locals {
  source_secret_names = [
    "${var.env}-o11y-auth0-client",
    "${var.env}-proxy-auth0-client",
  ]
  source_controlplane_resource_group = "${var.env}-${var.source_region}-controlplane"
  copy_source_secrets                = var.source_region != ""
  source_secret_set                  = local.copy_source_secrets ? toset(local.source_secret_names) : toset([])
}

data "azurerm_resources" "source_key_vaults" {
  count = local.copy_source_secrets ? 1 : 0

  resource_group_name = local.source_controlplane_resource_group
  type                = "Microsoft.KeyVault/vaults"

  lifecycle {
    postcondition {
      condition     = length(self.resources) == 1
      error_message = "Expected exactly one Key Vault in resource group ${local.source_controlplane_resource_group}."
    }
  }
}

data "azurerm_key_vault" "source" {
  count = local.copy_source_secrets ? 1 : 0

  name                = data.azurerm_resources.source_key_vaults[0].resources[0].name
  resource_group_name = local.source_controlplane_resource_group
}

data "azurerm_key_vault_secret" "source" {
  for_each = local.source_secret_set

  name         = each.key
  key_vault_id = data.azurerm_key_vault.source[0].id
}

resource "azurerm_key_vault_secret" "copied" {
  for_each = local.source_secret_set

  name         = each.key
  value        = data.azurerm_key_vault_secret.source[each.key].value
  key_vault_id = azurerm_key_vault.this.id
  tags         = local.tags

  depends_on = [null_resource.wait_for_current_secrets_officer]
}