data "google_project" "outbound_secrets" {
  project_id = var.nexuscrm_outbound_existing_secrets == null ? var.project_id : var.nexuscrm_outbound_existing_secrets.project_id
}

locals {
  outbound_secret_project       = data.google_project.outbound_secrets.project_id
  outbound_client_id_secret     = var.nexuscrm_outbound_existing_secrets == null ? google_secret_manager_secret.nexuscrm_outbound_client_id[0].secret_id : var.nexuscrm_outbound_existing_secrets.client_id
  outbound_client_secret_secret = var.nexuscrm_outbound_existing_secrets == null ? google_secret_manager_secret.nexuscrm_outbound_client_secret[0].secret_id : var.nexuscrm_outbound_existing_secrets.client_secret
}

moved {
  from = google_secret_manager_secret.nexuscrm_outbound_client_id
  to   = google_secret_manager_secret.nexuscrm_outbound_client_id[0]
}

moved {
  from = google_secret_manager_secret.nexuscrm_outbound_client_secret
  to   = google_secret_manager_secret.nexuscrm_outbound_client_secret[0]
}

resource "google_bigquery_dataset" "outbound_control" {
  project                    = var.project_id
  dataset_id                 = "outbound_control"
  location                   = var.region
  description                = "Run, lease, and per-record audit state for outbound integrations"
  labels                     = var.labels
  delete_contents_on_destroy = false

  depends_on = [google_project_service.required]
}

resource "google_service_account" "outbound_runtime" {
  project      = var.project_id
  account_id   = "pingcap-outbound-runtime"
  display_name = "PingCAP outbound Cloud Run runtime"

  depends_on = [google_project_service.required]
}

resource "google_project_iam_member" "outbound_bigquery_job_user" {
  project = var.project_id
  role    = "roles/bigquery.jobUser"
  member  = "serviceAccount:${google_service_account.outbound_runtime.email}"
}

resource "google_bigquery_dataset_iam_member" "outbound_google_sheets_viewer" {
  project    = var.project_id
  dataset_id = "google_sheets"
  role       = "roles/bigquery.dataViewer"
  member     = "serviceAccount:${google_service_account.outbound_runtime.email}"
}

resource "google_bigquery_dataset_iam_member" "outbound_control_editor" {
  project    = var.project_id
  dataset_id = google_bigquery_dataset.outbound_control.dataset_id
  role       = "roles/bigquery.dataEditor"
  member     = "serviceAccount:${google_service_account.outbound_runtime.email}"
}

resource "google_secret_manager_secret" "nexuscrm_outbound_client_id" {
  count     = var.nexuscrm_outbound_existing_secrets == null ? 1 : 0
  project   = var.project_id
  secret_id = "pingcap-nexuscrm-outbound-client-id"

  replication {
    auto {}
  }

  depends_on = [google_project_service.required]
}

resource "google_secret_manager_secret" "nexuscrm_outbound_client_secret" {
  count     = var.nexuscrm_outbound_existing_secrets == null ? 1 : 0
  project   = var.project_id
  secret_id = "pingcap-nexuscrm-outbound-client-secret"

  replication {
    auto {}
  }

  depends_on = [google_project_service.required]
}

resource "google_secret_manager_secret_iam_member" "outbound_client_id_accessor" {
  project   = local.outbound_secret_project
  secret_id = local.outbound_client_id_secret
  role      = "roles/secretmanager.secretAccessor"
  member    = "serviceAccount:${google_service_account.outbound_runtime.email}"
}

resource "google_secret_manager_secret_iam_member" "outbound_client_secret_accessor" {
  project   = local.outbound_secret_project
  secret_id = local.outbound_client_secret_secret
  role      = "roles/secretmanager.secretAccessor"
  member    = "serviceAccount:${google_service_account.outbound_runtime.email}"
}

resource "google_cloud_run_v2_job" "month_end_arr_outbound" {
  count = var.enable_month_end_arr_outbound ? 1 : 0

  project             = var.project_id
  name                = "pingcap-month-end-arr-outbound"
  location            = var.region
  labels              = var.labels
  deletion_protection = false

  template {
    template {
      service_account = google_service_account.outbound_runtime.email
      timeout         = "3600s"
      max_retries     = 0

      containers {
        image = local.pipeline_image
        args = [
          "outbound",
          "--job",
          "/app/configs/jobs/month_end_arr_outbound.yaml",
        ]

        resources {
          limits = {
            cpu    = "1"
            memory = "1Gi"
          }
        }

        env {
          name  = "GOOGLE_CLOUD_PROJECT"
          value = var.project_id
        }

        env {
          name  = "NEXUSCRM_BASE_URL"
          value = var.nexuscrm_outbound_base_url
        }

        env {
          name = "NEXUSCRM_CLIENT_ID"
          value_source {
            secret_key_ref {
              secret  = "projects/${data.google_project.outbound_secrets.number}/secrets/${local.outbound_client_id_secret}"
              version = "latest"
            }
          }
        }

        env {
          name = "NEXUSCRM_CLIENT_SECRET"
          value_source {
            secret_key_ref {
              secret  = "projects/${data.google_project.outbound_secrets.number}/secrets/${local.outbound_client_secret_secret}"
              version = "latest"
            }
          }
        }
      }
    }
  }

  depends_on = [
    google_bigquery_dataset_iam_member.outbound_control_editor,
    google_bigquery_dataset_iam_member.outbound_google_sheets_viewer,
    google_project_iam_member.outbound_bigquery_job_user,
    google_secret_manager_secret_iam_member.outbound_client_id_accessor,
    google_secret_manager_secret_iam_member.outbound_client_secret_accessor,
  ]

  lifecycle {
    ignore_changes = [
      template[0].template[0].containers[0].image,
    ]
  }
}

resource "google_service_account_iam_member" "scheduler_act_as_outbound_runtime" {
  service_account_id = google_service_account.outbound_runtime.name
  role               = "roles/iam.serviceAccountUser"
  member             = "serviceAccount:${google_service_account.scheduler.email}"
}

resource "google_cloud_scheduler_job" "month_end_arr_outbound" {
  count = var.enable_month_end_arr_outbound ? 1 : 0

  project     = var.project_id
  region      = var.region
  name        = "pingcap-month-end-arr-outbound"
  description = "Upsert the curated Month End ARR Google Sheet into NexusCRM"
  schedule    = var.month_end_arr_outbound_cron
  time_zone   = var.month_end_arr_outbound_timezone
  paused      = var.month_end_arr_outbound_scheduler_paused

  http_target {
    http_method = "POST"
    uri         = "https://run.googleapis.com/v2/projects/${var.project_id}/locations/${var.region}/jobs/${google_cloud_run_v2_job.month_end_arr_outbound[0].name}:run"

    oauth_token {
      service_account_email = google_service_account.scheduler.email
      scope                 = "https://www.googleapis.com/auth/cloud-platform"
    }
  }

  depends_on = [
    google_cloud_run_v2_job.month_end_arr_outbound,
    google_project_iam_member.scheduler_run_developer,
    google_service_account_iam_member.scheduler_act_as_outbound_runtime,
  ]
}