// The consumer credential is generated by OVHcloud (server side password)
// and delivered only through Vault, never through outputs or the user body.
// The Vault entry follows the existing contract:
//   secret/{provider}/{cloud_account}/{requester_unique_id}/{username}
// Only the Vault path of the entry is exposed as an output. There is no
// admin sibling entry: day 2 credential renewal follows the same Terraform
// rotation flow as the other catalog modules (the renewal workflow rewrites
// a rotation marker next to the deployment script and the apply regenerates
// the password, republishing this entry); the rotation marker input is
// added by the credential renewal ticket.

locals {
  database_host = one([for e in ovh_cloud_project_database.this.endpoints : e.domain if e.component == "postgresql"])
  database_port = one([for e in ovh_cloud_project_database.this.endpoints : e.port if e.component == "postgresql"])
}

resource "vault_kv_secret_v2" "consumer" {
  mount = "secret"
  name  = "ovh/${var.cloud_account}/${var.requester_unique_id}/${var.username}"
  data_json = jsonencode({
    username = ovh_cloud_project_database_postgresql_user.this.name
    password = ovh_cloud_project_database_postgresql_user.this.password
    host     = local.database_host
    port     = local.database_port
    database = ovh_cloud_project_database_database.this.name
    uri      = "postgres://${ovh_cloud_project_database_postgresql_user.this.name}:${ovh_cloud_project_database_postgresql_user.this.password}@${local.database_host}:${local.database_port}/${ovh_cloud_project_database_database.this.name}?sslmode=require"
  })
}