data "bitwarden-secrets_secret" "configmap_import" {
  for_each = {
    for pair in flatten([
      for k, v in var.kubernetes : [
        for id in v.config_map_import : {
          map_key   = k
          secret_id = id
        }
      ] if v.config_map_import != null && v.enabled == true
    ]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
  }
  id = each.value
}

resource "kubernetes_config_map_v1" "configmap_import" {
  for_each = { for key, value in data.bitwarden-secrets_secret.configmap_import : key => value }
  metadata {
    name      = each.value.note
    namespace = split("__", each.value.key)[0]
  }
  data = yamldecode(each.value.value)
}


data "bitwarden-secrets_secret" "secret_import" {
  for_each = {
    for pair in flatten([
      for k, v in var.kubernetes : [
        for id in v.secret_import : {
          map_key   = k
          secret_id = id
        }
      ] if v.secret_import != null && v.enabled == true
    ]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
  }
  id = each.value
}

resource "kubernetes_secret_v1" "secret_import" {
  for_each = { for key, value in data.bitwarden-secrets_secret.secret_import : key => value }
  metadata {
    name      = each.value.note
    namespace = split("__", each.value.key)[0]
  }
  data = yamldecode(each.value.value)
}


resource "kubernetes_secret_v1" "automatic-database-secret" {
  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
  metadata {
    name      = "${each.key}-db-terraform"
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
  }

  data = {
    DB_DATABASE_NAME    = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
    DB_DATABASE         = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
    POSTGRES_DB         = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
    MYSQL_DATABASE      = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
    PGDATABASE          = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
    DB_HOST             = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
    PGHOST              = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
    POSTGRES_HOST       = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
    DB_PASSWORD         = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
    MYSQL_PASSWORD      = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
    MYSQL_ROOT_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
    POSTGRES_PASSWORD   = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
    PGPASSWORD          = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
    DB_USERNAME         = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
    POSTGRES_USER       = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
    MYSQL_USER          = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
    PGUSER              = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
    DATABASE_URL        = "postgresql://${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}@${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key].value}/${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
  }

}

resource "kubernetes_secret_v1" "automatic-database-mapped-secret" {
  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
  metadata {
    name      = "${each.key}-db-mapped-terraform"
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
  }

  data = {
    "${try(each.value.database.map_name, "DB_DATABASE_NAME")}"     = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
    "${try(each.value.database.map_host, "DB_DATABASE_NAME")}"     = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
    "${try(each.value.database.map_password, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
    "${try(each.value.database.map_username, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
  }
}


resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_username" {
  for_each   = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
  key        = "${each.key}__db__username"
  value      = try(each.value.database.username, each.key)
  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
  lifecycle {
    ignore_changes = [
      value, key
    ]
  }
}

resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_password" {
  for_each        = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
  key             = "${each.key}__db__password"
  project_id      = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
  length          = 32
  special         = true
  min_special     = 5
  avoid_ambiguous = true
  lifecycle {
    ignore_changes = [
      value, key
    ]
  }
}

resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_host" {
  for_each   = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
  key        = "${each.key}__db__host"
  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
  value      = try(each.value.database.host, "${each.key}-db-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc")
  lifecycle {
    ignore_changes = [
      value, key
    ]
  }
}

resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_port" {
  for_each   = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
  key        = "${each.key}__db__port"
  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
  value      = try(each.value.database.port, 5432)
  lifecycle {
    ignore_changes = [
      value, key
    ]
  }
}

resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_name" {
  for_each   = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
  key        = "${each.key}__db__name"
  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
  value      = try(each.value.database.name, each.key)
  lifecycle {
    ignore_changes = [
      value, key
    ]
  }
}

# 1. Move the loop logic to a local variable first
locals {
  database_secrets_to_import = {
    for key, value in var.kubernetes : key => value
    if value.database != null && value.enabled == true && try(value.import_database_secret, "") != ""
  }
}

# 2. Reference the local map in your import block using each.key and each.value
import {
  for_each = local.database_secrets_to_import

  to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key]
  id = each.value.import_database_secret.host
}

import {
  for_each = local.database_secrets_to_import

  to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key]
  id = each.value.import_database_secret.name
}
import {
  for_each = local.database_secrets_to_import

  to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key]
  id = each.value.import_database_secret.password
}
import {
  for_each = local.database_secrets_to_import

  to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key]
  id = each.value.import_database_secret.port
}
import {
  for_each = local.database_secrets_to_import

  to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key]
  id = each.value.import_database_secret.username
}