# Non-secret SSM configuration only. SecureString parameters are intentionally
# owned by the external secret lifecycle so provider refresh cannot decrypt
# their values into Terraform state.

resource "aws_ssm_parameter" "app_env" {
  name = "/${var.project}/${var.environment}/APP_ENV"
  type = "String"
  # Runtime uses the literal "production" for production-only safety gates;
  # the infrastructure label remains the shorter "prod" elsewhere.
  value = var.environment == "prod" ? "production" : var.environment

}

resource "aws_ssm_parameter" "auth_password_login_enabled" {
  name  = "/${var.project}/${var.environment}/AUTH_PASSWORD_LOGIN_ENABLED"
  type  = "String"
  value = "false"

}

resource "aws_ssm_parameter" "cors_origins" {
  name  = "/${var.project}/${var.environment}/CORS_ORIGINS"
  type  = "String"
  value = jsonencode(["https://${var.domain_name}"])

}

resource "aws_ssm_parameter" "successfactors_base_url" {
  name  = "/${var.project}/${var.environment}/SUCCESSFACTORS_BASE_URL"
  type  = "String"
  value = "https://api15.sapsf.cn/odata/v2"

}