpec.sshConfig.sshPrivateKey,
+      };
+    }
+  }
+
+  return formValues;
+};
+
+export const getRepositoryPatches = (values: RepositoryFormValues, repository: Repository): PatchRequest => {
+  // If repoType changes, replace the entire spec
+  if (values.repoType !== repository.spec.type) {
+    const newRepository = getRepository(values);
+    return [
+      {
+        op: 'replace',
+        path: '/spec',
+        value: newRepository.spec,
+      },
+    ];
+  }
+
+  // Otherwise, we have the same type of repository, and we must patch only the fields that changed
+  if (values.repoType === RepoSpecType.RepoSpecTypeOci) {
+    return getOciRepositoryPatches(values, repository.spec as OciRepoSpec);
+  }
+
+  if (values.repoType === RepoSpecType.RepoSpecTypeHttp) {
+    return getHttpRepositoryPatches(values, repository.spec as HttpRepoSpec);
+  }
+
+  if (values.repoType === RepoSpecType.RepoSpecTypeGit) {
+    return getGitRepositoryPatches(values, repository.spec as GitRepoSpec);
+  }
+
+  return [];
+};
+
 export const getResourceSyncEditPatch = (rs: ResourceSyncFormValue) => {
   // The patch is always an edition because adding / deleting RS can only be done via POST / DELETE api calls.
   return [
@@ -429,26 +679,14 @@ export const singleResourceSyncSchema = (t: TFunction, existingRSs: ResourceSync
   });
 };
 
+// Regex for registry hostname: FQDN, IP address (IPv4 or IPv6), with optional port, matching as much as possible of the backend pattern
+const registryHostnameRegex =
+  /^(([a-z0-9]([-a-z0-9]*[a-z0-9])?\.)*[a-z]([-a-z0-9]*[a-z0-9])?|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|\[[a-fA-F0-9:]+\])(:[0-9]{1,5})?$/;
+
 export const repositorySchema =
   (t: TFunction, repository: Repository | undefined) => (values: RepositoryFormValues) => {
-    return Yup.object({
+    const baseSchema = {
       name: validKubernetesDnsSubdomain(t, { isRequired: !repository }),
-      url: Yup.string().when('repoType', {
-        is: (repoType: RepoSpecType) => repoType === RepoSpecType.GIT,
-        then: () =>
-          Yup.string()
-            .matches(
-              gitRepoUrlRegex,
-              t('Enter a valid repository URL. Example: {{ demoRepositoryUrl }}', {
-                demoRepositoryUrl: 'https://github.com/flightctl/flightctl-demos',
-              }),
-            )
-            .defined(t('Repository URL is required')),
-        otherwise: () =>
-          Yup.string()
-            .matches(httpRepoUrlRegex, t('Enter a valid HTTP service URL. Example: https://my-service-url'))
-            .defined(t('HTTP service URL is required')),
-      }),
       configType: values.useAdvancedConfig ? Yup.string().required(t('Repository type is required')) : Yup.string(),
       httpConfig: Yup.object({
         basicAuth: Yup.object({
@@ -467,66 +705,179 @@ export const repositorySchema =
       }),
       useResourceSyncs: Yup.boolean(),
       resourceSyncs: values.useResourceSyncs ? repoSyncSchema(t, values.resourceSyncs) : Yup.array(),
+    };
+
+    if (values.repoType === RepoSpecType.RepoSpecTypeOci) {
+      return Yup.object({
+        ...baseSchema,
+        url: Yup.string(),
+        ociConfig: Yup.object({
+          registry: Yup.string()
+            .matches(
+              registryHostnameRegex,
+              t('Enter a valid registry hostname (e.g., quay.io, registry.redhat.io, myregistry.com:5000)'),
+            )
+            .required(t('Registry hostname is required')),
+          scheme: Yup.string().oneOf([OciRepoSpec.scheme.HTTP, OciRepoSpec.scheme.HTTPS]),
+          accessMode: Yup.string().oneOf([OciRepoSpec.accessMode.READ, OciRepoSpec.accessMode.READ_WRITE]),
+          ociAuth: Yup.object({
+            use: Yup.boolean(),
+            username: values.ociConfig?.ociAuth?.use ? Yup.string().required(t('Username is required')) : Yup.string(),
+            password: values.ociConfig?.ociAuth?.use ? Yup.string().required(t('Password is required')) : Yup.string(),
+          }),
+          caCrt: Yup.string(),
+          skipServerVerification: Yup.boolean(),
+        }),
+      });
+    }
+
+    return Yup.object({
+      ...baseSchema,
+      url: Yup.string().when('repoType', {
+        is: (repoType: RepoSpecType) => repoType === RepoSpecType.RepoSpecTypeGit,
+        then: () =>
+          Yup.string()
+            .matches(
+              gitRepoUrlRegex,
+              t('Enter a valid repository URL. Example: {{ demoRepositoryUrl }}', {
+                demoRepositoryUrl: 'https://github.com/flightctl/flightctl-demos',
+              }),
+            )
+            .defined(t('Repository URL is required')),
+        otherwise: () =>
+          Yup.string()
+            .matches(httpRepoUrlRegex, t('Enter a valid HTTP service URL. Example: https://my-service-url'))
+            .defined(t('HTTP service URL is required')),
+      }),
+      ociConfig: Yup.object(),
     });
   };
 
