# Entity contract for the in-cluster Kafka implementation.
#
# The entity-level variables (topics, users, kafka_policy, create_users,
# default_user_roles, user_password_length) are BYTE-IDENTICAL to
# modules/kafka-topics-yc so that a single declaration in infrastructure.yaml
# drives both the Yandex MDB and the in-cluster (Bitnami/Strimzi) backends.
#
# Only `kafka_cluster_refs` differs: instead of a Yandex MDB cluster_id it
# carries the in-cluster bootstrap endpoint and SASL/TLS parameters. Admin
# SASL credentials are supplied by the root unit from Vault, never hardcoded.

variable "environment" {
  description = "Target environment name, for example stage/preprod/<contour>."
  type        = string
}

variable "topics" {
  description = "Kafka topics declared in infrastructure.yaml under environments.<env>.kafka.topics."
  type = list(object({
    name                 = string
    owner                = string
    clusterRef           = string
    partitions           = any
    replicationFactor    = any
    config               = optional(any, {})
    inheritDefaultConfig = optional(bool, true)
    deletionPolicy       = optional(string, "orphan")
    ownerRoles           = optional(list(string))
  }))
  default = []
}

variable "users" {
  description = "User-centric Kafka access declarations from infrastructure.yaml under environments.<env>.kafka.users. Each user lists the topics it may access and the roles it holds."
  type = list(object({
    name       = string
    clusterRef = string
    permissions = optional(list(object({
      topic = string
      roles = list(string)
    })), [])
  }))
  default = []
}

variable "kafka_cluster_refs" {
  description = "Environment clusterRef mapping. In-cluster shape: bootstrap endpoint + SASL/TLS, no Yandex cluster_id."
  type = map(object({
    bootstrap_servers          = string
    host                       = optional(string, "")
    port                       = optional(number, 9092)
    sasl_mechanism             = optional(string, "SCRAM-SHA-512")
    security_protocol          = optional(string, "SASL_PLAINTEXT")
    tls_enabled                = optional(bool, false)
    default_partitions         = optional(number, 3)
    default_replication_factor = optional(number, 1)
    max_replication_factor     = optional(number, 1)
    default_topic_config       = optional(map(string), {})
  }))
}

variable "kafka_policy" {
  description = "Platform policy for service-owned Kafka declarations."
  type = object({
    allow_create             = optional(bool, true)
    allow_delete             = optional(bool, false)
    allow_partition_increase = optional(bool, true)
    allow_partition_decrease = optional(bool, false)
  })
  default = {}
}

variable "create_users" {
  description = "Create one Kafka user per topic owner."
  type        = bool
  default     = true
}

variable "create_acls" {
  description = "Create ACL entries. Some brokers run without an authorizer configured (authorizer.class.name unset) and reject any ACL write with \"Security features are disabled\" — set false on those contours."
  type        = bool
  default     = true
}

variable "default_user_roles" {
  description = "Kafka roles granted to generated owner users on their topics."
  type        = list(string)
  default     = ["ACCESS_ROLE_PRODUCER", "ACCESS_ROLE_CONSUMER"]
}

variable "user_password_length" {
  description = "Generated Kafka user (SCRAM) password length."
  type        = number
  default     = 32
}