# API applications — the machine-token surface.
#
# ZITADEL keeps two different objects apart: an OIDC application is for a
# browser flow, and an API application is what a client_credentials / JWT-profile
# caller presents. Authentik modelled both with one provider, so the plan §1.1
# row 1 ("OIDC app + machine user") needs one of each here.
#
# The gateway signs its token request with the machine key from machines.tf, so
# the auth method is PRIVATE_KEY_JWT. No secret is stored for it.

resource "zitadel_application_api" "machine" {
  for_each = { for name, spec in local.machine_users : name => spec if contains(keys(var.api_app_consumers), name) }

  org_id           = data.zitadel_org.default.id
  project_id       = zitadel_project_v2.homelab.id
  name             = "${each.key}-machine"
  auth_method_type = "API_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT"
}