locals {
  # Маппинг наших типов на Kubernetes типы
  k8s_secret_type_map = {
    "dockerconfigjson" = "kubernetes.io/dockerconfigjson"
    "database"         = "Opaque"
    "s3"               = "Opaque"
    "yc_sa"            = "Opaque"
    "rabbitmq"         = "Opaque"
    "kafka"            = "Opaque"
    "opaque"           = "Opaque"
  }

  default_yc_sa_key_names = {
    access_key         = "access_key"
    secret_key         = "secret_key"
    service_account_id = "service_account_id"
  }

  secrets_map = {
    for idx, secret in var.secrets : (try(secret.resource_key, "") != "" ? secret.resource_key : secret.name) => secret
  }

  random_keys_flat = merge([
    for secret_name, secret in local.secrets_map : {
      for key, config in try(secret.random_keys, {}) : "${secret_name}:${key}" => {
        secret_name = secret_name
        key         = key
        length      = try(config.length, 32)
        special     = try(config.special, false)
      }
    }
  ]...)

  database_outputs_by_secret = {
    for name, secret in local.secrets_map : name => try(
      var.database_outputs_map["${try(secret.dependencies.cluster, "")}:${try(secret.dependencies.db, "")}:${try(secret.dependencies.user, "")}"],
      null
    )
  }

  rabbitmq_outputs_by_secret = {
    for name, secret in local.secrets_map : name => try(
      var.rabbitmq_outputs_map[
        format(
          "%s:%s:%s",
          try(secret.dependencies.rabbitmq_ref, "default"),
          try(secret.dependencies.rabbitmq_vhost, try(secret.dependencies.vhost, "")),
          try(secret.dependencies.rabbitmq_user, try(secret.dependencies.user, ""))
        )
      ],
      null
    )
  }

  kafka_outputs_by_secret = {
    for name, secret in local.secrets_map : name => try(
      var.kafka_outputs_map[
        format(
          "%s:%s",
          try(secret.dependencies.kafka_ref, try(secret.dependencies.cluster_ref, try(secret.dependencies.cluster, ""))),
          try(secret.dependencies.kafka_user, try(secret.dependencies.user, ""))
        )
      ],
      null
    )
  }

  rabbitmq_default_credentials_by_secret = {
    for name, secret in local.secrets_map : name => local.rabbitmq_outputs_by_secret[name] == null ? {} : {
      host                = local.rabbitmq_outputs_by_secret[name].host
      hostname            = "${local.rabbitmq_outputs_by_secret[name].host}:${local.rabbitmq_outputs_by_secret[name].port}"
      port                = local.rabbitmq_outputs_by_secret[name].port
      vhost               = local.rabbitmq_outputs_by_secret[name].vhost
      user                = local.rabbitmq_outputs_by_secret[name].username
      username            = local.rabbitmq_outputs_by_secret[name].username
      password            = local.rabbitmq_outputs_by_secret[name].password
      uri                 = local.rabbitmq_outputs_by_secret[name].uri
      management_endpoint = local.rabbitmq_outputs_by_secret[name].management_endpoint
    }
    if secret.secret_type == "rabbitmq"
  }

  rabbitmq_credentials_by_secret = {
    for name, secret in local.secrets_map : name => length(try(secret.credential_keys, {})) == 0 ? local.rabbitmq_default_credentials_by_secret[name] : {
      for key, source in try(secret.credential_keys, {}) : key => try(local.rabbitmq_default_credentials_by_secret[name][source], "")
    }
    if secret.secret_type == "rabbitmq" && local.rabbitmq_outputs_by_secret[name] != null
  }

