# =============================================================================
# Remote state: o11y-global (account, SNS topic) and base (PCA)
#
# The o11y-global read is skipped when var.o11y_account / var.sns_topic_arn are
# provided directly (e.g. dev, which has no aws/o11y-global state). The base
# read only happens when var.use_pca = true.
# =============================================================================

data "aws_s3_object" "o11y_global" {
  count = var.o11y_account == "" ? 1 : 0

  bucket = "autonomous-deployment-terraform-state"
  key    = "aws/o11y-global/${var.env}.json"

  provider = aws.tf_state
}

data "aws_s3_object" "base" {
  count = var.use_pca ? 1 : 0

  bucket = "autonomous-deployment-terraform-state"
  key    = "aws/base/${var.env}.json"

  provider = aws.tf_state
}

# =============================================================================
# Locals
# =============================================================================

locals {
  o11y_global_outputs = var.o11y_account == "" ? jsondecode(data.aws_s3_object.o11y_global[0].body).outputs : null
  o11y_account        = var.o11y_account != "" ? var.o11y_account : local.o11y_global_outputs.account.value
  sns_topic_arn       = var.sns_topic_arn != "" ? var.sns_topic_arn : local.o11y_global_outputs.sns_topic_arn.value

  pca_arn = var.use_pca ? jsondecode(data.aws_s3_object.base[0].body).outputs.pca_arn.value : null

  cluster_name = "o11y-${var.env}-regional-${var.logical_region_name}"

  hosted_zone_name = var.hosted_zone_name != "" ? var.hosted_zone_name : (
    var.env == "prod" ? "observability.tidbcloud.com" : "observability-${var.env}.pingcap.cloud"
  )
  rs_domain_name = var.rs_domain_name != "" ? var.rs_domain_name : "www.rs.${var.logical_region_name}.aws.${local.hosted_zone_name}"
  ds_domain_name = var.ds_domain_name != "" ? var.ds_domain_name : "www.ds.${var.logical_region_name}.aws.${local.hosted_zone_name}"

  # Same convention as deploy-cli: the o11y regional image registry always lives in us-west-2
  image_registry = "${local.o11y_account}.dkr.ecr.us-west-2.amazonaws.com"

  jump_server_role_arn = var.jump_server_role_arn != "" ? var.jump_server_role_arn : "arn:aws:iam::${local.o11y_account}:role/jump-service-role"

  common_tags = merge(var.tags, {
    environment = var.env
    servicetype = "o11y"
    usedby      = "o11y-region-control"
    tenant      = "admin"
  })
}