# Read the OAuth client secret from Vault so nothing sensitive is committed.
data "vault_kv_secret_v2" "keycloakoidc" {
  count = var.keycloakoidc != null && var.keycloakoidc.client_secret_vault != null ? 1 : 0
  mount = var.keycloakoidc.client_secret_vault.mount
  name  = var.keycloakoidc.client_secret_vault.path
}

# Rancher's Keycloak(OIDC) auth provider, pointed at Authentik. access_mode
# "unrestricted" means any authenticated Authentik user can log in; Rancher
# roles are granted to users/groups separately (avoids admin lockout on enable).
resource "rancher2_auth_config_keycloak_oidc" "this" {
  count = var.keycloakoidc != null ? 1 : 0

  rancher_url   = var.keycloakoidc.rancher_url
  client_id     = var.keycloakoidc.client_id
  client_secret = data.vault_kv_secret_v2.keycloakoidc[0].data["client_secret"]
  issuer        = var.keycloakoidc.issuer
  auth_endpoint = var.keycloakoidc.auth_endpoint
  scopes        = var.keycloakoidc.scopes
  access_mode   = var.keycloakoidc.access_mode
  enabled       = var.keycloakoidc.enabled
}