mock_provider "google" {}
mock_provider "external" {}

run "defaults_are_safe" {
  command = plan

  variables {
    port_base                      = 30000
    gcs_e2e_runner_service_account = "e2e-runner@test-project.iam.gserviceaccount.com"
    gcs_backup_export_access_grants = {
      backup-primary = {
        service_account_email = "backup-primary@test-project.iam.gserviceaccount.com"
      }
      backup-secondary = {
        service_account_email = "backup-secondary@test-project.iam.gserviceaccount.com"
      }
    }
    gcs_cdc_access_grants = {
      cdc-primary = {
        service_account_email = "cdc-primary@test-project.iam.gserviceaccount.com"
      }
      cdc-secondary = {
        service_account_email = "cdc-secondary@test-project.iam.gserviceaccount.com"
      }
    }
  }

  assert {
    condition     = var.gcp_project_id == "data-integration-team-int-8f71"
    error_message = "Unexpected default GCP project."
  }

  assert {
    condition     = alltrue([for port in values(local.ports) : port >= 20000 && port <= 60239])
    error_message = "All externally mapped ports must remain high ports."
  }

  assert {
    condition     = length(distinct(values(local.ports))) == 8
    error_message = "Service ports must be unique."
  }

  assert {
    condition = var.private_service_connect_project_ids == toset([
      "data-integration-team-int-8f71",
      "pingcap-gardener",
      "tidbcloud-dev-000",
      "tidbcloud-prod-000",
      "tidbcloud-stg-000",
    ])
    error_message = "The GCP service attachment must retain the approved consumer project allowlist."
  }

  assert {
    condition     = google_compute_service_attachment.services[0].connection_preference == "ACCEPT_MANUAL" && google_compute_service_attachment.services[0].reconcile_connections
    error_message = "PSC must manually enforce and reconcile the consumer allowlist."
  }

  assert {
    condition     = alltrue([for dependency in local.e2e_kafka_dependencies : keys(dependency.dnsRecords) == ["all zones"]])
    error_message = "GCP Kafka dependencies must use the all-zones custom-domain record key."
  }

  assert {
    condition = (
      length(var.gcs_backup_export_access_grants) == 2 &&
      toset(keys(var.gcs_backup_export_access_grants)) == toset(["backup-primary", "backup-secondary"])
    )
    error_message = "The test must exercise multiple backup-export service accounts."
  }

  assert {
    condition = (
      length(var.gcs_cdc_access_grants) == 2 &&
      toset(keys(var.gcs_cdc_access_grants)) == toset(["cdc-primary", "cdc-secondary"])
    )
    error_message = "The test must exercise multiple CDC service accounts."
  }

  assert {
    condition     = toset([for folder in values(google_storage_managed_folder.external_access) : folder.name]) == toset(["backup-export/", "cdc/"])
    error_message = "Backup export and CDC must each use a prefix-scoped managed folder."
  }

  assert {
    condition = (
      google_storage_bucket_iam_member.e2e_runner_admin[var.gcs_e2e_runner_service_account].role == "roles/storage.admin" &&
      google_storage_bucket_iam_member.e2e_runner_admin[var.gcs_e2e_runner_service_account].member == "serviceAccount:${var.gcs_e2e_runner_service_account}"
    )
    error_message = "The GitHub Actions WIF runner must administer IAM on the disposable test bucket."
  }

  assert {
    condition = alltrue([
      for name, grant in var.gcs_backup_export_access_grants : (
        google_storage_managed_folder_iam_member.backup_export_objects[name].managed_folder == "backup-export/" &&
        google_storage_managed_folder_iam_member.backup_export_objects[name].role == "roles/storage.objectUser" &&
        google_storage_managed_folder_iam_member.backup_export_objects[name].member == "serviceAccount:${grant.service_account_email}"
      )
    ])
    error_message = "The backup-export service account must be bound only to the backup-export managed folder."
  }

  assert {
    condition = alltrue([
      for name, grant in var.gcs_cdc_access_grants : (
        google_storage_managed_folder_iam_member.cdc_objects[name].managed_folder == "cdc/" &&
        google_storage_managed_folder_iam_member.cdc_objects[name].role == "roles/storage.objectUser" &&
        google_storage_managed_folder_iam_member.cdc_objects[name].member == "serviceAccount:${grant.service_account_email}"
      )
    ])
    error_message = "The CDC service account must be bound only to the CDC managed folder."
  }

  assert {
    condition = (
      length(google_storage_bucket_iam_member.external_bucket_get) == 4 &&
      alltrue([
        for service_account_email in local.external_storage_service_accounts : (
          google_storage_bucket_iam_member.external_bucket_get[service_account_email].role == "roles/storage.bucketViewer" &&
          google_storage_bucket_iam_member.external_bucket_get[service_account_email].member == "serviceAccount:${service_account_email}"
        )
      ])
    )
    error_message = "Every external storage consumer must receive bucket metadata access."
  }
}