variable "ci_database_bound_claims" {
  description = "Exact repository, protected-ref, and database-job claims for the database role."
  type        = map(string)
  default     = {}
}

variable "ci_jwt_bound_audiences" {
  description = "Exact CI JWT audiences."
  type        = set(string)
  default     = []
}

variable "ci_jwt_bound_issuer" {
  description = "Expected CI JWT issuer."
  type        = string
  default     = null
  nullable    = true
}

variable "ci_jwt_oidc_discovery_url" {
  description = "CI OIDC discovery URL. Null leaves external CI authentication disabled."
  type        = string
  default     = null
  nullable    = true
}

variable "ci_jwt_user_claim" {
  description = "JWT claim used as the Vault identity alias."
  type        = string
  default     = "sub"
}

variable "ci_token_ttl_seconds" {
  description = "Maximum lifetime for delegated CI tokens."
  type        = number
  default     = 1800

  validation {
    condition = (
      var.ci_token_ttl_seconds >= 60 &&
      var.ci_token_ttl_seconds <= 3600 &&
      floor(var.ci_token_ttl_seconds) == var.ci_token_ttl_seconds
    )
    error_message = "ci_token_ttl_seconds must be a whole number between 60 and 3600."
  }
}

variable "ci_workloads_bound_claims" {
  description = "Exact repository, protected-ref, and workloads-job claims for the workloads role."
  type        = map(string)
  default     = {}
}

variable "kubernetes_host" {
  description = "Kubernetes TokenReview API address."
  type        = string
  default     = "https://kubernetes.default.svc.cluster.local:443"
}

variable "vault_addr" {
  description = "Vault API address reachable by the foundation operator."
  type        = string
  default     = "http://127.0.0.1:8200"
}

variable "vault_token" {
  description = "Short-lived bootstrap or security-administrator token."
  type        = string
  sensitive   = true
  ephemeral   = true
}