variable "session_name" {
  description = "cp9 session name and external-resource prefix."
  type        = string

  validation {
    condition     = can(regex("^[a-z][a-z0-9-]{1,30}[a-z0-9]$", var.session_name))
    error_message = "session_name must be a DNS-compatible name with 3-32 characters."
  }
}

variable "owner" {
  description = "Authenticated cp9 owner. The exact value is retained in instance metadata."
  type        = string

  validation {
    condition     = trimspace(var.owner) != "" && can(regex("[A-Za-z0-9]", var.owner))
    error_message = "owner must contain at least one letter or digit."
  }
}

variable "ttl_expires_at" {
  description = "RFC3339 session expiry persisted in instance metadata."
  type        = string

  validation {
    condition     = can(timecmp(var.ttl_expires_at, var.ttl_expires_at))
    error_message = "ttl_expires_at must be an RFC3339 timestamp."
  }
}

variable "seed_project_id" {
  description = "Project that owns the session GCE regional runtime."
  type        = string

  validation {
    condition     = can(regex("^[a-z][a-z0-9-]{4,28}[a-z0-9]$", var.seed_project_id))
    error_message = "seed_project_id must be a lowercase GCP project ID with 6-30 characters."
  }
}

variable "dataplane_project_id" {
  description = "First project in which the regional controllers may create a GKE data plane."
  type        = string

  validation {
    condition     = can(regex("^[a-z][a-z0-9-]{4,28}[a-z0-9]$", var.dataplane_project_id))
    error_message = "dataplane_project_id must be a lowercase GCP project ID with 6-30 characters."
  }
}

variable "runtime_service_account_email" {
  description = "Project-bootstrap service account attached to the session GCE runtime."
  type        = string

  validation {
    condition     = can(regex("^cp9-developer@[a-z][a-z0-9-]{4,28}[a-z0-9]\\.iam\\.gserviceaccount\\.com$", var.runtime_service_account_email))
    error_message = "runtime_service_account_email must name a cp9-developer service account."
  }
}

variable "region" {
  description = "First-slice GCP Dedicated region."
  type        = string

  validation {
    condition     = var.region == "us-west1"
    error_message = "region must be us-west1 for the first GCP Dedicated slice."
  }
}

variable "zone" {
  description = "Zone for the single GCE+k3d regional runtime."
  type        = string

  validation {
    condition     = contains(["us-west1-a", "us-west1-b", "us-west1-c"], var.zone)
    error_message = "zone must be us-west1-a, us-west1-b, or us-west1-c."
  }
}

variable "primary_aws_source_cidr" {
  description = "Exact public egress /32 of the primary AWS CP9 host allowed to reach Regional Kong."
  type        = string

  validation {
    condition     = can(regex("^([0-9]{1,3}\\.){3}[0-9]{1,3}/32$", var.primary_aws_source_cidr)) && can(cidrhost(var.primary_aws_source_cidr, 0))
    error_message = "primary_aws_source_cidr must be one valid IPv4 /32."
  }
}