resource "google_storage_bucket" "test_data" {
  name                        = local.bucket_name
  project                     = var.gcp_project_id
  location                    = var.gcp_region
  force_destroy               = var.bucket_force_destroy
  uniform_bucket_level_access = true
  public_access_prevention    = "enforced"
  labels                      = local.labels

  lifecycle_rule {
    action {
      type = "Delete"
    }
    condition {
      age = 1
    }
  }

  depends_on = [google_project_service.storage]
}

resource "google_storage_bucket_iam_member" "object_admin" {
  bucket = google_storage_bucket.test_data.name
  role   = "roles/storage.objectAdmin"
  member = "serviceAccount:${google_service_account.services.email}"
}

resource "google_storage_bucket_iam_member" "bucket_reader" {
  bucket = google_storage_bucket.test_data.name
  role   = "roles/storage.legacyBucketReader"
  member = "serviceAccount:${google_service_account.services.email}"
}

# The GitHub Actions WIF runner grants and revokes temporary bucket access for
# the TiDB Cloud service account during the GCS CDC smoke test. It therefore
# needs bucket-level IAM administration on this disposable test bucket only.
resource "google_storage_bucket_iam_member" "e2e_runner_admin" {
  for_each = var.gcs_e2e_runner_service_account == null ? toset([]) : toset([var.gcs_e2e_runner_service_account])

  bucket = google_storage_bucket.test_data.name
  role   = "roles/storage.admin"
  member = "serviceAccount:${each.value}"
}

resource "google_storage_managed_folder" "external_access" {
  for_each = toset(["backup-export/", "cdc/"])

  bucket        = google_storage_bucket.test_data.name
  name          = each.value
  force_destroy = true
}

resource "google_storage_bucket_iam_member" "external_bucket_get" {
  for_each = local.external_storage_service_accounts

  bucket = google_storage_bucket.test_data.name
  role   = "roles/storage.bucketViewer"
  member = "serviceAccount:${each.value}"
}

resource "google_storage_managed_folder_iam_member" "backup_export_objects" {
  for_each = var.gcs_backup_export_access_grants

  bucket         = google_storage_managed_folder.external_access["backup-export/"].bucket
  managed_folder = google_storage_managed_folder.external_access["backup-export/"].name
  role           = "roles/storage.objectUser"
  member         = "serviceAccount:${each.value.service_account_email}"
}

resource "google_storage_managed_folder_iam_member" "cdc_objects" {
  for_each = var.gcs_cdc_access_grants

  bucket         = google_storage_managed_folder.external_access["cdc/"].bucket
  managed_folder = google_storage_managed_folder.external_access["cdc/"].name
  role           = "roles/storage.objectUser"
  member         = "serviceAccount:${each.value.service_account_email}"
}