# Workload authentication via SPIFFE JWT-SVIDs. The discovery document and
# JWKS contain public verification material, so this backend carries no secret.
resource "vault_jwt_auth_backend" "spire" {
  path               = "jwt-spire"
  description        = "SPIFFE JWT-SVID workload authentication"
  oidc_discovery_url = "https://spire-oidc.ad.ddupan.top"
  bound_issuer       = "https://spire-oidc.ad.ddupan.top"
}

# First end-to-end identity. Keep the subject exact: this role is deliberately
# not a wildcard escape hatch for every workload in the trust domain.
resource "vault_jwt_auth_backend_role" "spire_poc" {
  backend   = vault_jwt_auth_backend.spire.path
  role_name = "spire-poc"
  role_type = "jwt"

  user_claim      = "sub"
  bound_audiences = ["openbao"]
  bound_claims = {
    sub = "spiffe://ddupan.top/ns/spire-poc/sa/spire-jwt-poc"
  }

  token_policies          = [vault_policy.spire_poc.name]
  token_no_default_policy = true
  token_ttl               = 300
  token_max_ttl           = 900
}

# Local development on the laptop. Keep the subject exact: possession of any
# other identity in the trust domain must not grant interactive host access.
resource "vault_jwt_auth_backend_role" "local_development" {
  backend   = vault_jwt_auth_backend.spire.path
  role_name = "local-development"
  role_type = "jwt"

  user_claim      = "sub"
  bound_audiences = ["openbao"]
  bound_claims = {
    sub = "spiffe://ddupan.top/dev/panxiao81"
  }

  # local-development grants normal KV v2 read/write plus short-lived SSH
  # certificate signing; spire-poc only permits lookup and revocation of the
  # caller's own short-lived Bao token.
  token_policies = [
    vault_policy.local_development.name,
    vault_policy.spire_poc.name,
  ]
  token_no_default_policy = true
  token_ttl               = 300
  token_max_ttl           = 900
}