variable "session_name" {
  description = "cp9 session name. Must match the top-level name in cp9.yaml."
  type        = string

  validation {
    condition     = can(regex("^[a-z][a-z0-9-]{1,30}[a-z0-9]$", var.session_name))
    error_message = "session_name must be a DNS-compatible name with 3-32 characters."
  }
}

variable "owner" {
  description = "Stable lowercase owner identity used for cp9-owner tags."
  type        = string

  validation {
    condition     = trimspace(var.owner) != ""
    error_message = "owner must not be empty."
  }
}

variable "target_cloud" {
  description = "Target customer/dataplane cloud from the resolved cp9 session."
  type        = string

  validation {
    condition     = var.target_cloud == "aws"
    error_message = "target_cloud must be aws for Premium Reserved M1."
  }
}

variable "target_region" {
  description = "Target AWS region from the resolved cp9 session."
  type        = string

  validation {
    condition     = trimspace(var.target_region) != ""
    error_message = "target_region must not be empty."
  }
}

variable "target_account" {
  description = "AWS account proven by cp9 iam_ready and used as the Terraform account boundary."
  type        = string

  validation {
    condition     = can(regex("^\\d{12}$", var.target_account))
    error_message = "target_account must be a 12-digit AWS account ID."
  }
}

variable "tags" {
  description = "cp9-generated owner/session/managed/ttl tags."
  type        = map(string)
  default     = {}
}

variable "persona" {
  description = "Persona/business key for this substrate variable file."
  type        = string
  default     = "premium"
}

variable "aws_profile" {
  description = "AWS profile name written for cp9 day-2 commands. cp9 may override this in the session-local .tfvars copy."
  type        = string
  default     = "cp9"
}

variable "aws_source_profile" {
  description = "Existing local AWS source profile retained in the runtime handoff. cp9 may override this in the session-local .tfvars copy."
  type        = string
  default     = "sso"
}

variable "aws_assume_role_duration" {
  description = "Deprecated compatibility input. The cp9 runtime profile credential helper owns the session duration."
  type        = string
  default     = "1h"
}

variable "developer_role_name" {
  description = "cp9 developer role name."
  type        = string
  default     = "cp9-developer"
}

variable "developer_role_arn" {
  description = "cp9 developer role ARN. Defaults to target_account/developer_role_name when empty."
  type        = string
  default     = ""
}

variable "developer_boundary_policy_arn" {
  description = "cp9 developer permission boundary ARN. Defaults to target_account/cp9-developer-boundary when empty."
  type        = string
  default     = ""
}

variable "developer_power_policy_arn" {
  description = "cp9 developer broad managed policy ARN. Defaults to target_account/cp9-developer-power when empty."
  type        = string
  default     = ""
}

variable "remote_ec2_k3d_enabled" {
  description = "Whether this session runs its control plane on a remote EC2 k3d host with a session-owned instance profile."
  type        = bool
  default     = false
}

variable "starter_node_boundary_policy_arn" {
  description = "Optional Starter remote EKS role permission boundary ARN. Defaults to developer_boundary_policy_arn when empty."
  type        = string
  default     = ""
}

variable "iam_enabled" {
  description = "Whether to create the per-session workload IAM role and policy."
  type        = bool
  default     = true
}

variable "dedicated_crossplane_enabled" {
  description = "Whether to grant the workload role the Dedicated legacy Crossplane runtime permissions."
  type        = bool
  default     = false
}

variable "dataplane_role_name" {
  description = "Dataplane role name that the cp9 workload role may assume."
  type        = string
  default     = "tidbcloud-dataplane-manager-assumed-role"
}

variable "dataplane_accounts" {
  description = "AWS accounts that may host the dataplane role."
  type        = list(string)
  default     = []
}

variable "billing_sqs_arn" {
  description = "Optional billing queue ARN the workload role may send messages to."
  type        = string
  default     = ""
}

variable "route53_enabled" {
  description = "Whether to grant route53 hosted-zone permissions to the workload role."
  type        = bool
  default     = false
}

variable "metadb_enabled" {
  description = "Whether to create a metadb credentials secret."
  type        = bool
  default     = false
}

variable "metadb_host" {
  description = "Metadb host emitted through secret and outputs when metadb_enabled is true."
  type        = string
  default     = ""
}

variable "metadb_port" {
  description = "Metadb port emitted through secret and outputs."
  type        = number
  default     = 3306
}

variable "metadb_database" {
  description = "Metadb database name emitted through secret and outputs."
  type        = string
  default     = "metadb"
}

variable "metadb_username" {
  description = "Metadb username emitted through secret and outputs."
  type        = string
  default     = "cp9_metadb"
}

variable "metadb_password_length" {
  description = "Generated metadb password length."
  type        = number
  default     = 20
}

