locals {
  valkey_users_map = {
    for valkey_user in var.valkey_users : "${valkey_user.cluster_id}:${valkey_user.user.name}" => valkey_user
  }

  valkey_user_permissions = {
    for key, valkey_user in local.valkey_users_map : key => merge(
      try(valkey_user.permissions.commands, null) != null ? {
        commands = valkey_user.permissions.commands
      } : {},
      try(valkey_user.permissions.categories, null) != null ? {
        categories = valkey_user.permissions.categories
      } : {},
      try(valkey_user.permissions.patterns, null) != null ? {
        patterns = valkey_user.permissions.patterns
      } : {},
      try(valkey_user.permissions.pub_sub_channels, try(valkey_user.permissions.pubSubChannels, null)) != null ? {
        pub_sub_channels = try(valkey_user.permissions.pub_sub_channels, valkey_user.permissions.pubSubChannels)
      } : {},
      try(valkey_user.permissions.sanitize_payload, try(valkey_user.permissions.sanitizePayload, null)) != null ? {
        sanitize_payload = try(valkey_user.permissions.sanitize_payload, valkey_user.permissions.sanitizePayload)
      } : {},
      try(valkey_user.permissions.databases, null) != null ? {
        databases = valkey_user.permissions.databases
      } : {}
    )
  }
}

resource "random_password" "user_password" {
  for_each = local.valkey_users_map

  length  = try(each.value.user.password_length, 32)
  special = try(each.value.user.password_special, false)
  upper   = true
  lower   = true
  numeric = true

  lifecycle {
    ignore_changes = all
  }
}

resource "yandex_mdb_redis_user" "this" {
  for_each = local.valkey_users_map

  cluster_id  = each.value.cluster_id
  name        = each.value.user.name
  passwords   = [random_password.user_password[each.key].result]
  enabled     = try(each.value.user.enabled, true)
  permissions = local.valkey_user_permissions[each.key]

  lifecycle {
    ignore_changes = [passwords]
  }
}