variable "secrets" {
  description = "Список секретов. Форма и данные декларируются в одном месте (infrastructure-secrets.yaml)."
  type = list(object({
    name         = string
    namespace    = string
    type         = string
    registry_url = optional(string, "")
    data         = optional(map(string), {}) # Явные значения (adopt/static), base64 как в k8s .data
    depends_on = optional(object({
      cluster         = optional(string, "")
      cluster_ref     = optional(string, "")
      db              = optional(string, "")
      user            = optional(string, "")
      valkey_cluster  = optional(string, "")
      valkey_user     = optional(string, "")
      kafka_ref       = optional(string, "")
      kafka_user      = optional(string, "")
      vhost           = optional(string, "")
      bucket          = optional(string, "") # Имя бакета для s3 секретов
      service_account = optional(string, "") # Имя YC Service Account для yc_sa секретов
      rabbitmq_ref    = optional(string, "default")
      rabbitmq_vhost  = optional(string, "")
      rabbitmq_user   = optional(string, "")
    }), {})
    yc_sa_key_names = optional(object({
      access_key         = optional(string, "access_key")
      secret_key         = optional(string, "secret_key")
      service_account_id = optional(string, "service_account_id")
    }), {})
    custom_keys   = optional(map(string), {})
    constant_keys = optional(map(string), {})
    random_keys = optional(map(object({
      length  = optional(number, 32)
      special = optional(bool, false)
    })), {}) # Случайные ключи
    credential_keys = optional(map(string), {})
    labels          = optional(map(string), {})
    annotations     = optional(map(string), {})
    ignore_changes  = optional(bool, false)

    # Sink: where the resolved secret data lands. "k8s" (default) writes a
    # Kubernetes Secret; "vault" writes a Vault KV v2 entry instead. Keys and
    # resolution (static/dynamic from module outputs) are identical either way.
    sink       = optional(string, "k8s")
    vault_path = optional(string, "") # KV name relative to mount; default <vault_path_prefix>/<name>

    # v2 contract fields. All optional - legacy callers (type + depends_on)
    # keep working unchanged when these are left unset.
    schema = optional(string, "") # canonical field-set selector, e.g. "rabbitmq.v1", "dockerconfigjson.v1"

    # Ownership mode: managed | referenced | observed | adopt_once. Empty ("")
    # falls back to legacy behavior derived from ignore_changes.
    ownership = optional(string, "")

    # Used only when ownership = "referenced": value is read from an external
    # store instead of computed from module outputs.
    source_kind = optional(string, "") # currently only "secret_ref" is implemented
    source_ref  = optional(string, "") # "vault://<kv-name-relative-to-mount>#<field>"

    # Extra named fields merged on top of the resolved/canonical data, each
    # either read from Vault (secret_ref) or a literal non-secret value (static).
    extra_fields = optional(map(object({
      source_kind = string # "secret_ref" | "static"
      ref         = optional(string, "") # for secret_ref: "vault://<kv-name>#<field>"
      value       = optional(string, "") # for static
    })), {})
  }))
}

variable "vault_kv_mount" {
  description = "Vault KV v2 mount for secrets with sink=vault"
  type        = string
  default     = "secrets"
}

variable "vault_path_prefix" {
  description = "Default path prefix under the KV mount for sink=vault secrets (used when vault_path is unset)"
  type        = string
  default     = "vault"
}

variable "s3_outputs" {
  description = "Outputs от модуля S3 (default/первый бакет)"
  type = object({
    bucket_name = optional(string, "")
    access_key  = optional(string, "")
    secret_key  = optional(string, "")
  })
  default = {
    bucket_name = ""
    access_key  = ""
    secret_key  = ""
  }
}

variable "s3_buckets_map" {
  description = "Map всех бакетов (name => data)"
  type = map(object({
    bucket_name        = string
    access_key         = string
    secret_key         = string
    service_account_id = optional(string, "")
  }))
  default = {}
}

variable "yc_service_accounts_map" {
  description = "Map YC service accounts (name => data)"
  type = map(object({
    service_account_id = string
    access_key         = optional(string, "")
    secret_key         = optional(string, "")
    folder_roles       = optional(list(string), [])
  }))
  default = {}
}

variable "database_outputs_map" {
  description = "Outputs от модулей Database, ключ = cluster_id:database_name:user_name"
  type = map(object({
    host          = string
    database_name = string
    user_name     = string
    password      = string
  }))
  default = {}
}

variable "valkey_outputs_map" {
  description = "Outputs от модулей Valkey/Redis users, ключ = cluster_id:user_name"
  type = map(object({
    cluster_id = string
    host       = string
    port       = string
    user_name  = string
    password   = string
  }))
  default = {}
}

variable "rabbitmq_outputs_map" {
  description = "Outputs от модуля RabbitMQ, ключ = rabbitmq_ref:vhost:user"
  type = map(object({
    host                = string
    port                = string
    vhost               = string
    username            = string
    password            = string
    uri                 = string
    management_endpoint = string
  }))
  default = {}
}

variable "kafka_outputs_map" {
  description = "Outputs от модуля Kafka, ключ = kafka_ref:user"
  type = map(object({
    host                   = string
    hostname               = string
    port                   = string
    username               = string
    password               = string
    sasl_mechanism         = string
    security_protocol      = string
    bootstrap_server       = string
    bootstrap_servers      = string
    bootstrap_servers_json = string
  }))
  default = {}
}

variable "constants" {
  description = "Константные значения (CA сертификаты, endpoints и т.д.)"
  type        = map(string)
  default     = {}
}

variable "env_vars" {
  description = "Environment variables"
  type        = map(string)
  default     = {}
}