locals {
  quay_personas = {
    candidates-bot = {
      display_name = "Quay Candidates Bot"
      email        = "candidates-bot@quorate.dev"
      last_name    = "Candidates"
    }
    mirror-bot = {
      display_name = "Quay Mirror Bot"
      email        = "mirror-bot@quorate.dev"
      last_name    = "Mirror"
    }
  }
}

ephemeral "vault_kv_secret_v2" "quay_persona" {
  for_each = local.quay_personas

  mount = var.vault_kv_mount
  name  = "quay/personas/${each.key}"
}

resource "zitadel_human_user" "quay_persona" {
  for_each = local.quay_personas

  org_id                       = zitadel_org.primary.id
  user_name                    = each.key
  first_name                   = "Quay"
  last_name                    = each.value.last_name
  display_name                 = each.value.display_name
  email                        = each.value.email
  is_email_verified            = true
  initial_password             = ephemeral.vault_kv_secret_v2.quay_persona[each.key].data["password"]
  initial_skip_password_change = true
}

resource "zitadel_user_grant" "quay_persona" {
  for_each = local.quay_personas

  org_id     = zitadel_org.primary.id
  project_id = zitadel_project.services.id
  user_id    = zitadel_human_user.quay_persona[each.key].id
  role_keys  = ["quay_user"]

  depends_on = [zitadel_project_role.quay]
}