resource "aws_ssm_parameter" "tidb_host" {
  name  = "/${local.name_prefix}/TIDB_HOST"
  type  = "String"
  value = var.tidb_host
}

resource "aws_ssm_parameter" "tidb_port" {
  name  = "/${local.name_prefix}/TIDB_PORT"
  type  = "String"
  value = var.tidb_port
}

resource "aws_ssm_parameter" "tidb_user" {
  name  = "/${local.name_prefix}/TIDB_USER"
  type  = "String"
  value = var.tidb_user
}

resource "aws_ssm_parameter" "tidb_password" {
  name  = "/${local.name_prefix}/TIDB_PASSWORD"
  type  = "SecureString"
  value = var.tidb_password
}

resource "aws_ssm_parameter" "tidb_database" {
  name  = "/${local.name_prefix}/TIDB_DATABASE"
  type  = "String"
  value = var.tidb_database
}

resource "aws_ssm_parameter" "jwt_secret" {
  name  = "/${local.name_prefix}/JWT_SECRET"
  type  = "SecureString"
  value = var.jwt_secret
}

resource "aws_ssm_parameter" "admin_password" {
  name      = "/${local.name_prefix}/NEXUS_ADMIN_PASSWORD"
  type      = "SecureString"
  value     = var.admin_password
  overwrite = true
}

resource "aws_ssm_parameter" "google_client_id" {
  count = var.google_client_id != "" ? 1 : 0
  name  = "/${local.name_prefix}/GOOGLE_CLIENT_ID"
  type  = "String"
  value = var.google_client_id
}

resource "aws_ssm_parameter" "google_client_secret" {
  count = var.google_client_id != "" ? 1 : 0
  name  = "/${local.name_prefix}/GOOGLE_CLIENT_SECRET"
  type  = "SecureString"
  value = var.google_client_secret
}

resource "aws_ssm_parameter" "tidb_cloud_public_key" {
  count = var.tidb_cloud_public_key != "" ? 1 : 0
  name  = "/${local.name_prefix}/TIDB_CLOUD_PUBLIC_KEY"
  type  = "SecureString"
  value = var.tidb_cloud_public_key
}

resource "aws_ssm_parameter" "tidb_cloud_private_key" {
  count = var.tidb_cloud_private_key != "" ? 1 : 0
  name  = "/${local.name_prefix}/TIDB_CLOUD_PRIVATE_KEY"
  type  = "SecureString"
  value = var.tidb_cloud_private_key
}

# ── SMTP / SES credentials (when smtp_ses_domain is set) ─────────────────

resource "aws_ssm_parameter" "smtp_host" {
  count = var.smtp_ses_domain != "" ? 1 : 0
  name  = "/${local.name_prefix}/SMTP_HOST"
  type  = "String"
  value = "email-smtp.${var.aws_region}.amazonaws.com"
}

resource "aws_ssm_parameter" "smtp_port" {
  count = var.smtp_ses_domain != "" ? 1 : 0
  name  = "/${local.name_prefix}/SMTP_PORT"
  type  = "String"
  value = "587"
}

resource "aws_ssm_parameter" "smtp_user" {
  count = var.smtp_ses_domain != "" ? 1 : 0
  name  = "/${local.name_prefix}/SMTP_USER"
  type  = "String"
  value = local.ses_smtp_access_key
}

resource "aws_ssm_parameter" "smtp_password" {
  count = var.smtp_ses_domain != "" ? 1 : 0
  name  = "/${local.name_prefix}/SMTP_PASSWORD"
  type  = "SecureString"
  value = local.ses_smtp_password

  lifecycle { ignore_changes = [value] }
}

resource "aws_ssm_parameter" "smtp_from" {
  count = var.smtp_ses_domain != "" ? 1 : 0
  name  = "/${local.name_prefix}/SMTP_FROM"
  type  = "String"
  value = var.smtp_from_address
}

resource "aws_ssm_parameter" "smtp_tls" {
  count = var.smtp_ses_domain != "" ? 1 : 0
  name  = "/${local.name_prefix}/SMTP_TLS"
  type  = "String"
  value = "true"
}

# ── Staging branch credentials (managed by staging-db-refresh workflow) ──
# These parameters are created with initial values from the main cluster,
# then overwritten by the refresh workflow after each branch reset.
# lifecycle { ignore_changes } prevents terraform apply from reverting them.

resource "aws_ssm_parameter" "tidb_branch_host" {
  count = var.environment == "staging" ? 1 : 0
  name  = "/${local.name_prefix}/TIDB_BRANCH_HOST"
  type  = "String"
  value = var.tidb_host

  lifecycle { ignore_changes = [value] }
}

resource "aws_ssm_parameter" "tidb_branch_user" {
  count = var.environment == "staging" ? 1 : 0
  name  = "/${local.name_prefix}/TIDB_BRANCH_USER"
  type  = "String"
  value = var.tidb_user

  lifecycle { ignore_changes = [value] }
}

resource "aws_ssm_parameter" "tidb_branch_password" {
  count = var.environment == "staging" ? 1 : 0
  name  = "/${local.name_prefix}/TIDB_BRANCH_PASSWORD"
  type  = "SecureString"
  value = var.tidb_password

  lifecycle { ignore_changes = [value] }
}