  kafka_default_credentials_by_secret = {
    for name, secret in local.secrets_map : name => local.kafka_outputs_by_secret[name] == null ? {} : {
      host                   = local.kafka_outputs_by_secret[name].host
      hostname               = local.kafka_outputs_by_secret[name].hostname
      port                   = local.kafka_outputs_by_secret[name].port
      username               = local.kafka_outputs_by_secret[name].username
      user                   = local.kafka_outputs_by_secret[name].username
      password               = local.kafka_outputs_by_secret[name].password
      sasl_mechanism         = local.kafka_outputs_by_secret[name].sasl_mechanism
      security_protocol      = local.kafka_outputs_by_secret[name].security_protocol
      bootstrap_server       = local.kafka_outputs_by_secret[name].bootstrap_server
      bootstrap_servers      = local.kafka_outputs_by_secret[name].bootstrap_servers
      bootstrap_servers_json = local.kafka_outputs_by_secret[name].bootstrap_servers_json
    }
    if secret.secret_type == "kafka"
  }

  kafka_credentials_by_secret = {
    for name, secret in local.secrets_map : name => length(try(secret.credential_keys, {})) == 0 ? local.kafka_default_credentials_by_secret[name] : {
      for key, source in try(secret.credential_keys, {}) : key => try(local.kafka_default_credentials_by_secret[name][source], "")
    }
    if secret.secret_type == "kafka" && local.kafka_outputs_by_secret[name] != null
  }

  yc_sa_sources = {
    for name, secret in local.secrets_map : name => try(
      var.yc_service_accounts_map[try(secret.dependencies.service_account, "")],
      null
    )
    if secret.secret_type == "yc_sa"
  }

  yc_sa_key_names_by_secret = {
    for name, secret in local.secrets_map : name => merge(
      local.default_yc_sa_key_names,
      try(secret.yc_sa_key_names, {})
    )
    if secret.secret_type == "yc_sa"
  }

  # Значения, захваченные из live-кластера (adopt 1:1). Приходят из расшифрованного
  # secret-values файла как map(resource_key => map(key => base64(raw_value))).
  # k8s хранит .data уже в base64, поэтому base64decode даёт исходное значение байт-в-байт.
  secrets_data_override = {
    for name, secret in local.secrets_map : name => {
      for key, b64 in try(var.secret_values[name], {}) : key => base64decode(b64)
    }
    if length(try(var.secret_values[name], {})) > 0
  }

  secrets_data_computed = {
    for name, secret in local.secrets_map : name =>
    secret.secret_type == "dockerconfigjson" ? {
      ".dockerconfigjson" = jsonencode({
        auths = {
          "${secret.registry_url}" = {
            username = try(var.env_vars.DOCKER_REGISTRY_USERNAME, "")
            password = try(var.env_vars.DOCKER_REGISTRY_PASSWORD, "")
            auth     = base64encode("${try(var.env_vars.DOCKER_REGISTRY_USERNAME, "")}:${try(var.env_vars.DOCKER_REGISTRY_PASSWORD, "")}")
          }
        }
      })
      } : secret.secret_type == "s3" ? {
      # Если указан конкретный bucket в dependencies - используем его, иначе fallback на s3_outputs
      access_key = try(var.s3_buckets_map[secret.dependencies.bucket].access_key, var.s3_outputs.access_key)
      secret_key = try(var.s3_buckets_map[secret.dependencies.bucket].secret_key, var.s3_outputs.secret_key)
      bucket     = try(var.s3_buckets_map[secret.dependencies.bucket].bucket_name, var.s3_outputs.bucket_name)
      endpoint   = try(var.constants.s3_endpoint, "https://storage.yandexcloud.net")
      } : secret.secret_type == "yc_sa" ? merge(
      {
        (local.yc_sa_key_names_by_secret[name].access_key)         = try(local.yc_sa_sources[name].access_key, "")
        (local.yc_sa_key_names_by_secret[name].secret_key)         = try(local.yc_sa_sources[name].secret_key, "")
        (local.yc_sa_key_names_by_secret[name].service_account_id) = try(local.yc_sa_sources[name].service_account_id, "")
        endpoint                                                   = "https://storage.yandexcloud.net"
      },
      try(secret.custom_keys, {}),
      {
        for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
      },
      {
        for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
      }
      ) : secret.secret_type == "database" && local.database_outputs_by_secret[name] != null ? merge(
      # Базовые поля из database outputs
      {
        host     = local.database_outputs_by_secret[name].host
        port     = try(var.constants.postgres_port, "6432")
        database = local.database_outputs_by_secret[name].database_name
        username = local.database_outputs_by_secret[name].user_name
        password = local.database_outputs_by_secret[name].password
        "ca.crt" = try(var.constants.postgres_ca, "")
      },
      # Кастомные статические поля
      try(secret.custom_keys, {}),
      {
        for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
      },
      # Рандомные поля
      {
        for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
      }
      ) : secret.secret_type == "rabbitmq" && local.rabbitmq_outputs_by_secret[name] != null ? merge(
      local.rabbitmq_credentials_by_secret[name],
      try(secret.custom_keys, {}),
      {
        for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
      },
      {
        for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
      }
      ) : secret.secret_type == "kafka" && local.kafka_outputs_by_secret[name] != null ? merge(
      local.kafka_credentials_by_secret[name],
      try(secret.custom_keys, {}),
      {
        for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
      },
      {
        for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
      }
      ) : merge(
      try(secret.custom_keys, {}),
      {
        for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
      },
      {
        for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
      }
    )
  }

