resource "azapi_resource" "test_data" {
  type      = "Microsoft.Storage/storageAccounts@2023-05-01"
  name      = local.storage_account_name
  parent_id = azurerm_resource_group.this.id
  location  = azurerm_resource_group.this.location
  tags      = local.tags
  body = {
    kind = "StorageV2"
    sku = {
      name = "Standard_LRS"
    }
    properties = {
      allowBlobPublicAccess        = false
      allowSharedKeyAccess         = true
      minimumTlsVersion            = "TLS1_2"
      publicNetworkAccess          = "Enabled"
      supportsHttpsTrafficOnly     = true
      defaultToOAuthAuthentication = false
    }
  }
}

resource "azapi_resource" "cdc_container" {
  type      = "Microsoft.Storage/storageAccounts/blobServices/containers@2023-05-01"
  name      = "cdc"
  parent_id = "${azapi_resource.test_data.id}/blobServices/default"
  body = {
    properties = {
      publicAccess = "None"
    }
  }
}

resource "azapi_resource" "backup_export_container" {
  type      = "Microsoft.Storage/storageAccounts/blobServices/containers@2023-05-01"
  name      = "backup-export"
  parent_id = "${azapi_resource.test_data.id}/blobServices/default"
  body = {
    properties = {
      publicAccess = "None"
    }
  }
}

# Dedicated import source container. Unlike the cdc/ and backup-export/
# fixtures, import data is deliberately NOT covered by the one-day lifecycle
# rule: import tests may run over longer windows and must not have their source
# deleted out from under them.
resource "azapi_resource" "import_container" {
  type      = "Microsoft.Storage/storageAccounts/blobServices/containers@2023-05-01"
  name      = "import"
  parent_id = "${azapi_resource.test_data.id}/blobServices/default"
  body = {
    properties = {
      publicAccess = "None"
    }
  }
}

resource "azapi_resource" "expire_test_objects" {
  type      = "Microsoft.Storage/storageAccounts/managementPolicies@2023-05-01"
  name      = "default"
  parent_id = azapi_resource.test_data.id
  body = {
    properties = {
      policy = {
        rules = [{
          name    = "expire-test-objects-after-one-day"
          enabled = true
          type    = "Lifecycle"
          definition = {
            filters = {
              # Azure lifecycle filters are positive-only: unlike AliCloud OSS,
              # they have no excludePrefix/negative filter. Keep the disposable
              # prefixes explicit so the import/sql/ source remains protected;
              # new disposable prefixes must be added here deliberately.
              blobTypes   = ["blockBlob", "appendBlob"]
              prefixMatch = ["cdc/", "backup-export/"]
            }
            actions = {
              baseBlob = {
                delete = {
                  daysAfterModificationGreaterThan = 1
                }
              }
            }
          }
        }]
      }
    }
  }

  depends_on = [azapi_resource.cdc_container, azapi_resource.backup_export_container]
}

data "azurerm_storage_account" "test_data" {
  name                = local.storage_account_name
  resource_group_name = azurerm_resource_group.this.name

  depends_on = [azapi_resource.test_data]
}

data "azurerm_storage_account_sas" "test_data" {
  connection_string = data.azurerm_storage_account.test_data.primary_connection_string
  https_only        = true
  signed_version    = "2022-11-02"
  start             = "2026-01-01T00:00:00Z"
  expiry            = var.blob_sas_expiry

  resource_types {
    service   = false
    container = true
    object    = true
  }

  services {
    blob  = true
    queue = false
    table = false
    file  = false
  }

  permissions {
    read    = true
    write   = true
    delete  = true
    list    = true
    add     = true
    create  = true
    update  = false
    process = false
    tag     = false
    filter  = false
  }
}