variable "aws_region" {
  description = "AWS region to deploy into"
  type        = string
  default     = "us-east-1"
}

variable "environment" {
  description = "Environment name (dev, staging, prod)"
  type        = string
  default     = "dev"
}

variable "image_tag" {
  description = "Docker image tag to deploy (git SHA or 'latest')"
  type        = string
  default     = "latest"
}

# ── TiDB Cloud connection ──────────────────────────────────

variable "tidb_host" {
  description = "TiDB Cloud hostname"
  type        = string
}

variable "tidb_port" {
  description = "TiDB Cloud port"
  type        = string
  default     = "4000"
}

variable "tidb_user" {
  description = "TiDB Cloud username"
  type        = string
}

variable "tidb_password" {
  description = "TiDB Cloud password"
  type        = string
  sensitive   = true
}

variable "tidb_database" {
  description = "TiDB database name"
  type        = string
  default     = "nexuscrm"
}

# ── TiDB Cloud API (branch management) ─────────────────────

variable "tidb_cloud_public_key" {
  description = "TiDB Cloud API public key (HTTP Digest Auth)"
  type        = string
  default     = ""
}

variable "tidb_cloud_private_key" {
  description = "TiDB Cloud API private key (HTTP Digest Auth)"
  type        = string
  sensitive   = true
  default     = ""
}

variable "tidb_cloud_cluster_id" {
  description = "TiDB Cloud cluster ID for branch creation"
  type        = string
  default     = ""
}

variable "jwt_secret" {
  description = "Secret key for signing JWT tokens (min 32 chars). Generate with: openssl rand -base64 32"
  type        = string
  sensitive   = true
}

variable "admin_password" {
  description = "Password for the seed admin user. Must be set explicitly — no default is provided."
  type        = string
  sensitive   = true
}

variable "google_client_id" {
  description = "Google OAuth 2.0 Client ID for SSO"
  type        = string
  default     = ""
}

variable "google_client_secret" {
  description = "Google OAuth 2.0 Client Secret for SSO"
  type        = string
  sensitive   = true
  default     = ""
}

variable "dev_session_branch_db" {
  description = "Whether dev sessions create TiDB Cloud branches (true) or share the main DB (false). Auto-detects from TiDB Cloud key presence when empty."
  type        = string
  default     = ""
}

# bootstrap_schema_mode removed — server is read-only, setup runs via entrypoint.sh

variable "autonumber_seed_tolerate_legacy" {
  description = "Tolerate legacy autonumber rows that pre-date the v2 cutover (PR #1140). When \"true\", V6/V8 invariant violations are logged as warnings instead of failing readiness. Default \"true\" preserves prior behavior for prod. Set to \"false\" in non-prod tfvars to exercise strict mode against a clone of prod data. Only the literal strings \"true\" or \"false\" are accepted — backend gate uses strict string equality (autonumber_seed.go:51, platform_config.go:118+158), and any other value (\"True\", \"1\", \"\", etc.) silently flips to strict mode and would crash-loop the new binary on prod data."
  type        = string
  default     = "true"

  validation {
    condition     = contains(["true", "false"], var.autonumber_seed_tolerate_legacy)
    error_message = "autonumber_seed_tolerate_legacy must be exactly \"true\" or \"false\" (the backend reads it via strict string equality)."
  }
}

variable "tenant_overlay_dir" {
  description = "Optional runtime tenant overlay directory. Leave empty for generic brand-neutral deployments; tenant deployments set this to the mounted or image-bundled overlay directory."
  type        = string
  default     = ""
}

variable "apply_tenant_overlay" {
  description = "Whether entrypoint.sh should run nexuscrm-setup apply-tenant on boot. Only \"0\" or \"1\" are accepted. This is separate from tenant_overlay_dir so runtime metadata selection does not imply DB mutation."
  type        = string
  default     = "0"

  validation {
    condition     = contains(["0", "1"], var.apply_tenant_overlay)
    error_message = "apply_tenant_overlay must be exactly \"0\" or \"1\"."
  }
}

