# Create reader/applier service accounts and assign them to the bucket
resource "google_service_account" "reader_service_account" {
    account_id   = "reader-${var.project_id}"
    display_name = "Reader Service Account for project ${var.project_id}"
}

resource "google_service_account" "applier_service_account" {
    account_id   = "applier-${var.project_id}"
    display_name = "Applier Service Account for project ${var.project_id}"
}

# Allow reader/applier service accounts to access the bucket
resource "google_storage_bucket_iam_member" "bucket_iam_reader" {
    bucket = google_storage_bucket.terraform_workspace_bucket.name
    role   = "roles/storage.objectViewer"
    member = "serviceAccount:${google_service_account.reader_service_account.email}"
}

resource "google_storage_bucket_iam_member" "bucket_iam" {
    bucket = google_storage_bucket.terraform_workspace_bucket.name
    role   = "roles/storage.objectAdmin"
    member = "serviceAccount:${google_service_account.applier_service_account.email}"
}

# Project admin permissions
# - Key admin on reader/applier service accounts <- TODO: this is temporary. Eventually we want to directly ingest key into CI/CD.
# - Object admin on the bucket <- TODO: this is temporary. Eventually we want to assign viewer permissions only

resource "google_service_account_iam_member" "reader_service_account_iam" {
    service_account_id = google_service_account.reader_service_account.name
    role               = "roles/iam.serviceAccountKeyAdmin"
    for_each = toset(var.project_admins)
    member = each.value
}

resource "google_service_account_iam_member" "applier_service_account_iam" {
    service_account_id = google_service_account.applier_service_account.name
    role               = "roles/iam.serviceAccountKeyAdmin"
    for_each = toset(var.project_admins)
    member = each.value
}

resource "google_storage_bucket_iam_member" "bucket_iam_admin" {
    bucket = google_storage_bucket.terraform_workspace_bucket.name
    role   = "roles/storage.objectAdmin"
    for_each = toset(var.project_admins)
    member = each.value
}


# Dataproc Related IAM
resource "google_service_account" "dbt_dataproc_sa" {
    account_id   = "dbt-dataproc-sa"
    display_name = "Service Account for running dbt models in Dataproc"
}

resource "google_service_account_iam_member" "act_as_dbt_dataproc_sa" {
    service_account_id = google_service_account.dbt_dataproc_sa.id
    role = "roles/iam.serviceAccountUser"
    for_each = toset(var.project_admins)
    member = each.value
}

resource "google_project_iam_member" "dbt_sa_project_permissions"{
    project = var.project_id
    for_each = toset([
        "roles/dataproc.worker",
        "roles/bigquery.jobUser",
        "roles/bigquery.admin"
    ])
    role   = each.value
    member = "serviceAccount:${google_service_account.dbt_dataproc_sa.email}"
}

resource "google_storage_bucket_iam_member" "dbt_sa_bucket_iam_admin" {
    bucket = google_storage_bucket.dbt_dataproc_bucket.name
    role   = "roles/storage.objectAdmin"
    member = "serviceAccount:${google_service_account.dbt_dataproc_sa.email}"
}

resource "google_storage_bucket_iam_member" "dbt_bucket_iam_admin" {
    bucket = google_storage_bucket.dbt_dataproc_bucket.name
    role   = "roles/storage.objectAdmin"
    for_each = toset(var.project_admins)
    member = each.value
}