# @summary Concourse local authentication
# @param users
#   List of local users.
# @param main_team_user
#   List of users which should be added to the "main" team.
# @param main_team_group
#   Ignored, but here to keep the same "API" with the other auth modules.
# @param ensure
class concourse::auth::local (
  Array[Struct[{
        'name'   => String,
        'password' => Variant[String, Sensitive[String]],
  }]] $users,
  Optional[Array[String]] $main_team_user = undef,
  Optional[Array[String]] $main_team_group = undef, # ignored
  Enum['absent', 'present'] $ensure = 'present',
) {
  $environment = {
    'CONCOURSE_ADD_LOCAL_USER'       => $users.map |$user| {
      $name = $user['name']
      $pass = $user['password'] ? {
        String  => $user['password'],
        default => $user['password'].unwrap,
      }
      "${name}:${pass}"
    }.join(','),
    'CONCOURSE_MAIN_TEAM_LOCAL_USER' => $main_team_group ? {
      Array   => $main_team_group.join(','),
      default => undef,
    },
  }

  concourse::conf::web { 'auth-local':
    ensure => $ensure,
    env    => $environment,
  }
}