# Output shape byte-identical to modules/yc-s3 so k8s-secret consumes it unchanged.
# access_key = the per-bucket MinIO user, secret_key = its generated secret.

output "bucket_name" {
  description = "Name of the first bucket (for backward compatibility)"
  value       = length(var.buckets) > 0 ? minio_s3_bucket.this[var.buckets[0].name].bucket : ""
}

output "access_key" {
  description = "Access key for the first bucket (for backward compatibility)"
  value       = length(var.buckets) > 0 ? minio_iam_user.this[var.buckets[0].name].name : ""
  sensitive   = true
}

output "secret_key" {
  description = "Secret key for the first bucket (for backward compatibility)"
  value       = length(var.buckets) > 0 ? random_password.secret_key[var.buckets[0].name].result : ""
  sensitive   = true
}

output "buckets" {
  description = "Map of all buckets (name => data)"
  value = {
    for name, bucket in minio_s3_bucket.this : name => {
      bucket_name        = bucket.bucket
      access_key         = minio_iam_user.this[name].name
      secret_key         = random_password.secret_key[name].result
      service_account_id = minio_iam_user.this[name].id
    }
  }
  sensitive = true
}

# Parity with yc-s3 (which exposes extra YC service accounts); none in-cluster.
output "service_accounts" {
  description = "Map of additional service accounts (none for MinIO)"
  value       = {}
  sensitive   = true
}