variables.tf

## ---------------------------------------------------------------------------
## terraform-bigip-ltm-persistence-profile-cookie — variables.tf
##
## One-to-one mapping against the live F5Networks/bigip v1.28.0 provider schema
## for `bigip_ltm_persistence_profile_cookie` (verified against the rendered
## Terraform Registry doc, cross-checked against
## `terraform providers schema -json` because the rendered doc page has three
## discrepancies against the live schema:
## 1. `app_service` is present in the live schema (string, optional) but is
## entirely absent from the rendered Argument Reference — added here from
## the schema fallback, described consistently with the same attribute on
## terraform-bigip-ltm-profile-http / terraform-bigip-net-ike-peer.
## 2. The rendered doc's `name` description reads "Name of the virtual
## address" — a copy/paste artifact from an unrelated resource's doc
## page. The live schema's own description ("Name of the persistence
## profile") is used instead.
## 3. The rendered doc's `timeout` entry is prefixed "(enabled or disabled)"
## even though the field is a numeric second count (the doc's own Example
## Usage sets `timeout = 3600`, and the live schema types it `number`).
## The parenthetical is a copy/paste artifact from the surrounding
## enabled/disabled fields; `timeout` is typed `number` here.
##
## Every other optional field in the live schema is Optional+Computed with no
## literal provider-side default documented anywhere (rendered doc or schema).
## Consistent with this catalog's existing precedent for Optional+Computed
## fields with no documented default (e.g. terraform-bigip-ltm-monitor's
## `time_until_up`, terraform-bigip-ltm-profile-http's `accept_xff`), those fields
## default to `null` here rather than this module inventing a value the
## provider itself does not commit to — BIG-IP computes its own effective
## value (frequently inherited from the `defaults_from` parent profile) when
## the field is left unset.
##
## Universal tail: none. BIG-IP persistence profiles carry no tagging concept
## and this resource's live schema exposes no `timeouts {}` block, so neither
## is added here.
## ---------------------------------------------------------------------------

variable "name" {
 description = <<-EOT
 Required. Name of the cookie persistence profile, expressed as a BIG-IP
 full path (partition + name), e.g. "/Common/my-cookie-persistence".
 BIG-IP addresses this object by full path, not a numeric id, so `name` is
 the practical cross-reference key consumed by
 terraform-bigip-ltm-virtual-server's persistence-profile inputs.

 IMMUTABLE (full-path identity): moving this profile to a different
 partition, or renaming it, forces destroy/recreate rather than an
 in-place update.
 EOT
 type = string
 nullable = false
}

variable "defaults_from" {
 description = <<-EOT
 Required. Full path of the parent cookie persistence profile this profile
 inherits its initial values from, e.g. "/Common/cookie". No provider-side
 default — the provider requires an explicit parent for every persistence
 profile.
 EOT
 type = string
 nullable = false
}

variable "match_across_pools" {
 description = <<-EOT
 Optional ("enabled" or "disabled"). Whether the system matches an
 existing persistence record across all pools serving the same virtual
 server, rather than only the pool the connection was originally
 persisted to. No literal provider default is documented (Optional+
 Computed in the live schema); left unset so the `defaults_from` parent
 profile's own value applies. Closed set enforced via validation{}.
 EOT
 type = string
 default = null

 validation {
 condition = var.match_across_pools == null ? true: contains(["enabled", "disabled"], var.match_across_pools)
 error_message = "var.match_across_pools must be one of: enabled, disabled."
 }
}

variable "match_across_services" {
 description = <<-EOT
 Optional ("enabled" or "disabled"). Whether the system matches an
 existing persistence record across all services (virtual servers)
 sharing the same destination address. No literal provider default is
 documented; left unset so the `defaults_from` parent profile's own value
 applies. Closed set enforced via validation{}.
 EOT
 type = string
 default = null

 validation {
 condition = var.match_across_services == null ? true: contains(["enabled", "disabled"], var.match_across_services)
 error_message = "var.match_across_services must be one of: enabled, disabled."
 }
}

variable "match_across_virtuals" {
 description = <<-EOT
 Optional ("enabled" or "disabled"). Whether the system matches an
 existing persistence record across all virtual servers with the same
 destination address, regardless of the destination port. No literal
 provider default is documented; left unset so the `defaults_from` parent
 profile's own value applies. Closed set enforced via validation{}.
 EOT
 type = string
 default = null

 validation {
 condition = var.match_across_virtuals == null ? true: contains(["enabled", "disabled"], var.match_across_virtuals)
 error_message = "var.match_across_virtuals must be one of: enabled, disabled."
 }
}

variable "mirror" {
 description = <<-EOT
 Optional ("enabled" or "disabled"). Whether the system mirrors this
 profile's persistence records to the high-availability peer unit. No
 literal provider default is documented; left unset so the
 `defaults_from` parent profile's own value applies. Closed set enforced
 via validation{}.
 EOT
 type = string
 default = null

 validation {
 condition = var.mirror == null ? true: contains(["enabled", "disabled"], var.mirror)
 error_message = "var.mirror must be one of: enabled, disabled."
 }
}

variable "override_conn_limit" {
 description = <<-EOT
 Optional ("enabled" or "disabled"). Whether pool member connection limits
 are overridden for persisted clients; per-virtual connection limits
 remain hard limits and are not overridden. No literal provider default is
 documented; left unset so the `defaults_from` parent profile's own value
 applies. Closed set enforced via validation{}.

