data "azurerm_client_config" "current" {}

resource "azurerm_key_vault" "this" {
  name                       = local.key_vault_name
  location                   = var.cloud_region
  resource_group_name        = azurerm_resource_group.this.name
  tenant_id                  = data.azurerm_client_config.current.tenant_id
  sku_name                   = "standard"
  purge_protection_enabled   = false
  rbac_authorization_enabled = true
  tags                       = local.tags

  lifecycle {
    ignore_changes = [name]
  }
}

resource "azurerm_role_assignment" "current_secrets_officer" {
  scope                = azurerm_key_vault.this.id
  role_definition_name = "Key Vault Secrets Officer"
  principal_id         = data.azurerm_client_config.current.object_id
}

resource "null_resource" "wait_for_current_secrets_officer" {
  triggers = {
    key_vault_id = azurerm_key_vault.this.id
    principal_id = data.azurerm_client_config.current.object_id
    role_name    = azurerm_role_assignment.current_secrets_officer.role_definition_name
  }

  provisioner "local-exec" {
    command = "sleep 20"
  }
}

resource "azurerm_key_vault_secret" "admin" {
  name = local.admin_secret_name
  value = jsonencode({
    username = var.admin_username
    password = local.admin_password
  })
  key_vault_id = azurerm_key_vault.this.id
  tags         = local.tags

  depends_on = [
    azurerm_mysql_flexible_server.this,
    null_resource.wait_for_current_secrets_officer,
  ]
}

output "key_vault_name" {
  value = azurerm_key_vault.this.name
}

output "key_vault_id" {
  value = azurerm_key_vault.this.id
}

output "key_vault_uri" {
  value = azurerm_key_vault.this.vault_uri
}