terraform {
  required_providers {
    aws = {
      source                = "hashicorp/aws"
      version               = "~> 6.0"
      configuration_aliases = [aws.kv_bucket]
    }
  }
}

variable "env" {
  type = string
}

variable "cloud_provider" {
  type = string
}

variable "cloud_region" {
  type = string
}

variable "logical_region_name" {
  type = string
}

variable "vector_role_arn" {
  type    = string
  default = ""
}

variable "agent_access_account" {
  type    = string
  default = ""
}

variable "key_vault_name" {
  type    = string
  default = ""
}

variable "dataplane_manager_object_id" {
  type    = string
  default = ""
}

variable "controlplane_subscription_id" {
  type    = string
  default = ""
}

resource "terraform_data" "create_o11y_cluster" {
  lifecycle {
    ignore_changes = all

    precondition {
      condition     = var.cloud_provider != "alicloud" || var.agent_access_account != ""
      error_message = "For alicloud, agent_access_account must be set."
    }

    precondition {
      condition     = var.cloud_provider != "aws" || var.vector_role_arn != ""
      error_message = "For aws, vector_role_arn must be set."
    }

    precondition {
      condition     = var.cloud_provider != "azure" || (var.key_vault_name != "" && var.dataplane_manager_object_id != "" && var.controlplane_subscription_id != "")
      error_message = "For azure, key_vault_name, dataplane_manager_object_id, and controlplane_subscription_id must be set."
    }
  }

  input = {
    biz_type                     = "${var.env}-tidbcloud-nextgen"
    cloud_provider               = var.cloud_provider
    cloud_region                 = var.cloud_region
    logical_region_name          = var.logical_region_name
    o11y_tenant_id               = "infra-${var.env}"
    o11y_project_id              = "seed"
    o11y_global_endpoint         = "www.gs.us-west-2.aws.observability.tidbcloud.com"
    o11y_rule_template_id        = "tidb-cloud-control-plane-dedicated-seed-rule"
    vector_role_arn              = var.vector_role_arn
    agent_access_account         = var.agent_access_account
    key_vault_name               = var.key_vault_name
    dataplane_manager_object_id  = var.dataplane_manager_object_id
    controlplane_subscription_id = var.controlplane_subscription_id
    auth0_secret_id              = "${var.env}-o11y-auth0-client"
    job_timeout                  = 300
    job_check_interval           = 10
  }

  provisioner "local-exec" {
    command = <<-EOT
      uv run ${path.module}/scripts/create_o11y_cluster.py \
        --biz-type ${self.input.biz_type} \
        --cloud ${self.input.cloud_provider} \
        --region ${self.input.cloud_region} \
        --logical-region-name ${self.input.logical_region_name} \
        --o11y-endpoint ${self.input.o11y_global_endpoint} \
        --tenant-id ${self.input.o11y_tenant_id} \
        --project-id ${self.input.o11y_project_id} \
        --rule-template-id ${self.input.o11y_rule_template_id} \
        --vector-role-arn "${self.input.vector_role_arn}" \
        --agent-access-account "${self.input.agent_access_account}" \
        --key-vault-name "${self.input.key_vault_name}" \
        --dataplane-manager-object-id "${self.input.dataplane_manager_object_id}" \
        --controlplane-subscription-id "${self.input.controlplane_subscription_id}" \
        --auth0-secret-id ${self.input.auth0_secret_id} \
        --resource-id ${self.id} \
        --timeout ${self.input.job_timeout} \
        --interval ${self.input.job_check_interval}
    EOT
    when    = create
  }

  provisioner "local-exec" {
    command = <<-EOT
      uv run ${path.module}/scripts/delete_o11y_cluster.py \
        --biz-type ${self.input.biz_type} \
        --cloud ${self.input.cloud_provider} \
        --region ${self.input.cloud_region} \
        --o11y-endpoint ${self.input.o11y_global_endpoint} \
        --tenant-id ${self.input.o11y_tenant_id} \
        --vector-role-arn "${self.input.vector_role_arn}" \
        --agent-access-account "${self.input.agent_access_account}" \
        --key-vault-name "${self.input.key_vault_name}" \
        --controlplane-subscription-id "${self.input.controlplane_subscription_id}" \
        --auth0-secret-id ${self.input.auth0_secret_id} \
        --resource-id ${self.id}
    EOT
    when    = destroy
  }
}

data "aws_s3_object" "o11y_cluster" {
  provider = aws.kv_bucket
  bucket   = "autonomous-deployment-kv"
  key      = terraform_data.create_o11y_cluster.id
}

locals {
  cluster_data = jsondecode(data.aws_s3_object.o11y_cluster.body)
}

output "o11y_cluster_id" {
  value = local.cluster_data.id
}

output "storage_info" {
  value = { for s in local.cluster_data.storageInfo : s.category => s }
}

output "agent_info" {
  value = local.cluster_data.agentInfo
}

output "monitor_info" {
  value = local.cluster_data.monitorInfo
}