update crds

crdSchemas/keycloakidentityprovider_v1beta1.json

@@ -65,6 +65,23 @@
           ],
           "type": "object",
           "additionalProperties": false
+        },
+        "tokenExchange": {
+          "description": "TokenExchange configures fine-grained-authz so that exactly the listed\nclients (and no others) may exchange tokens with this IdP as\n`subject_issuer`. Omit the field to leave token-exchange permissions\nunmanaged (whatever was clicked manually stays). Set to a list (possibly\nempty) to have the operator enable IdP permissions and bind a Client-type\npolicy listing the allowed clients on the `token-exchange` scope\npermission in the realm-management authz resource server.",
+          "properties": {
+            "allowedClients": {
+              "description": "AllowedClients is the list of clientIds (text, not UUIDs) in the same\nrealm as the IdP that are permitted to perform token-exchange against\nthis IdP. An empty list creates a policy that matches no clients,\neffectively denying all (useful as an explicit lockdown). Omitting the\nparent `tokenExchange` field entirely leaves Keycloak permissions\nuntouched.",
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "allowedClients"
+          ],
+          "type": "object",
+          "additionalProperties": false
         }
       },
       "required": [
@@ -177,6 +194,33 @@
         "status": {
           "description": "Status is a human-readable status message",
           "type": "string"
+        },
+        "tokenExchange": {
+          "description": "TokenExchange contains the observed state of the token-exchange\npermission wiring, populated only when spec.tokenExchange is set.",
+          "properties": {
+            "enabled": {
+              "description": "Enabled reflects whether fine-grained authz permissions are enabled on\nthis IdP in Keycloak.",
+              "type": "boolean"
+            },
+            "message": {
+              "description": "Message carries the last token-exchange reconcile error, if any. Set\nonly when token-exchange reconcile fails \u2014 the parent `status.ready`\nstill reflects the IdP itself, not the TE side.",
+              "type": "string"
+            },
+            "permissionID": {
+              "description": "PermissionID is the ID of the `token-exchange` scope permission auto-\ncreated in the realm-management authz resource server when permissions\nare enabled on this IdP.",
+              "type": "string"
+            },
+            "policyID": {
+              "description": "PolicyID is the ID of the Client-type authz policy managed by the\noperator (carries the AllowedClients list).",
+              "type": "string"
+            },
+            "policyName": {
+              "description": "PolicyName is the name of the managed policy, useful for admins\nlooking the resource up in the Keycloak UI.",
+              "type": "string"
+            }
+          },
+          "type": "object",
+          "additionalProperties": false
         }
       },
       "required": [