# Session secret for the real account service (PRD #571 account unification).
#
# The account service's config loader requires a `server.secret` block: at
# startup it fetches this AWS Secrets Manager secret and merges the YAML into
# its config, and the same block's region drives the account KMS KeyService.
# Terraform creates a session-owned, tag-scoped, reaper-cleanable placeholder;
# the dev-full apply script later fills it from the rendered account config plus
# the shared Auth0 Management M2M secret. Keeping the runtime reference pointed
# at this session secret avoids feeding account-central a partial shared secret:
# the current account merge path can otherwise clear required `server` fields.
# It reuses the metadb gate because the account service ships with the same
# Dev full persona surface that enables the premium-metadb resource.
resource "aws_secretsmanager_secret" "account" {
  count = local.metadb_enabled ? 1 : 0

  name                    = "cp9/${local.session_name}/account"
  description             = "cp9 ${local.session_name} account service config overrides"
  recovery_window_in_days = 0

  tags = merge(local.common_tags, {
    Name = "cp9-${local.session_name}-account"
  })
}

resource "aws_secretsmanager_secret_version" "account" {
  count = local.metadb_enabled ? 1 : 0

  secret_id     = aws_secretsmanager_secret.account[0].id
  secret_string = "{}\n"
}