# @summary Concourse local authentication
# @param users
#   List of local users.
# @param main_team_user
#   List of users which should be added to the "main" team.
# @param main_team_group
#   Ignored, but here to keep the same "API" with the other auth modules.
# @param ensure
class concourse::auth::local (
  Array[Struct[{
        'name'   => String,
        'password' => Variant[String, Sensitive[String]],
  }]] $users,
  Optional[Array[String]] $main_team_user = undef,
  Optional[Array[String]] $main_team_group = undef, # ignored
  Enum['absent', 'present'] $ensure = 'present',
) {
  $env_file = "${concourse::web::conf_dir}/auth-local"

  $environment = {
    'CONCOURSE_ADD_LOCAL_USER'       => $users.map |$user| {
      $name = $user['name']
      $pass = $user['password'] ? {
        String  => $user['password'],
        default => $user['password'].unwrap,
      }
      "${name}:${pass}"
    }.join(','),
    'CONCOURSE_MAIN_TEAM_LOCAL_USER' => $main_team_group ? {
      Array   => $main_team_group.join(','),
      default => undef,
    },
  }

  file { $env_file:
    ensure    => $ensure,
    content   => epp("${module_name}/env.epp", { 'entries' => $environment }),
    # To not show new password
    show_diff => false,
    mode      => '0600',
  }

  $dropin_content = @("EOF")
    [Service]
    EnvironmentFile=${env_file}
    | EOF

  systemd::dropin_file { 'concourse-local-auth.conf':
    ensure  => $ensure,
    unit    => $concourse::web::service_unit,
    content => $dropin_content,
  }
}