variable "host_identifier" {
  description = "Limit to hosts matching where user is connecting from. If not overwritten using % here, provider will set it to localhost"
  type        = string
  default     = "%"
}

variable "database_name" {
  description = "The custom database for MySQL resources"
  type        = string
  default     = "*"
}

variable "auth_plugin" {
  description = "Supported plugins are AWSAuthenticationPlugin and caching_sha2_password. caching_sha2_password is the default for MySQL 8.0."
  default     = "caching_sha2_password"
}

variable "read_only_role_privileges" {
  description = "Privileges for the read-only role"
  type        = list(string)
  default = [
    "SELECT",
    "SHOW VIEW",
    "USAGE"
  ]
}

variable "roles" {
  description = "List of roles"
  type        = list(string)
  default     = [
    "read_only_role",
    "read_write_role"
  ]
}

variable "read_only_users" {
  description = "A list of read-only MySQL users and their passwords"
  type = list(object({
    user               = string
    auth_plugin        = string
    host_identifier    = optional(string)
  }))
  default = []
}

variable "read_write_role_privileges" {
  description = "Privileges for the read-write role"
  type        = list(string)
  default = [
    "SELECT",
    "SHOW VIEW",
    "INSERT",
    "UPDATE",
    "USAGE",
    "DELETE"
  ]
}

variable "read_write_users" {
  description = "A list of read-write MySQL users and their passwords"
  type = list(object({
    user            = string
    auth_plugin     = string
    host_identifier = optional(string)
  }))
  default = []
}

variable "custom_roles" {
  type = map(object({
    name       = string
    privileges = list(string)
  }))
  default = {}
}

variable "custom_role_users" {
  description = "A list of custom role MySQL users and their passwords"
  type = list(object({
    user            = string
    auth_plugin     = string
    host_identifier = optional(string)
    roles           = list(string) # List of custom roles assigned to the user
  }))
  default = []
}

variable "tls_option_enforced" {
  description = "TLS option to enforce for non AWSAuthenticationPlugin users"
  type        = string
  default     = "NONE"
}