variable "gcp_project_id" {
  description = "GCP project in which this test environment is allowed to run."
  type        = string
  default     = "data-integration-team-int-8f71"
}

variable "gcp_region" {
  description = "GCP region for the environment."
  type        = string
  default     = "us-west1"
}

variable "gcp_zone" {
  description = "Optional zone override. Defaults to the region's -a zone."
  type        = string
  default     = null
  nullable    = true
}

variable "name_prefix" {
  type    = string
  default = "date-integration-test"

  validation {
    condition     = can(regex("^[a-z][a-z0-9-]{2,23}$", var.name_prefix))
    error_message = "name_prefix must contain 3-24 lowercase letters, digits, or hyphens."
  }
}

variable "vpc_cidr" {
  type    = string
  default = "10.89.0.0/20"
}

variable "machine_type" {
  description = "Two-vCPU, 4-GiB default for lightweight E2E use."
  type        = string
  default     = "e2-custom-2-4096"
}

variable "root_disk_size_gib" {
  type    = number
  default = 30
}

variable "data_disk_size_gib" {
  type    = number
  default = 50
}

variable "desired_state" {
  type    = string
  default = "running"

  validation {
    condition     = contains(["running", "stopped"], var.desired_state)
    error_message = "desired_state must be running or stopped."
  }
}

variable "remove_privatelink_when_stopped" {
  type    = bool
  default = false
}

variable "port_base" {
  type     = number
  default  = null
  nullable = true

  validation {
    condition     = var.port_base == null ? true : var.port_base >= 20000 && var.port_base <= 60000 && floor(var.port_base) == var.port_base
    error_message = "port_base must be a whole number between 20000 and 60000."
  }
}

variable "kafka_privatelink_root_domain_name" {
  type    = string
  default = "date-integration.gcp.kafka.test"
}

variable "private_service_connect_project_ids" {
  description = "GCP projects allowed to create PSC endpoints to the shared MySQL/Kafka service attachment."
  type        = set(string)
  default = [
    "data-integration-team-int-8f71",
    "pingcap-gardener",
    "tidbcloud-dev-000",
    "tidbcloud-prod-000",
    "tidbcloud-stg-000",
  ]

  validation {
    condition = length(var.private_service_connect_project_ids) > 0 && alltrue([
      for project_id in var.private_service_connect_project_ids : can(regex("^[a-z][a-z0-9-]{4,28}[a-z0-9]$", project_id))
    ])
    error_message = "private_service_connect_project_ids must contain valid GCP project IDs."
  }
}

variable "e2e_project_ids" {
  description = "Comma-separated TiDB Cloud project IDs allowed to consume the Kafka PrivateLink dependency."
  type        = string
  default     = "1369847559694040763,1369847559694040575"

  validation {
    condition     = can(regex("^[0-9]+(,[0-9]+)*$", var.e2e_project_ids))
    error_message = "e2e_project_ids must be a comma-separated list of numeric TiDB Cloud project IDs."
  }
}

variable "mysql_user" {
  type    = string
  default = "e2e_admin"
}

variable "mysql_root_password" {
  type      = string
  default   = null
  nullable  = true
  sensitive = true
}

variable "mysql_password" {
  type      = string
  default   = null
  nullable  = true
  sensitive = true
}

variable "kafka_sasl_username" {
  type      = string
  default   = null
  nullable  = true
  sensitive = true
}

variable "kafka_sasl_password" {
  type      = string
  default   = null
  nullable  = true
  sensitive = true
}

variable "pulsar_token_secret" {
  type      = string
  default   = null
  nullable  = true
  sensitive = true
}

variable "enable_pulsar" {
  type    = bool
  default = true
}

variable "enable_schema_registry" {
  type    = bool
  default = false
}

variable "schema_registry_username" {
  type      = string
  default   = null
  nullable  = true
  sensitive = true
}

variable "schema_registry_password" {
  type      = string
  default   = null
  nullable  = true
  sensitive = true
}

variable "bucket_name" {
  type     = string
  default  = null
  nullable = true
}

variable "bucket_force_destroy" {
  type    = bool
  default = true
}

variable "gcs_e2e_runner_service_account" {
  description = "GitHub Actions WIF service account allowed to administer IAM on the disposable E2E bucket."
  type        = string
  default     = null
  nullable    = true

  validation {
    condition     = var.gcs_e2e_runner_service_account == null || can(regex("^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.iam\\.gserviceaccount\\.com$", var.gcs_e2e_runner_service_account))
    error_message = "gcs_e2e_runner_service_account must be a valid service-account email when configured."
  }
}

variable "gcs_backup_export_access_grants" {
  description = "Service accounts granted backup-export managed-folder access. Add stable map entries for additional consumers."
  type = map(object({
    service_account_email = string
  }))
  default = {}

  validation {
    condition = alltrue([
      for name in keys(var.gcs_backup_export_access_grants) : can(regex("^[a-z][a-z0-9-]{0,31}$", name))
    ])
    error_message = "gcs_backup_export_access_grants keys must be 1-32 lowercase alphanumeric or hyphen characters and start with a letter."
  }

  validation {
    condition = alltrue([
      for grant in values(var.gcs_backup_export_access_grants) :
      can(regex("^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.iam\\.gserviceaccount\\.com$", grant.service_account_email))
    ])
    error_message = "Each GCS backup-export grant must contain a valid service-account email."
  }
}

variable "gcs_cdc_access_grants" {
  description = "Service accounts granted CDC managed-folder access. Add stable map entries for additional consumers."
  type = map(object({
    service_account_email = string
  }))
  default = {}

  validation {
    condition = alltrue([
      for name in keys(var.gcs_cdc_access_grants) : can(regex("^[a-z][a-z0-9-]{0,31}$", name))
    ])
    error_message = "gcs_cdc_access_grants keys must be 1-32 lowercase alphanumeric or hyphen characters and start with a letter."
  }

  validation {
    condition = alltrue([
      for grant in values(var.gcs_cdc_access_grants) :
      can(regex("^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.iam\\.gserviceaccount\\.com$", grant.service_account_email))
    ])
    error_message = "Each GCS CDC grant must contain a valid service-account email."
  }
}