variable "environment" {
  description = "Name of the environment, e.g. dev, qa, prod"
  type        = string
  default     = "dev"
}

variable "service_name" {
  description = "Name of the service, e.g. ows-service"
  type        = string
}

variable "secret_name" {
  description = "Name of the secret, minus environment and service name prefixes, e.g. DATABASE_PASSWORD"
  type        = string
}

variable "application_family" {
  description = "Value for application_family tag. An application_family should be inclusive of several services, owned by a group."
  type        = string
}

variable "additional_tags" {
  type        = map(string)
  description = "Optional map of additional tags to set on resources. These will be combined with programmatically set required tags."
  default     = {}
}

# Customization and override options
variable "custom_kms_key_enabled" {
  description = "Whether or not to use a secret-specific KMS key. There should generally be a good reason for doing this."
  type        = bool
  default     = false
}

variable "custom_secret_description" {
  description = "Custom secret description. Set to override the default value, which matches the secret name"
  type        = string
  default     = ""
}

variable "secret_recovery_window_in_days" {
  description = "How long to wait before secret is deleted. Valid options are 0 to delete immediately, or 7-30"
  type        = number
  default     = 30
}

variable "secret_map" {
  description = "If secret is json, set a map here to be json-encoded. Generally, this should be a placeholder value changed out of band."
  type        = map(string)
  default     = {}
}

variable "secret_string" {
  description = "If secret is a plaintext string, set it here. Generally, this should be a placeholder value changed out of band."
  type        = string
  default     = "dummy"
}

variable "version_stages" {
  description = "List of version stages for the secret"
  type        = list(string)
  default = [
    "TERRAFORMED",
  ]
}

# Replication settings
variable "secret_replication_regions" {
  description = "Additional regions to which the secret will be replicated."
  type        = list(string)
  default     = []
}

# Rotation settings
variable "secret_rotation_enabled" {
  description = "Whether or not secret rotation is enabled. If set to true, var.secret_rotation_lambda_arn must also be set"
  type        = bool
  default     = false
}

variable "secret_rotation_rotate_immediately" {
  description = "Whether or not secret rotation should occur immediately."
  type        = bool
  default     = true
}

variable "secret_rotation_lambda_arn" {
  description = "ARN of lambda used for rotating secret"
  type        = string
  default     = ""
}

variable "secret_rotation_interval_in_days" {
  description = "Interval in days at which secret rotation will occur. Set only one of this variable or secret_rotation_schedule_expression"
  type        = number
  default     = null
}

variable "secret_rotation_schedule_expression" {
  description = "Interval at which secret rotation will occur. Set only one of this variable or secret_rotation_interval_in_days. Use cron() or rate() syntax. Shortest supported interval is every 4 hours."
  type        = string
  default     = null
}

variable "secret_rotation_window_duration" {
  description = <<EOH
  The length of the secret rotation window in hours.

  Automatic Secret rotation is an asynchronous process. Secrets Manager will rotate the secret
  anytime within the rotation window. You can consider this like a maintenance window - 
  if the rotation is not done within the window, it will not be done until the next time
  the secret is scheduled to be rotated.

  When null is specified, Secrets Manager will consider it a default window of 1 hour.
  EOH
  type        = string
  default     = null
}

variable "secret_rotation_lambda_permission" {
  description = "Indicate whether to configure aws_lambda_permission.allow_secrets_manager_invocation"
  type        = bool
  default     = true
}

locals {
  # Concatenate required and user-supplied tags
  combined_resource_tags = merge(
    {
      environment        = var.environment
      service_name       = var.service_name
      application_family = var.application_family
      terraformed        = "true"
    },
    var.additional_tags
  )
}