variable "session_name" {
  type = string

  validation {
    condition     = can(regex("^[a-z0-9][a-z0-9-]{2,39}$", var.session_name))
    error_message = "session_name must be 3-40 lowercase letters, digits, or hyphens."
  }
}

variable "owner" {
  type = string

  validation {
    condition     = trimspace(var.owner) != ""
    error_message = "owner is required."
  }
}

variable "ttl_expires_at" {
  type = string

  validation {
    condition     = can(timecmp(var.ttl_expires_at, timestamp()))
    error_message = "ttl_expires_at must be RFC3339."
  }
}

variable "aws_profile" {
  type = string

  validation {
    condition     = trimspace(var.aws_profile) != ""
    error_message = "aws_profile is required."
  }
}

variable "aws_region" {
  type = string

  validation {
    condition     = can(regex("^[a-z]{2}(?:-gov)?-[a-z]+-[0-9]$", var.aws_region))
    error_message = "aws_region must be an AWS region."
  }
}

variable "target_account" {
  type = string

  validation {
    condition     = can(regex("^[0-9]{12}$", var.target_account))
    error_message = "target_account must be a 12-digit AWS account ID."
  }
}

variable "permissions_boundary_arn" {
  type = string
}

variable "developer_power_policy_arn" {
  type = string
}

variable "service_account_unique_id" {
  type = string

  validation {
    condition     = can(regex("^[0-9]{10,32}$", var.service_account_unique_id))
    error_message = "service_account_unique_id must be the numeric Google service-account unique ID."
  }
}

variable "audience" {
  type = string

  validation {
    condition     = trimspace(var.audience) != "" && length(var.audience) <= 255
    error_message = "audience must be non-empty and at most 255 characters."
  }
}

variable "route53_zone_id" {
  type = string

  validation {
    condition     = can(regex("^Z[A-Z0-9]+$", var.route53_zone_id))
    error_message = "route53_zone_id must be an AWS hosted zone ID."
  }
}

variable "route53_zone_name" {
  type = string

  validation {
    condition     = trimsuffix(trimspace(var.route53_zone_name), ".") == "${var.target_account}.cp9.dev.aws.tidbcloud.com"
    error_message = "route53_zone_name must be <target_account>.cp9.dev.aws.tidbcloud.com."
  }
}

variable "regional_endpoint_host" {
  type = string

  validation {
    condition     = can(regex("^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$", var.regional_endpoint_host))
    error_message = "regional_endpoint_host must be a lowercase DNS name."
  }
}

variable "gcp_public_ip" {
  type = string

  validation {
    condition     = can(cidrhost("${var.gcp_public_ip}/32", 0))
    error_message = "gcp_public_ip must be an IPv4 address."
  }
}

variable "pca_arn" {
  type = string
}