data "terraform_remote_state" "seed" {
  backend = "s3"

  config = {
    bucket       = "autonomous-deployment-terraform-state"
    region       = "us-west-2"
    use_lockfile = true
    key          = "azure/account/seed/${var.env}.json"
  }
}

locals {
  shared_states = {
    base   = "aws/base/${var.env}.json"
    clinic = var.env == "dev" ? "aws/clinic/staging.json" : "aws/clinic/${var.env}.json"
    devops = var.env == "dev" ? "aws/devops/staging.json" : "aws/devops/${var.env}.json"
    argocd = "gke/argocd/${var.env}.json"
    runner = "gke/runner/prod.json"
  }
}

data "aws_s3_object" "shared_states" {
  for_each = local.shared_states

  bucket = "autonomous-deployment-terraform-state"
  key    = each.value

  provider = aws.tf_state
}

data "aws_s3_objects" "shoot_objects" {
  bucket = "autonomous-deployment-terraform-state"
  prefix = "azure/account/shoot/${var.env}-"

  provider = aws.tf_state
}

data "aws_s3_object" "shoot_states" {
  for_each = toset(data.aws_s3_objects.shoot_objects.keys)

  bucket = "autonomous-deployment-terraform-state"
  key    = each.value

  provider = aws.tf_state
}

data "terraform_remote_state" "region" {
  backend = "s3"

  config = {
    bucket       = "autonomous-deployment-terraform-state"
    region       = "us-west-2"
    use_lockfile = true
    key          = "azure/region/${var.env}-${var.cloud_region}.json"
  }
}

locals {
  cluster_name                      = "${var.env}-seed-${var.logical_region_name}"
  base_account                      = data.terraform_remote_state.seed.outputs.base_account
  controlplane_tenant_id            = data.terraform_remote_state.seed.outputs.controlplane_tenant_id
  controlplane_subscription         = data.terraform_remote_state.seed.outputs.controlplane_subscription_id
  controlplane_client_id            = data.terraform_remote_state.seed.outputs.controlplane_client_id
  image_registry                    = data.terraform_remote_state.seed.outputs.image_registry
  admin_group_object_ids            = data.terraform_remote_state.seed.outputs.admin_group_object_ids
  effective_acr_id_scope            = data.terraform_remote_state.seed.outputs.acr_id_scope
  effective_acr_rg                  = try(split("/", local.effective_acr_id_scope)[4], "")
  shoot_state_outputs               = { for key in sort(data.aws_s3_objects.shoot_objects.keys) : key => jsondecode(data.aws_s3_object.shoot_states[key].body).outputs }
  shoot_subscriptions               = [for key in sort(data.aws_s3_objects.shoot_objects.keys) : local.shoot_state_outputs[key].dataplane_subscription_id.value]
  default_dataplane_account         = local.shoot_subscriptions[0]
  region_outputs                    = data.terraform_remote_state.region.outputs
  base_outputs                      = jsondecode(data.aws_s3_object.shared_states["base"].body).outputs
  clinic_outputs                    = jsondecode(data.aws_s3_object.shared_states["clinic"].body).outputs
  devops_outputs                    = jsondecode(data.aws_s3_object.shared_states["devops"].body).outputs
  argocd_outputs                    = jsondecode(data.aws_s3_object.shared_states["argocd"].body).outputs
  runner_outputs                    = jsondecode(data.aws_s3_object.shared_states["runner"].body).outputs
  controlplane_domain_name          = var.controlplane_domain_name != "" ? var.controlplane_domain_name : "${var.env}.azure.tidbcloud.com"
  dataplane_domain_name             = "${var.env}.azure.tidb-cloud.com"
  issuer_dns_zone                   = local.controlplane_domain_name
  public_hosted_zone_domain         = local.dataplane_domain_name
  regional_api_host_record          = "${var.logical_region_name}.regional-api"
  service_address                   = var.service_address != "" ? var.service_address : "https://${local.regional_api_host_record}.${local.controlplane_domain_name}"
  controlplane_dns_zone_rg          = var.controlplane_dns_zone_resource_group != "" ? var.controlplane_dns_zone_resource_group : data.external.controlplane_dns_zone.result.resource_group_name
  issuer_hosted_zone_resource_group = local.controlplane_dns_zone_rg
  hosted_zone_resource_group        = data.external.dataplane_dns_zone.result.resource_group_name
  global_controlplane_ips           = formatlist("%s/32", local.base_outputs.public_ips.value)
  clinic_ips                        = formatlist("%s/32", local.clinic_outputs.public_ips.value)
  bastion_ips                       = formatlist("%s/32", local.devops_outputs.public_ips.value)
  auth0_audience                    = "${var.env}-proxy-service"
  auth0_domain                      = var.env == "prod" ? "tidb.auth0.com" : "tidb-${var.env}.us.auth0.com"
  tidb_image_registry               = local.image_registry
  dataplane_accounts_contract_shape = [
    for key in sort(data.aws_s3_objects.shoot_objects.keys) : {
      subscriptionID      = local.shoot_state_outputs[key].dataplane_subscription_id.value
      bucketResourceGroup = try(local.shoot_state_outputs[key].bucket_resource_group_name.value, "${var.env}-premium-bucket")
    }
  ]
  control_plane_crossplane_provider_config = local.controlplane_subscription
  jump_server_tenant_id                    = var.jump_server_tenant_id != "" ? var.jump_server_tenant_id : local.controlplane_tenant_id
  jump_server_subscription                 = var.jump_server_subscription_id != "" ? var.jump_server_subscription_id : local.controlplane_subscription
  jump_server_env                          = var.jump_server_env != "" ? var.jump_server_env : var.env
}

check "shoot_subscriptions_found" {
  assert {
    condition     = length(local.shoot_subscriptions) > 0
    error_message = "No dataplane subscriptions found in azure/account/shoot state for this env."
  }
}

check "seed_premium_defaults_found" {
  assert {
    condition     = length(local.admin_group_object_ids) > 0
    error_message = "No admin_group_object_ids found in azure/account/seed state for this env."
  }

  assert {
    condition     = local.effective_acr_id_scope != ""
    error_message = "No acr_id_scope found in azure/account/seed state for this env."
  }

  assert {
    condition     = local.image_registry != ""
    error_message = "No image_registry found in azure/account/seed state for this env."
  }
}

data "external" "controlplane_dns_zone" {
  program = ["bash", "-lc", <<-EOT
    set -euo pipefail
    rg=$(az network dns zone list --query "[?name=='${local.controlplane_domain_name}'].resourceGroup | [0]" -o tsv)
    printf '{"resource_group_name":"%s"}\n' "$rg"
  EOT
  ]

  lifecycle {
    postcondition {
      condition     = self.result.resource_group_name != ""
      error_message = "Azure DNS zone ${local.controlplane_domain_name} not found in the current subscription."
    }
  }
}

data "external" "dataplane_dns_zone" {
  program = ["bash", "-lc", <<-EOT
    set -euo pipefail
    rg=$(az network dns zone list --query "[?name=='${local.dataplane_domain_name}'].resourceGroup | [0]" -o tsv)
    printf '{"resource_group_name":"%s"}\n' "$rg"
  EOT
  ]

  lifecycle {
    postcondition {
      condition     = self.result.resource_group_name != ""
      error_message = "Azure DNS zone ${local.dataplane_domain_name} not found in the current subscription."
    }
  }
}