{ lib, config, ... }:
let
  cfg = config.khscodes.vault;
in
{
  options.khscodes.vault = {
    approle_auth_backend_role = lib.mkOption {
      type = lib.types.attrsOf (
        lib.khscodes.mkSubmodule {
          options = {
            backend = lib.mkOption {
              type = lib.types.str;
              description = "Path of the backend";
              default = "approle";
            };
            role_name = lib.mkOption {
              type = lib.types.str;
              description = "Name of the role";
            };
            secret_id_ttl = lib.mkOption {
              type = lib.types.int;
              description = "TTL for the secret id, in seconds";
            };
            secret_id_num_uses = lib.mkOption {
              type = lib.types.int;
              description = "Maximum number of uses per secret id";
            };
            token_ttl = lib.mkOption {
              type = lib.types.int;
              description = "TTL for the tokens issued, in seconds";
            };
            token_max_ttl = lib.mkOption {
              type = lib.types.int;
              description = "Max TTL for the tokens issued, in seconds";
            };
            token_policies = lib.mkOption {
              type = lib.types.listOf lib.types.str;
              description = "Policies attached to the backend role";
            };
          };
          description = "vault_approle_auth_backend_role";
        }
      );
      description = "Defines an app backend role";
      default = { };
    };
    approle_auth_backend_role_secret_id = lib.mkOption {
      type = lib.types.attrsOf (
        lib.khscodes.mkSubmodule {
          options = {
            backend = lib.mkOption {
              type = lib.types.str;
              description = "Path of the backend";
              default = "approle";
            };
            role_name = lib.mkOption {
              type = lib.types.str;
              description = "NThe name of the role to create the SecretID for";
            };
            cidr_list = lib.mkOption {
              type = lib.types.listOf lib.types.str;
              description = "If set, specifies blocks of IP addresses which can perform the login operation using this SecretID";
              default = [ ];
            };
            metadata = lib.mkOption {
              type = lib.types.attrsOf lib.types.str;
              description = "Metadata associated with tokens issued by this secret";
              default = { };
            };
            num_uses = lib.mkOption {
              type = lib.types.int;
              description = "Number of uses for the secret id";
              default = 300;
            };
            wrapping_ttl = lib.mkOption {
              type = lib.types.nullOr lib.types.int;
              description = "If set, the SecretID response will be response-wrapped and available for the duration specified. Only a single unwrapping of the token is allowed.";
              default = null;
            };
            with_wrapped_accessor = lib.mkOption {
              type = lib.types.bool;
              description = "Set to `true` to use the wrapped secret-id accessor as the resource ID. If `false` (default value), a fresh secret ID will be regenerated whenever the wrapping token is expired or invalidated through unwrapping.";
              default = false;
            };
            lifecycle.ignore_changes = lib.mkOption {
              type = lib.types.listOf lib.types.str;
              description = "Ignores changes to the following properties when rerunning the terraform script";
              default = [ ];
            };
          };
          description = "vault_approle_auth_backend_role_secret_id";
        }
      );
      description = "Defines an app backend role secret id";
      default = { };
    };
  };
  config = lib.mkIf cfg.enable {
    resource.vault_approle_auth_backend_role = lib.mapAttrs' (name: value: {
      name = lib.khscodes.sanitize-terraform-name name;
      value = value;
    }) cfg.approle_auth_backend_role;
    resource.vault_approle_auth_backend_role_secret_id = lib.mapAttrs' (name: value: {
      name = lib.khscodes.sanitize-terraform-name name;
      value = {
        inherit (value)
          backend
          role_name
          cidr_list
          wrapping_ttl
          num_uses
          with_wrapped_accessor
          lifecycle
          ;
        metadata = if value.metadata != null then builtins.toJSON value.metadata else null;
      };
    }) cfg.approle_auth_backend_role_secret_id;
  };
}
