variable "project_id" {
  description = "GCP project that owns buckets, datasets, Cloud Run jobs, and schedulers."
  type        = string
  default     = "gcp-digital-bi"
}

variable "region" {
  description = "Cloud Run and Cloud Scheduler region."
  type        = string
  default     = "us-west2"
}

variable "pipeline_image" {
  description = "Container image for the pingcap-pipeline runtime. Defaults to the managed Artifact Registry repo when null."
  type        = string
  default     = null
}

variable "pipeline_image_tag" {
  description = "Default image tag used when pipeline_image is null."
  type        = string
  default     = "main"
}

variable "labels" {
  description = "Labels applied to managed resources."
  type        = map(string)
  default = {
    app       = "pingcap-datapipelines"
    managedby = "terraform"
  }
}

variable "github_repository" {
  description = "owner/repo allowed to deploy via Workload Identity Federation. Only this repo's GitHub Actions can impersonate the deployer service account."
  type        = string
  default     = "pingcap-inc/pingcap-datapipelines"
}

variable "enabled_credentialed_extract_sources" {
  description = "Credentialed sources whose extract or combined Cloud Run jobs should be deployed. Add a source only after its required Secret Manager versions exist."
  type        = set(string)
  default     = ["data_foundation_finance", "helix", "nexuscrm"]

  validation {
    condition = alltrue([
      for source in var.enabled_credentialed_extract_sources :
      contains(["data_foundation_finance", "helix", "nexuscrm"], source)
    ])
    error_message = "enabled_credentialed_extract_sources can include only data_foundation_finance, helix, and nexuscrm."
  }
}

variable "nexuscrm_outbound_base_url" {
  description = "NexusCRM instance that receives outbound records. Keep staging until the production cutover is approved."
  type        = string
  default     = "https://nexuscrm-new-staging.pingcap.com"
}

variable "nexuscrm_outbound_existing_secrets" {
  description = "Existing secret references, including cross-project credentials; values never enter Terraform state."
  type = object({
    project_id    = string
    client_id     = string
    client_secret = string
  })
  default = null
}

variable "enable_month_end_arr_outbound" {
  description = "Create the Month End ARR Cloud Run Job and scheduler only after both NexusCRM secret versions exist."
  type        = bool
  default     = false
}

variable "month_end_arr_outbound_cron" {
  description = "Daily retry window for Month End ARR outbound. The scheduler remains paused until staging acceptance."
  type        = string
  default     = "0 8 * * *"
}

variable "month_end_arr_outbound_timezone" {
  description = "Cloud Scheduler timezone for Month End ARR outbound."
  type        = string
  default     = "Asia/Shanghai"
}

variable "month_end_arr_outbound_scheduler_paused" {
  description = "Safety gate for automatic Month End ARR writes."
  type        = bool
  default     = true
}

variable "enable_netsuite_revenue_to_nexuscrm" {
  description = "Create the isolated NetSuite revenue NexusCRM API resources only after separate approval. Default false creates no Job, Scheduler, bucket, runtime identity, or secrets."
  type        = bool
  default     = false
}

variable "netsuite_revenue_pipeline_image" {
  description = "Separately authorized immutable image digest for the NexusCRM API Job; ordinary main deployment never updates it."
  type        = string
  default     = ""
}

variable "netsuite_revenue_restlet_url" {
  description = "NetSuite RESTlet endpoint injected without credentials. It is only used when the separately enabled Job runs."
  type        = string
  default     = ""
}

variable "netsuite_revenue_posting_period_id" {
  description = "Explicit NetSuite accounting-period internal ID for a separately approved candidate-freeze run."
  type        = string
  default     = ""
}

variable "netsuite_revenue_nexuscrm_base_url" {
  description = "NexusCRM base URL injected without credentials. The ordinary disabled Job only freezes candidates; API validation/write needs separate authorization."
  type        = string
  default     = ""
}

variable "netsuite_revenue_schedule_cron" {
  description = "Candidate-freeze schedule. The scheduler remains paused until separately authorized."
  type        = string
  default     = "30 2 * * *"
}

variable "netsuite_revenue_schedule_timezone" {
  description = "IANA timezone for the disabled candidate-freeze scheduler."
  type        = string
  default     = "Asia/Shanghai"
}

variable "netsuite_revenue_scheduler_paused" {
  description = "Safety gate for NetSuite revenue candidate-freeze automation."
  type        = bool
  default     = true
}