 export const getRepository = (values: Omit<RepositoryFormValues, 'useResourceSyncs' | 'resourceSyncs'>): Repository => {
-  const spec: RepositorySpec = {
-    url: values.url,
-    type: values.repoType,
-  };
-  if (values.configType === 'http' && values.validationSuffix) {
-    const httpRepoSpec = spec as HttpRepoSpec;
-    httpRepoSpec.validationSuffix = values.validationSuffix;
-    // httpConfig must be included as "validationSuffix" is only allowed for HttpRepoSpec
-    httpRepoSpec.httpConfig = {
-      skipServerVerification: false,
+  if (values.repoType === RepoSpecType.RepoSpecTypeOci && values.ociConfig) {
+    const ociRepoSpec: OciRepoSpec = {
+      registry: values.ociConfig.registry,
+      type: RepoSpecType.RepoSpecTypeOci,
+      scheme: values.ociConfig.scheme || OciRepoSpec.scheme.HTTPS,
+      accessMode: values.ociConfig.accessMode || OciRepoSpec.accessMode.READ,
+    };
+
+    if (values.ociConfig.skipServerVerification) {
+      ociRepoSpec.skipServerVerification = true;
+    }
+
+    if (values.ociConfig.caCrt && !values.ociConfig.skipServerVerification) {
+      ociRepoSpec['ca.crt'] = btoa(values.ociConfig.caCrt);
+    }
+
+    if (values.ociConfig.ociAuth?.use && values.ociConfig.ociAuth.username && values.ociConfig.ociAuth.password) {
+      ociRepoSpec.ociAuth = {
+        authType: OciAuthType.DOCKER,
+        username: values.ociConfig.ociAuth.username,
+        password: values.ociConfig.ociAuth.password,
+      };
+    }
+
+    return {
+      apiVersion: CORE_API_VERSION,
+      kind: 'Repository',
+      metadata: {
+        name: values.name,
+      },
+      spec: ociRepoSpec,
     };
   }
 
-  if (values.configType === 'http' && values.httpConfig) {
-    const httpRepoSpec = spec as HttpRepoSpec;
-    httpRepoSpec.httpConfig = {
-      skipServerVerification: values.httpConfig.skipServerVerification,
+  let spec: GitRepoSpec | HttpRepoSpec;
+
+  if (values.repoType === RepoSpecType.RepoSpecTypeGit) {
+    spec = {
+      url: values.url,
+      type: RepoSpecType.RepoSpecTypeGit,
     };
-    const caCrt = values.httpConfig.caCrt;
-    if (caCrt && !values.httpConfig.skipServerVerification) {
-      httpRepoSpec.httpConfig['ca.crt'] = btoa(caCrt);
-    }
-    if (values.httpConfig.basicAuth?.use) {
-      httpRepoSpec.httpConfig.username = values.httpConfig.basicAuth.username;
-      httpRepoSpec.httpConfig.password = values.httpConfig.basicAuth.password;
+  } else {
+    spec = {
+      url: values.url,
+      type: RepoSpecType.RepoSpecTypeHttp,
+    };
+  }
+
+  // Handle config based on repository type
+  if (spec.type === RepoSpecType.RepoSpecTypeHttp) {
+    if (values.validationSuffix) {
+      spec.httpConfig = {
+        skipServerVerification: false,
+      };
+      spec.validationSuffix = values.validationSuffix;
     }
 
