{ config, lib, ... }:
let
  cfg = config.khscodes.vault;
in
{
  options.khscodes.vault = {
    output = {
      approle_auth_backend_role = lib.mkOption {
        type = lib.types.attrsOf (
          lib.khscodes.mkSubmodule {
            options = {
              role_name = lib.mkOption {
                type = lib.types.str;
                description = "The name of the role. Can be used instead of hardcoding the role, to create a dependency in OpenTofu";
              };
              role_id = lib.mkOption {
                type = lib.types.str;
                description = "ID of the role";
              };
            };
            description = "vault_approle_auth_backend_role output";
          }
        );
      };
      approle_auth_backend_role_secret_id = lib.mkOption {
        type = lib.types.attrsOf (
          lib.khscodes.mkSubmodule {
            options = {
              wrapping_token = lib.mkOption {
                type = lib.types.str;
                description = "The generated wrapping token";
              };
            };
            description = "vault_approle_auth_backend_role_secret_id";
          }
        );
      };
      mount = lib.mkOption {
        type = lib.types.attrsOf (
          lib.khscodes.mkSubmodule {
            options = {
              path = lib.mkOption {
                type = lib.types.str;
                description = "The path of the mount, this is here mainly to set up dependencies";
              };
            };
            description = "vault_mount output";
          }
        );
      };
    };
  };
  config = {
    khscodes.vault.output.approle_auth_backend_role = lib.mapAttrs (
      name: value:
      let
        sanitizedName = lib.khscodes.sanitize-terraform-name name;
      in
      {
        role_name = "\${ vault_approle_auth_backend_role.${sanitizedName}.role_name }";
        role_id = "\${ vault_approle_auth_backend_role.${sanitizedName}.role_id }";
      }
    ) cfg.approle_auth_backend_role;
    khscodes.vault.output.approle_auth_backend_role_secret_id = lib.mapAttrs (
      name: value:
      let
        sanitizedName = lib.khscodes.sanitize-terraform-name name;
      in
      {
        wrapping_token = "\${ vault_approle_auth_backend_role_secret_id.${sanitizedName}.wrapping_token }";
      }
    ) cfg.approle_auth_backend_role_secret_id;
    khscodes.vault.output.mount = lib.mapAttrs (
      name: value:
      let
        sanitizedName = lib.khscodes.sanitize-terraform-name name;
      in
      {
        path = "\${ vault_mount.${sanitizedName}.path }";
      }
    ) cfg.mount;
  };
}