  # Если для секрета заданы live-значения (adopt) - используем их 1:1,
  # иначе собираем data из outputs/custom/constant/random как обычно.
  secrets_data = {
    for name, secret in local.secrets_map : name => (
      contains(keys(local.secrets_data_override), name)
      ? local.secrets_data_override[name]
      : local.secrets_data_computed[name]
    )
  }

  secrets_with_data = {
    for name, secret in local.secrets_map : name => {
      name           = secret.name
      namespace      = secret.namespace
      secret_type    = secret.secret_type
      k8s_type       = try(local.k8s_secret_type_map[secret.secret_type], "Opaque")
      labels         = try(secret.labels, {})
      annotations    = try(secret.annotations, {})
      ignore_changes = try(secret.ignore_changes, false)
      data           = try(local.secrets_data[name], {})
    }
  }

  secrets_with_ignore = {
    for name, secret in local.secrets_with_data : name => secret
    if secret.ignore_changes
  }
  secrets_without_ignore = {
    for name, secret in local.secrets_with_data : name => secret
    if !secret.ignore_changes
  }
}

resource "random_password" "secrets" {
  for_each = local.random_keys_flat

  length  = each.value.length
  special = each.value.special
  upper   = true
  lower   = true
  numeric = true

  lifecycle {
    ignore_changes = all
  }
}

resource "kubernetes_secret" "with_ignore" {
  for_each = local.secrets_with_ignore

  metadata {
    name        = each.value.name
    namespace   = each.value.namespace
    labels      = try(each.value.labels, {})
    annotations = try(each.value.annotations, {})
  }

  type = each.value.k8s_type

  # Совпадает с импортированным состоянием (провайдер по умолчанию ставит true и
  # даёт phantom "+ wait_for_service_account_token = true" на adopt-секретах).
  # Актуально только для secret-ов типа service-account-token; тут все Opaque.
  wait_for_service_account_token = false

  data = each.value.data

  lifecycle {
    # Игнорируем data, type и metadata чтобы не было phantom updates
    ignore_changes = [data, type, metadata]
  }

  depends_on = [random_password.secrets]
}

resource "kubernetes_secret" "without_ignore" {
  for_each = local.secrets_without_ignore

  metadata {
    name        = each.value.name
    namespace   = each.value.namespace
    labels      = try(each.value.labels, {})
    annotations = try(each.value.annotations, {})
  }

  type = each.value.k8s_type

  # Совпадает с импортированным состоянием (иначе phantom "+ wait_for_service_account_token = true").
  wait_for_service_account_token = false

  data = each.value.data

  lifecycle {
    # type и metadata игнорируем чтобы не было phantom updates
    ignore_changes = [type, metadata]
  }

  depends_on = [random_password.secrets]
}