terraform {
  required_providers {
    alicloud = {
      source  = "aliyun/alicloud"
      version = "1.261.0"
    }
  }
}

provider "alicloud" {
  profile = "default"
}

variable "oidc_issuer" {
  type = string
}

variable "oidc_arn" {
  type = string
}

variable "role_name" {
  type = string
}

variable "service_names" {
  type = list(string)
}

variable "policy_document" {
  type    = string
  default = ""
}

variable "system_policies" {
  type    = list(string)
  default = []
}

variable "custom_policies" {
  type    = list(string)
  default = []
}

variable "auto_deploy_owner_tag" {
  type = string
}

data "alicloud_account" "current" {}
locals {
  controlplane_account = data.alicloud_account.current.id
}

resource "alicloud_ram_role" "controlplane_role" {
  role_name = var.role_name

  assume_role_policy_document = jsonencode({
    Version = "1"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Federated = [var.oidc_arn]
        }
        Condition = {
          "StringEquals" = {
            "oidc:aud" = ["sts.aliyuncs.com"]
            "oidc:iss" = [var.oidc_issuer]
          }
          "StringLike" = {
            "oidc:sub" = [for service in var.service_names : "system:serviceaccount:*:${service}"]
          }
        }
      }
    ]
  })
  tags = {
    "tidbcloud-auto-deploy-owner" = var.auto_deploy_owner_tag,
  }
}

resource "alicloud_ram_role_policy_attachment" "system_policy_attachments" {
  count       = length(var.system_policies)
  role_name   = alicloud_ram_role.controlplane_role.role_name
  policy_name = var.system_policies[count.index]
  policy_type = "System"
}

resource "alicloud_ram_role_policy_attachment" "custom_policy_attachments" {
  count       = length(var.custom_policies)
  role_name   = alicloud_ram_role.controlplane_role.role_name
  policy_name = var.custom_policies[count.index]
  policy_type = "Custom"
}

resource "alicloud_ram_policy" "inline_policy" {
  count = var.policy_document != "" ? 1 : 0

  policy_name     = var.role_name
  policy_document = var.policy_document
}

resource "alicloud_ram_role_policy_attachment" "inline_policy_attachment" {
  count = var.policy_document != "" ? 1 : 0

  role_name   = alicloud_ram_role.controlplane_role.role_name
  policy_name = alicloud_ram_policy.inline_policy[0].policy_name
  policy_type = "Custom"
}

output "controlplane_role_id" {
  value = alicloud_ram_role.controlplane_role.role_id
}

output "controlplane_role_name" {
  value = alicloud_ram_role.controlplane_role.role_name
}

output "controlplane_role_arn" {
  value = alicloud_ram_role.controlplane_role.arn
}