main.bicep

param productPrefix string
@allowed([
    'dev'
    'test'
    'prod'
])
param envName string
param location string = resourceGroup().location
param appClientId string
@secure()
param appClientSecret string

var commonTags = {
  env: envName
  product: productPrefix
}

var keyvaultName = 'kv-${productPrefix}-${envName}'
var staticWebAppName = 'swa-${productPrefix}-${envName}'

module keyVault 'modules/keyvault.bicep' = {
  name: 'deploy-${keyvaultName}'
  params: {
    location: location
    tags: commonTags
    name: keyvaultName
  }
}

module appClientIdSecret 'modules/keyvault-secret.bicep' = {
  name: 'deploy-appClientId-secret'
  params: {
    keyVaultName: keyVault.outputs.name
    name: 'AppClientId'
    value: appClientId
  }
}

module appClientSecretSecret 'modules/keyvault-secret.bicep' = {
  name: 'deploy-appClientSecret-secret'
  params: {
    keyVaultName: keyVault.outputs.name
    name: 'AppClientSecret'
    value: appClientSecret
  }
}

module staticWebApp 'modules/static-web-app.bicep' = {
  name: 'deploy-${staticWebAppName}'
  params: {
    location: location
    tags: commonTags
    name: staticWebAppName
    sku: 'Standard'
    appSettings: {
      APP_CLIENT_ID: '@Microsoft.KeyVault(SecretUri=${appClientIdSecret.outputs.storageSecretUri})'
      APP_CLIENT_SECRET: '@Microsoft.KeyVault(SecretUri=${appClientSecretSecret.outputs.storageSecretUri})'
    }
  }
}

module staticWebAppRbacKeyVault 'modules/rbac-keyvault.bicep' = {
  name: 'deploy-${staticWebAppName}-rbac-keyvault'
  params: {
    principalId: staticWebApp.outputs.principalId    
    keyVaultName: keyVault.outputs.name
  }
}

output staticWebAppName string = staticWebApp.outputs.name