terraform {
  required_version = ">= 1.11.0"

  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "~> 5.7.0"
    }
  }

  backend "s3" {}
}

provider "vault" {
  address          = var.vault_addr
  skip_child_token = true
  token            = var.vault_token
}

moved {
  from = vault_database_secret_backend_connection.platform_postgres
  to   = vault_database_secret_backend_connection.auth_system_postgres
}

removed {
  from = vault_database_secret_backend_role.postgres_operator

  lifecycle {
    destroy = false
  }
}

locals {
  database_config_name = "auth-system-postgres-dev"
  database_mount_path  = "database"
  migration_role_name  = "auth-db-migration-dev"

  creation_statements = [
    <<-EOT
    CREATE ROLE "{{name}}" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';
    GRANT "${var.auth_db_role}" TO "{{name}}";
    EOT
  ]

  revocation_statements = [
    <<-EOT
    REASSIGN OWNED BY "{{name}}" TO "${var.auth_db_role}";
    DROP OWNED BY "{{name}}";
    REVOKE "${var.auth_db_role}" FROM "{{name}}";
    DROP ROLE IF EXISTS "{{name}}";
    EOT
  ]
}

resource "vault_database_secret_backend_connection" "auth_system_postgres" {
  allowed_roles     = [local.migration_role_name]
  backend           = local.database_mount_path
  name              = local.database_config_name
  plugin_name       = "postgresql-database-plugin"
  verify_connection = true

  postgresql {
    connection_url          = "postgresql://{{username}}:{{password}}@${var.postgres_host}:${var.postgres_port}/${var.postgres_database}?sslmode=${var.postgres_sslmode}"
    password_authentication = "scram-sha-256"
    password_wo             = var.postgres_admin_password
    password_wo_version     = var.postgres_admin_password_version
    username                = var.postgres_admin_username
  }

  lifecycle {
    create_before_destroy = true
  }
}

resource "vault_database_secret_backend_role" "auth_db_migration" {
  backend               = local.database_mount_path
  creation_statements   = local.creation_statements
  db_name               = vault_database_secret_backend_connection.auth_system_postgres.name
  default_ttl           = var.auth_db_migration_default_ttl_seconds
  max_ttl               = var.auth_db_migration_max_ttl_seconds
  name                  = local.migration_role_name
  revocation_statements = local.revocation_statements
}