-    if (values.httpConfig.mTlsAuth?.use) {
-      const tlsCrt = values.httpConfig.mTlsAuth.tlsCrt;
-      if (tlsCrt) {
-        httpRepoSpec.httpConfig['tls.crt'] = btoa(tlsCrt);
+    if (values.httpConfig) {
+      spec.httpConfig = {
+        skipServerVerification: values.httpConfig.skipServerVerification,
+      };
+      const caCrt = values.httpConfig.caCrt;
+      if (caCrt && !values.httpConfig.skipServerVerification) {
+        spec.httpConfig['ca.crt'] = btoa(caCrt);
       }
-      const tlsKey = values.httpConfig.mTlsAuth.tlsKey;
-      if (tlsKey) {
-        httpRepoSpec.httpConfig['tls.key'] = btoa(tlsKey);
+      if (values.httpConfig.basicAuth?.use) {
+        spec.httpConfig.username = values.httpConfig.basicAuth.username;
+        spec.httpConfig.password = values.httpConfig.basicAuth.password;
+      }
+
+      if (values.httpConfig.mTlsAuth?.use) {
+        const tlsCrt = values.httpConfig.mTlsAuth.tlsCrt;
+        if (tlsCrt) {
+          spec.httpConfig['tls.crt'] = btoa(tlsCrt);
+        }
+        const tlsKey = values.httpConfig.mTlsAuth.tlsKey;
+        if (tlsKey) {
+          spec.httpConfig['tls.key'] = btoa(tlsKey);
+        }
+      }
+      if (values.httpConfig.token) {
+        spec.httpConfig.token = values.httpConfig.token;
       }
     }
-    if (spec.type === RepoSpecType.HTTP && values.httpConfig.token) {
-      httpRepoSpec.httpConfig.token = values.httpConfig.token;
-    }
-  } else if (values.configType === 'ssh' && values.sshConfig) {
-    const sshRepoSpec = spec as SshRepoSpec;
+  } else if (spec.type === RepoSpecType.RepoSpecTypeGit) {
+    if (values.configType === 'http' && values.httpConfig) {
+      spec.httpConfig = {
+        skipServerVerification: values.httpConfig.skipServerVerification,
+      };
+      const caCrt = values.httpConfig.caCrt;
+      if (caCrt && !values.httpConfig.skipServerVerification) {
+        spec.httpConfig['ca.crt'] = btoa(caCrt);
+      }
+      if (values.httpConfig.basicAuth?.use) {
+        spec.httpConfig.username = values.httpConfig.basicAuth.username;
+        spec.httpConfig.password = values.httpConfig.basicAuth.password;
+      }
 
-    sshRepoSpec.sshConfig = {
-      privateKeyPassphrase: values.sshConfig.privateKeyPassphrase,
-      skipServerVerification: values.sshConfig.skipServerVerification,
-    };
+      if (values.httpConfig.mTlsAuth?.use) {
+        const tlsCrt = values.httpConfig.mTlsAuth.tlsCrt;
+        if (tlsCrt) {
+          spec.httpConfig['tls.crt'] = btoa(tlsCrt);
+        }
+        const tlsKey = values.httpConfig.mTlsAuth.tlsKey;
+        if (tlsKey) {
+          spec.httpConfig['tls.key'] = btoa(tlsKey);
+        }
+      }
+      // Note: GitRepoSpec doesn't support token
+    } else if (values.configType === 'ssh' && values.sshConfig) {
+      spec.sshConfig = {
+        privateKeyPassphrase: values.sshConfig.privateKeyPassphrase,
+        skipServerVerification: values.sshConfig.skipServerVerification,
+      };
 
-    const sshPrivateKey = values.sshConfig.sshPrivateKey;
-    if (sshPrivateKey) {
-      sshRepoSpec.sshConfig.sshPrivateKey = btoa(sshPrivateKey);
+      const sshPrivateKey = values.sshConfig.sshPrivateKey;
+      if (sshPrivateKey) {
+        spec.sshConfig.sshPrivateKey = btoa(sshPrivateKey);
+      }
     }
   }
 
   return {
-    apiVersion: API_VERSION,
+    apiVersion: CORE_API_VERSION,
     kind: 'Repository',
     metadata: {
       name: values.name,
@@ -537,7 +888,7 @@ export const getRepository = (values: Omit<RepositoryFormValues, 'useResourceSyn
 
 export const getResourceSync = (repositoryId: string, values: ResourceSyncFormValue): ResourceSync => {
   return {
-    apiVersion: API_VERSION,
+    apiVersion: CORE_API_VERSION,
     kind: 'ResourceSync',
     metadata: {
       name: values.name,