# M2M secrets are not populated on dev and contain dummy values.
# There is no m2m secret rotation lambda on dev, so regular secrets are used to fake them.
# They must exist so the app does not fail when attempting to read them.

locals {
  secrets = flatten([for m in var.machine_names : [
    {
      service_name = "${var.machine_name_prefix}-${m}"
      secret_name  = "M2M_JWT_ACCESS_TOKEN"
      secret_map = {
        expires_at                    = "1970-01-01 00:00:00.000000+0000"
        token                         = "dummy"
        client_credentials_secret_arn = "${var.environment}/${var.machine_name_prefix}-${m}/M2M_AUTH0_CLIENT_CREDENTIALS"
      }
    },
    {
      service_name = "${var.machine_name_prefix}-${m}"
      secret_name  = "M2M_AUTH0_CLIENT_CREDENTIALS"
      secret_map = {
        audience      = "https://dummy.foo"
        client_id     = "dummy"
        client_secret = "dummy"
        grant_type    = "dummy"
      }
    },
  ]])
}

module "m2m_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.3"
  for_each = { for s in local.secrets : "${s.service_name}/${s.secret_name}" => s }

  environment        = var.environment
  service_name       = each.value.service_name
  application_family = var.platform_application_family
  secret_name        = each.value.secret_name
  secret_map         = each.value.secret_map
}