variable "provider_credential_secret_names" {
  description = "Provider credential secret names cp9 can materialize into app-delivery patches."
  type        = map(string)
  default     = {}
}

variable "source_ecr_profile" {
  description = "Existing local AWS profile that owns the staging/source ECR repositories used by Starter image pulls."
  type        = string
  default     = "sso"
}

variable "source_ecr_account_id" {
  description = "AWS account ID that owns the staging/source ECR repositories used by Starter image pulls."
  type        = string
  default     = "385595570414"

  validation {
    condition     = can(regex("^\\d{12}$", var.source_ecr_account_id))
    error_message = "source_ecr_account_id must be a 12-digit AWS account ID."
  }
}

variable "source_ecr_region" {
  description = "AWS region for the staging/source ECR repositories used by Starter image pulls."
  type        = string
  default     = "us-west-2"

  validation {
    condition     = trimspace(var.source_ecr_region) != ""
    error_message = "source_ecr_region must not be empty."
  }
}

variable "starter_remote_eks_enabled" {
  description = "Whether to create the Starter remote regional EKS substrate."
  type        = bool
  default     = false
}

variable "starter_infra_cluster_enabled" {
  description = "Whether to create the Starter infra cluster table, queue, and stream bridge used by the regional manager."
  type        = bool
  default     = false
}

variable "starter_remote_eks_cluster_name" {
  description = "Remote regional EKS cluster name for Starter. Defaults to a cp9 session-scoped name."
  type        = string
  default     = ""
}

variable "starter_remote_eks_kubernetes_version" {
  description = "Kubernetes minor version for the Starter remote EKS cluster."
  type        = string
  default     = "1.36"
}

variable "starter_remote_eks_node_instance_type" {
  description = "Legacy fallback managed node group instance type for Starter remote EKS."
  type        = string
  default     = "m6i.large"
}

variable "starter_remote_eks_node_count" {
  description = "Legacy fallback managed node group desired/minimum size for Starter remote EKS."
  type        = number
  default     = 2

  validation {
    condition     = var.starter_remote_eks_node_count > 0
    error_message = "starter_remote_eks_node_count must be positive."
  }
}

variable "starter_remote_eks_node_groups" {
  description = "Resolved seven-role managed node groups for the Dev full Starter regional substrate."
  type = list(object({
    name          = string
    instance_type = string
    ami_type      = string
    desired_size  = number
    min_size      = number
    max_size      = number
    labels        = map(string)
    taints = list(object({
      key    = string
      value  = string
      effect = string
    }))
  }))
  default = []

  validation {
    condition = length(distinct([
      for group in var.starter_remote_eks_node_groups : group.name
      ])) == length(var.starter_remote_eks_node_groups) && alltrue([
      for group in var.starter_remote_eks_node_groups :
      trimspace(group.name) != "" &&
      trimspace(group.instance_type) != "" &&
      contains(["AL2023_ARM_64_STANDARD", "AL2023_x86_64_STANDARD"], group.ami_type) &&
      group.desired_size >= 0 &&
      group.min_size == group.desired_size &&
      group.max_size > group.desired_size &&
      alltrue([for taint in group.taints : contains(["NO_SCHEDULE", "NO_EXECUTE", "PREFER_NO_SCHEDULE"], taint.effect)])
    ])
    error_message = "starter_remote_eks_node_groups must have unique non-empty names, reviewed AL2023 AMI types, non-negative min=desired<max sizes, and valid EKS taint effects."
  }
}

variable "starter_o11y_stub_enabled" {
  description = "Whether to create the legacy AWS-hosted Starter o11y stub endpoint."
  type        = bool
  default     = false
}

variable "starter_o11y_stub_script" {
  description = "Deterministic Prometheus-compatible response script for the legacy Starter o11y stub."
  type        = string
  default     = "{\"default\":[{\"data\":{\"resultType\":\"vector\",\"result\":[]}}]}"
}

variable "cp9_dns_zone_id" {
  description = "Runtime-account public hosted zone that receives this session's UI, Regional, and Dedicated endpoint records."
  type        = string

  validation {
    condition     = can(regex("^Z[A-Z0-9]+$", var.cp9_dns_zone_id))
    error_message = "cp9_dns_zone_id must look like a Route53 hosted zone ID."
  }
}

variable "cp9_dns_zone_name" {
  description = "Delegated runtime-account zone matching cp9_dns_zone_id; session records are written beneath it."
  type        = string

  validation {
    condition     = trimsuffix(trimspace(var.cp9_dns_zone_name), ".") == "${var.target_account}.cp9.dev.aws.tidbcloud.com"
    error_message = "cp9_dns_zone_name must be <target_account>.cp9.dev.aws.tidbcloud.com."
  }
}