terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/snowflake/delphi/databases/orchard-app-reporting-v2/additional_roles/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

provider "snowflake" {
  account_name = var.account
  role         = "PROD_ATLANTIS"
}

resource "snowflake_account_role" "read_role" {
  name    = "${var.database_name}_READ"
  comment = "Managed by Terraform"
}

resource "snowflake_grant_ownership" "grant_ownership_to_useradmin" {
  account_role_name = "USERADMIN"
  on {
    object_type = "ROLE"
    object_name = snowflake_account_role.read_role.name
  }
}

resource "snowflake_grant_account_role" "grant_role_to_sysadmin" {
  role_name        = snowflake_account_role.read_role.name
  parent_role_name = "SYSADMIN"
  depends_on       = [snowflake_grant_ownership.grant_ownership_to_useradmin]
}

resource "snowflake_grant_privileges_to_account_role" "read_role_db_usage" {
  account_role_name = snowflake_account_role.read_role.name
  privileges        = ["USAGE"]
  on_account_object {
    object_type = "DATABASE"
    object_name = "ORCHARD_APP_REPORTING_V2"
  }
}

resource "snowflake_grant_privileges_to_account_role" "read_role_schema_usage" {
  account_role_name = snowflake_account_role.read_role.name
  privileges        = ["USAGE"]
  on_schema {
    all_schemas_in_database = "ORCHARD_APP_REPORTING_V2"
  }
  depends_on = [snowflake_grant_privileges_to_account_role.read_role_db_usage]
}

resource "snowflake_grant_privileges_to_account_role" "read_role_future_schema_usage" {
  account_role_name = snowflake_account_role.read_role.name
  privileges        = ["USAGE"]
  on_schema {
    future_schemas_in_database = "ORCHARD_APP_REPORTING_V2"
  }
  depends_on = [snowflake_grant_privileges_to_account_role.read_role_db_usage]
}

resource "snowflake_grant_privileges_to_account_role" "read_role_table_select" {
  account_role_name = snowflake_account_role.read_role.name
  privileges        = ["SELECT"]
  on_schema_object {
    all {
      object_type_plural = "TABLES"
      in_database        = "ORCHARD_APP_REPORTING_V2"
    }
  }
  depends_on = [snowflake_grant_privileges_to_account_role.read_role_schema_usage]
}

resource "snowflake_grant_privileges_to_account_role" "read_role_future_table_select" {
  account_role_name = snowflake_account_role.read_role.name
  privileges        = ["SELECT"]
  on_schema_object {
    future {
      object_type_plural = "TABLES"
      in_database        = "ORCHARD_APP_REPORTING_V2"
    }
  }
  depends_on = [snowflake_grant_privileges_to_account_role.read_role_future_schema_usage]
}

module "table_database_role_QA_ROYALTY_ACCOUNTING_ROYALTY_ACCOUNTING" {
  source = "git@github.com:theorchard/terraform-snowflake.git//modules/roles/table_access?ref=7.7.5"

  for_each = toset([
    "STATEMENT_PERIOD",
  ])

  database = var.database_name
  schema   = "QA_ROYALTY_ACCOUNTING_ROYALTY_ACCOUNTING"
  table    = each.value
}

module "table_database_role_PROD_ROYALTY_ACCOUNTING_ROYALTY_ACCOUNTING" {
  source = "git@github.com:theorchard/terraform-snowflake.git//modules/roles/table_access?ref=7.7.5"

  for_each = toset([
    "STATEMENT_PERIOD",
  ])

  database = var.database_name
  schema   = "PROD_ROYALTY_ACCOUNTING_ROYALTY_ACCOUNTING"
  table    = each.value
}

module "table_database_role_PROD_DDEX_PLACEHOLDER_UPC_MAPPING" {
  source = "git@github.com:theorchard/terraform-snowflake.git//modules/roles/table_access?ref=7.7.5"

  for_each = toset([
    "PLACEHOLDER_UPC_MAPPING",
  ])

  database = var.database_name
  schema   = "PROD_DDEX_INGESTER_DDEX_INGESTER"
  table    = each.value
}