# Outputs feed two things: the SOPS re-point of consumer secrets (§3.2, §6.9)
# and the machine-key handoff to each agent workload (§5.3). Every value that can
# authenticate a client is marked sensitive, so `terraform output` prints a
# placeholder until you ask for it explicitly.

output "org_id" {
  description = "Organization that owns the project, roles and applications."
  value       = data.zitadel_org.default.id
}

output "project_id" {
  description = "Project ID, which ZITADEL puts in the access-token `aud` claim."
  value       = zitadel_project_v2.homelab.id
}

output "client_ids" {
  description = "client_id per consumer. Compare against the Authentik values: any difference means the consumer config must change too."
  value       = { for name, app in zitadel_application_v2.oidc : name => app.oidc[0].client_id }
}

output "client_secrets" {
  description = "Generated client secret per consumer. Write these into the existing SOPS files; never into git."
  value       = { for name, app in zitadel_application_v2.oidc : name => app.oidc[0].client_secret }
  sensitive   = true
}

output "api_app_client_ids" {
  description = "client_id of each API application (machine-token surface)."
  value       = { for name, app in zitadel_application_api.machine : name => app.client_id }
}

output "machine_user_ids" {
  description = "ZITADEL user ID per machine user."
  value       = { for name, user in zitadel_machine_user.agent : name => user.id }
}

output "machine_keys" {
  description = "JWT profile key JSON per machine user. Mount as a file; do not pass through the environment."
  value       = { for name, key in zitadel_machine_key.agent : name => key.key_details }
  sensitive   = true
}

output "groups_claim_enabled" {
  description = "Whether the groups-claim action and its triggers exist. False means Option A is not yet in place and no consumer may move."
  value       = var.enable_groups_claim_action
}