 Security note: enabling this allows a persisted client to exceed a pool
 member's configured `connection_limit` — treat as a deliberate capacity
 decision, not a default to enable casually (see this module suite's
 "Persistence / connection limits" secure-default guidance).
 EOT
 type = string
 default = null

 validation {
 condition = var.override_conn_limit == null ? true: contains(["enabled", "disabled"], var.override_conn_limit)
 error_message = "var.override_conn_limit must be one of: enabled, disabled."
 }
}

variable "timeout" {
 description = <<-EOT
 Optional. Timeout for persistence of the session, in seconds. Typed as a
 number per the live provider schema (the rendered Terraform Registry doc
 page's "(enabled or disabled)" prefix on this field is a copy/paste
 artifact from surrounding fields — see the file header note). No literal
 provider default is documented (Optional+Computed); left unset so the
 `defaults_from` parent profile's own value applies.
 EOT
 type = number
 default = null
}

variable "always_send" {
 description = <<-EOT
 Optional ("enabled" or "disabled"). Whether the system sends a cookie for
 every response, not only when a new persistence record is created. No
 literal provider default is documented; left unset so the
 `defaults_from` parent profile's own value applies. Closed set enforced
 via validation{}.
 EOT
 type = string
 default = null

 validation {
 condition = var.always_send == null ? true: contains(["enabled", "disabled"], var.always_send)
 error_message = "var.always_send must be one of: enabled, disabled."
 }
}

variable "method" {
 description = <<-EOT
 Optional. Type of cookie processing the system uses. The provider's own
 documentation states the default value is "insert" but does not enumerate
 a complete, verifiable closed set of accepted values in either the
 rendered doc or the live schema (unlike `cookie_encryption`, which does),
 so no validation{} allow-list is enforced here — pass the literal value
 your BIG-IP version expects (e.g. "insert"). Left unset (null) by default
 rather than this module hardcoding "insert" as a value the provider
 itself has not committed to in its schema.
 EOT
 type = string
 default = null
}

variable "cookie_name" {
 description = <<-EOT
 Optional. Name of the cookie used to track persistence. No literal
 provider default is documented; left unset so the `defaults_from` parent
 profile's own value applies.
 EOT
 type = string
 default = null
}

variable "cookie_encryption" {
 description = <<-EOT
 Optional ("required", "preferred", or "disabled"). Policy for cookie
 encryption. No literal provider default is documented; left unset so the
 `defaults_from` parent profile's own value applies. Closed set enforced
 via validation{}.
 EOT
 type = string
 default = null

 validation {
 condition = var.cookie_encryption == null ? true: contains(["required", "preferred", "disabled"], var.cookie_encryption)
 error_message = "var.cookie_encryption must be one of: required, preferred, disabled."
 }
}

variable "cookie_encryption_passphrase" {
 description = <<-EOT
 Optional. Passphrase used to encrypt the persistence cookie when
 `cookie_encryption` is "required" or "preferred". Secret-shaped — marked
 sensitive. Source this from a secrets manager/Terraform Cloud variable
 set, never as a literal committed to version control, consistent with
 our PII/credential handling policy.

 Schema note: BIG-IP encrypts this value server-side and always returns a
 different value than what was set, which would otherwise show as a
 perpetual diff on every plan. `main.tf` carries a static
 `lifecycle { ignore_changes = [cookie_encryption_passphrase] }` on the
 keystone resource to suppress that false drift, matching the provider's
 own documented Example Usage for this resource.
 EOT
 type = string
 default = null
 sensitive = true
}

variable "expiration" {
 description = <<-EOT
 Optional. Expiration TTL for the cookie, specified as
 "DAY:HOUR:MIN:SECONDS" (e.g. "1:0:0:0" for one day, "1:0:0" for one hour,
 "30:0" for thirty minutes). No literal provider default is documented;
 left unset so the `defaults_from` parent profile's own value applies.
 EOT
 type = string
 default = null
}

variable "hash_length" {
 description = <<-EOT
 Optional. Length of hash to apply to the cookie. No literal provider
 default is documented (Optional+Computed); left unset so the
 `defaults_from` parent profile's own value applies.
 EOT
 type = number
 default = null
}

variable "hash_offset" {
 description = <<-EOT
 Optional. Number of characters to skip in the cookie for the hash. No
 literal provider default is documented (Optional+Computed); left unset so
 the `defaults_from` parent profile's own value applies.
 EOT
 type = number
 default = null
}

variable "httponly" {
 description = <<-EOT
 Optional ("enabled" or "disabled"). Whether the cookie is sent only over
 HTTP (the `HttpOnly` cookie attribute, blocking client-side script
 access). No literal provider default is documented; left unset so the
 `defaults_from` parent profile's own value applies. Closed set enforced
 via validation{}.
 EOT
 type = string
 default = null

 validation {
 condition = var.httponly == null ? true: contains(["enabled", "disabled"], var.httponly)
 error_message = "var.httponly must be one of: enabled, disabled."
 }
}

variable "app_service" {
 description = <<-EOT
 Optional. The application service (iApp) to which this persistence
 profile belongs. Rarely used outside iApp-managed deployments. Present in
 the live provider schema but omitted from the rendered Terraform Registry
 Argument Reference for this resource — see the file header note.
 EOT
 type = string
 default = null
}