variable "kubernetes_input" {
  type = map(object({
    namespace              = optional(string)
    connected_namespace    = optional(string, "")
    database               = optional(map(string))
    redis                  = optional(map(string))
    enabled                = optional(bool, true)
    config_map_import      = optional(list(string))
    secret_import          = optional(list(string))
       requirements = optional(map(string), {
         limits-cpu      = "800m"
         limits-memory   = "500Mi"
         requests-cpu    = "200m"
         requests-memory = "200Mi"
       })
    import_database_secret = optional(object({
      #putting them a non optional as the code doesn't allow optional value 
      host     = string
      name     = string
      password = string
      port     = string
      username = string
    }))
  }))

}

###########################################################################################################################################################################################
#
#
#                                                                       CONFIGMAP PART
#
#
#
###########################################################################################################################################################################################
data "bitwarden-secrets_secret" "configmap_import" {
  for_each = {
    for pair in flatten([
      for k, v in var.kubernetes_input : [
        for id in v.config_map_import : {
          map_key   = k
          secret_id = id
        }
      ] if v.config_map_import != null && v.enabled == true
    ]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
  }
  id = each.value
}

resource "kubernetes_config_map_v1" "configmap_import" {
  for_each = { for key, value in data.bitwarden-secrets_secret.configmap_import : key => value }
  metadata {
    name      = each.value.note
    namespace = split("__", each.value.key)[0]
  }
  data = yamldecode(each.value.value)
}


data "bitwarden-secrets_secret" "secret_import" {
  for_each = {
    for pair in flatten([
      for k, v in var.kubernetes_input : [
        for id in v.secret_import : {
          map_key   = k
          secret_id = id
        }
      ] if v.secret_import != null && v.enabled == true
    ]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
  }
  id = each.value
}

resource "kubernetes_secret_v1" "secret_import" {
  for_each = { for key, value in data.bitwarden-secrets_secret.secret_import : key => value }
  metadata {
    name      = each.value.note
    namespace = split("__", each.value.key)[0]
  }
  data = yamldecode(each.value.value)
}

###########################################################################################################################################################################################
#
#
#                                                                       DATABASE PART
#
#
#
###########################################################################################################################################################################################
resource "kubernetes_secret_v1" "automatic-database-secret" {
  for_each = { for key, value in var.kubernetes_input : key => value if value.database != null && value.enabled == true }
  metadata {
    name      = "${each.key}-db-terraform"
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
  }

  data = {
    DB_DATABASE_NAME    = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
    DB_DATABASE         = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
    POSTGRES_DB         = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
    MYSQL_DATABASE      = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
    PGDATABASE          = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
    DB_HOST             = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
    PGHOST              = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
    POSTGRES_HOST       = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
    DB_PASSWORD         = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
    MYSQL_PASSWORD      = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
    MYSQL_ROOT_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
    POSTGRES_PASSWORD   = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
    PGPASSWORD          = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
    DB_USERNAME         = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
    POSTGRES_USER       = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
    MYSQL_USER          = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
    PGUSER              = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
    DATABASE_URL        = "postgresql://${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}@${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key].value}/${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
  }

}

resource "kubernetes_secret_v1" "automatic-database-mapped-secret" {
  for_each = { for key, value in var.kubernetes_input : key => value if value.database != null && value.enabled == true }
  metadata {
    name      = "${each.key}-db-mapped-terraform"
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
  }

  data = {
    "${try(each.value.database.map_name, "DB_DATABASE_NAME")}"     = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
    "${try(each.value.database.map_host, "DB_DATABASE_NAME")}"     = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
    "${try(each.value.database.map_password, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
    "${try(each.value.database.map_username, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
  }
}


resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_username" {
  for_each   = { for key, value in var.kubernetes_input : key => value if value.database != null && value.enabled == true }
  key        = "${each.key}__db__username"
  value      = try(each.value.database.username, each.key)
  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
  lifecycle {
    ignore_changes = [
      value, key
    ]
  }
}

resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_password" {
  for_each        = { for key, value in var.kubernetes_input : key => value if value.database != null && value.enabled == true }
  key             = "${each.key}__db__password"
  project_id      = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
  length          = 32
  special         = true
  min_special     = 5
  avoid_ambiguous = true
  lifecycle {
    ignore_changes = [
      value, key
    ]
  }
}

resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_host" {
  for_each   = { for key, value in var.kubernetes_input : key => value if value.database != null && value.enabled == true }
  key        = "${each.key}__db__host"
  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
  value      = try(each.value.database.host, "${each.key}-db-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc")
  lifecycle {
    ignore_changes = [
      value, key
    ]
  }
}

resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_port" {
  for_each   = { for key, value in var.kubernetes_input : key => value if value.database != null && value.enabled == true }
  key        = "${each.key}__db__port"
  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
  value      = try(each.value.database.port, 5432)
  lifecycle {
    ignore_changes = [
      value, key
    ]
  }
}

resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_name" {
  for_each   = { for key, value in var.kubernetes_input : key => value if value.database != null && value.enabled == true }
  key        = "${each.key}__db__name"
  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
  value      = try(each.value.database.name, each.key)
  lifecycle {
    ignore_changes = [
      value, key
    ]
  }
}

# 1. Move the loop logic to a local variable first
locals {
  database_secrets_to_import = {
    for key, value in var.kubernetes_input : key => value
    if value.database != null && value.enabled == true && can(value.import_database_secret.host)
  }
}

# 2. Reference the local map in your import block using each.key and each.value
import {
  for_each = local.database_secrets_to_import

  to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key]
  id = each.value.import_database_secret.host
}

import {
  for_each = local.database_secrets_to_import

  to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key]
  id = each.value.import_database_secret.name
}
import {
  for_each = local.database_secrets_to_import

  to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key]
  id = each.value.import_database_secret.password
}
import {
  for_each = local.database_secrets_to_import

  to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key]
  id = each.value.import_database_secret.port
}
import {
  for_each = local.database_secrets_to_import

  to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key]
  id = each.value.import_database_secret.username
}
###########################################################################################################################################################################################
#
#
#                                                                       REDIS PART
#
#
#
###########################################################################################################################################################################################

resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_host" {
  for_each   = { for key, value in var.kubernetes_input : key => value if value.redis != null && value.enabled == true }
  key        = "${each.key}__redis__host"
  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
  value      = try(each.value.redis.host, "${each.key}-redis-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc")
}

resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_port" {
  for_each   = { for key, value in var.kubernetes_input : key => value if value.redis != null && value.enabled == true }
  key        = "${each.key}__redis__port"
  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
  value      = try(each.value.redis.port, 5432)
}

##
## Commenting until I use the redis password option
##
#resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_password" {
#  for_each        = { for key, value in var.kubernetes_input : key => value if value.redis != null && value.enabled == true }
#  key             = "${each.key}__redis__password"
#  project_id      = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
#  length          = 32
#  special         = true
#  min_special     = 5
#  avoid_ambiguous = true
#}

resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_REPLICATION_MODE" {
  for_each   = { for key, value in var.kubernetes_input : key => value if value.redis != null && value.enabled == true }
  key        = "${each.key}__redis__REPLICATION_MODE"
  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
  value      = try(each.value.redis.REPLICATION_MODE, "master")
}

resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_TLS_ENABLED" {
  for_each   = { for key, value in var.kubernetes_input : key => value if value.redis != null && value.enabled == true }
  key        = "${each.key}__redis__TLS_ENABLED"
  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
  value      = try(each.value.redis.TLS_ENABLED, "no")
}

resource "kubernetes_secret_v1" "automatic-redis-secret" {
  for_each = { for key, value in var.kubernetes_input : key => value if value.redis != null && value.enabled == true }
  metadata {
    name      = "${each.key}-redis-terraform"
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
  }

  data = {
    REDIS_HOSTNAME         = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_host[each.key].value}"
    REDIS_PORT             = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_port[each.key].value}"
    REDIS_REPLICATION_MODE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_REPLICATION_MODE[each.key].value}"
    REDIS_TLS_ENABLED      = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_TLS_ENABLED[each.key].value}"
  }

}