// Key Vault permissions module - reusable for different roles and principals

@description('Key Vault name')
param keyVaultName string

@description('Principal ID for Key Vault access')
param principalId string

@description('Principal type (User, Group, ServicePrincipal)')
@allowed(['User', 'Group', 'ServicePrincipal'])
param principalType string = 'ServicePrincipal'

@description('Key Vault role to assign')
@allowed([
  'Key Vault Administrator'
  'Key Vault Certificates Officer'
  'Key Vault Crypto Officer'
  'Key Vault Crypto Service Encryption User'
  'Key Vault Crypto User'
  'Key Vault Reader'
  'Key Vault Secrets Officer'
  'Key Vault Secrets User'
])
param roleName string = 'Key Vault Secrets User'

var roleDefinitions = {
  // gitleaks:allow
  'Key Vault Administrator': '00482a5a-887f-4fb3-b363-3b7fe8e74483'
  'Key Vault Certificates Officer': 'a4417e6f-fecd-4de8-b567-7b0420556985'
  'Key Vault Crypto Officer': '14b46e9e-c2b7-41b4-b07b-48a6ebf60603'
  'Key Vault Crypto Service Encryption User': 'e147488a-f6f5-4113-8e2d-b22465e65bf6'
  // gitleaks:allow
  'Key Vault Crypto User': '12338af0-0e69-4776-bea7-57ae8d297424'
  // gitleaks:allow
  'Key Vault Reader': '21090545-7ca7-4776-b22c-e363652d74d2'
  // gitleaks:allow
  'Key Vault Secrets Officer': 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7'
  // gitleaks:allow
  'Key Vault Secrets User': '4633458b-17de-408a-b874-0445c86b69e6'
}

var roleDefinitionId = subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions[roleName])

resource keyVault 'Microsoft.KeyVault/vaults@2024-11-01' existing = {
  name: keyVaultName
}

resource keyVaultRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(keyVault.id, principalId, roleName)
  scope: keyVault
  properties: {
    roleDefinitionId: roleDefinitionId
    principalId: principalId
    principalType: principalType
  }
}

output roleAssignmentId string = keyVaultRoleAssignment.id
output roleAssignmentName string = keyVaultRoleAssignment.name