resource "google_service_account" "dagster_service_account" {
  project      = var.project_id
  account_id   = "dagster-${var.app_id}-sa"
  display_name = "Dagster Service Account"
  description  = "Service account for running Dagster and accessing GCS and BigQuery"
}

# Grant all required permissions to the service account
resource "google_project_iam_member" "dagster_permissions" {
  for_each = toset([
    "roles/run.invoker",
    "roles/run.serviceAgent",
    "roles/storage.objectAdmin",
    "roles/bigquery.admin",
    "roles/bigquery.jobUser",
  ])
  
  project = var.project_id
  role    = each.value
  member  = "serviceAccount:${google_service_account.dagster_service_account.email}"
}

# Allow the specified user to impersonate the service account
resource "google_service_account_iam_member" "user_impersonation" {
  service_account_id = google_service_account.dagster_service_account.name
  for_each = toset([
    "roles/iam.serviceAccountUser",
    "roles/iam.serviceAccountTokenCreator"
  ])
  role              = each.value
  member             = "user:yiming.wang@pingcap.com"  # Replace with actual user email
}