# PR #1850 audit log v2 + request capture feature gates. Default OFF in all envs
# for prod safety (C17.3 invariant). Flip on per-environment via TF_VAR_* secret
# after the matching schema/wiring prerequisites are verified. Leaving these
# empty skips emitting the env var entirely, so the backend falls through to its
# own default-off behavior (v2_hook.go:84, request_capture_middleware.go:59).
variable "audit_v2_enabled" {
  description = "Sets AUDIT_V2_ENABLED on the backend task. \"true\" opts the deployment into the V2 audit head-row + outbox path. Leave empty (\"\") to omit the env var and preserve backend default (off). Never set to \"true\" in prod until MySQL OutboxStore impl lands. Only \"\" and \"true\" are accepted — the backend uses strict string equality (v2_hook.go:84 enables iff value == \"true\"); any other value (including \"false\") would be confusing: it ships an env whose only meaningful value is \"true\". Use \"\" to disable."
  type        = string
  default     = ""

  validation {
    condition     = contains(["", "true"], var.audit_v2_enabled)
    error_message = "audit_v2_enabled must be \"\" (omit env, backend default off) or \"true\" (opt in)."
  }
}

variable "nexuscrm_request_capture" {
  description = "Sets NEXUSCRM_REQUEST_CAPTURE on the backend task. \"on\" enables the request-capture middleware that persists to _System_RequestCapture for replay (§14.4). Leave empty (\"\") to omit and preserve backend default (off). Only \"\" and \"on\" are accepted — the backend uses strict string equality (request_capture_middleware.go IsCaptureEnabledFromEnv: truthy iff value matches {on,true,1,yes}); use \"\" to disable."
  type        = string
  default     = ""

  validation {
    condition     = contains(["", "on"], var.nexuscrm_request_capture)
    error_message = "nexuscrm_request_capture must be \"\" (omit env, backend default off) or \"on\" (opt in)."
  }
}

# ── Email / SMTP (SES) ───────────────────────────────────────

variable "smtp_ses_domain" {
  description = "Domain to verify with SES for email sending (e.g. nexuscrm.pingcap.com). Empty = no SES setup."
  type        = string
  default     = ""
}

variable "smtp_from_address" {
  description = "Default From address for outbound emails"
  type        = string
  default     = "noreply@nexuscrm.pingcap.com"
}

variable "smtp_recipient_allowlist" {
  description = "Exact-match allowlist of recipient email addresses. When non-empty, the SES SMTP IAM policy adds a ForAllValues:StringEquals ses:Recipients condition, so any send with a recipient outside this list is rejected by AWS. Empty = no restriction (typical for prod)."
  type        = list(string)
  default     = []
}

# ── Domain / TLS ─────────────────────────────────────────────

variable "domain_name" {
  description = "Custom domain for the application (e.g. app.nexuscrm.io). Leave empty to use CloudFront default domain."
  type        = string
  default     = ""
}

# ── ECS sizing ──────────────────────────────────────────────

variable "ecs_cpu" {
  description = "Fargate task CPU units (256 = 0.25 vCPU)"
  type        = number
  default     = 512
}

variable "ecs_memory" {
  description = "Fargate task memory (MiB)"
  type        = number
  default     = 1024
}

variable "ecs_desired_count" {
  description = "Number of ECS tasks to run"
  type        = number
  default     = 1
}

# ── File storage ───────────────────────────────────────────

variable "file_storage_provider" {
  description = "File storage provider for uploads/downloads (filesystem or s3)"
  type        = string
  default     = "filesystem"

  validation {
    condition     = contains(["filesystem", "s3"], lower(trimspace(var.file_storage_provider)))
    error_message = "file_storage_provider must be either 'filesystem' or 's3'."
  }
}

variable "file_storage_bucket" {
  description = "S3 bucket for application file uploads/downloads. Leave empty when using filesystem storage."
  type        = string
  default     = ""

  validation {
    condition     = lower(trimspace(var.file_storage_provider)) != "s3" || trimspace(var.file_storage_bucket) != ""
    error_message = "file_storage_bucket must be set when file_storage_provider is 's3'."
  }
}

variable "file_storage_region" {
  description = "AWS region for the application file storage bucket. Empty = use aws_region."
  type        = string
  default     = ""
}

variable "file_storage_prefix" {
  description = "Optional key prefix within the file storage bucket."
  type        = string
  default     = ""
}

# ── WAF ──────────────────────────────────────────────────────

variable "vpn_whitelist_cidrs" {
  description = "CIDR blocks to whitelist from WAF (team VPN IPs)"
  type        = list(string)
  default     = []
}