# @summary Concourse local authentication
# @param users
#   List of local users.
# @param main_team_users
#   List of users which should be added to the "main" team.
# @param main_team_group
#   Ignored, but here to keep the same "API" with the other auth modules.
class concourse::auth::local (
  Array[Struct[{
    'name'   => String,
    'password' => Variant[String, Sensitive[String]],
  }]] $users,
  Optional[Array[String]] $main_team_user,
  Optional[Array[String]] $main_team_group, # ignored
  Enum['absent', 'present'] $ensure = 'present',
) {
  $env_file = "${concourse::web::conf_dir}/auth-local"

  $environment = {
    'CONCOURSE_ADD_LOCAL_USER'       => $users.map |$user| {
      $name = $user['name']
      $pass = $user['password'] ? {
        String  => $user['password'],
        default => $user['password'].unwrap,
      }
      "${name}:${pass}"
    }.join(','),
    'CONCOURSE_MAIN_TEAM_LOCAL_USER' => $main_team_group ? {
      Array   => $main_team_group.join(','),
      default => undef,
    },
  }

  file { $env_file:
    ensure    => $ensure,
    content   => epp("${module_name}/env.epp", $environment),
    # To not show new password
    show_diff => false,
    mode      => '0600',
  }

  systemd::manage_dropin { 'concourse-local-auth':
    ensure        => $ensure,
    unit          => $concourse::web::service,
    service_entry => {
      'EnvironmentFile' => $env_file,
    },
  }
}