# Grant bigquery.dataViewer role to the BI datasets for the service account
resource "google_bigquery_dataset_iam_member" "bi_reader_sa_access" {
  for_each = toset(local.dwh_datasets)
  project    = var.project_id
  dataset_id = each.value
  role       = "roles/bigquery.dataViewer"
  member     = "serviceAccount:${google_service_account.bi_reader_service_account.email}"
}

# Grant bigquery.readSessionUser role to the service account
resource "google_project_iam_member" "bi_reader_sa_read_session_user" {
  project = var.project_id
  role    = "roles/bigquery.readSessionUser"
  member  = "serviceAccount:${google_service_account.bi_reader_service_account.email}"
}

# Grant bigquery.jobUser role to the service account
resource "google_project_iam_member" "bi_reader_sa_job_user" {
  project = var.project_id
  role    = "roles/bigquery.jobUser"
  member  = "serviceAccount:${google_service_account.bi_reader_service_account.email}"
}

# Allow project admins to fully manage the service account
resource "google_service_account_iam_member" "project_admins_sa_admin" {
  for_each = toset(var.project_admins)
  service_account_id = google_service_account.bi_reader_service_account.name
  role               = "roles/iam.serviceAccountAdmin"
  member             = each.value
}

resource "google_service_account_iam_member" "project_admins_sa_key_admin" {
  for_each = toset(var.project_admins)
  service_account_id = google_service_account.bi_reader_service_account.name
  role               = "roles/iam.serviceAccountKeyAdmin"
  member             = each.value
}