variable "account" {
  type        = string
  description = "snowflake account id"
  default     = "delphi"
}

variable "users" {
  type = map(object({
    first_name                     = string,
    last_name                      = string,
    email                          = string,
    default_role                   = string,
    roles                          = list(string)
    username                       = optional(string, ""),
    comment                        = optional(string, "Managed by Terraform"),
    default_wh                     = optional(string),
    default_secondary_roles_option = optional(string, "ALL")
    owner                          = optional(string, "USERADMIN"),
    disabled                       = optional(bool, false),
    rsa_public_key                 = optional(string),
    rsa_public_key_2               = optional(string),
    network_policy                 = optional(string),
    authentication_policy          = optional(string, "human_users_authentication_policy"),
    team                           = optional(string, ""),
  }))
  description = "A map of users with their first/last names and default role and Email as a key"

  # Validate that all sonymusicpub.com domain users are in the approved list
  validation {
    condition = alltrue([
      for k, v in var.users :
      !endswith(lower(v.email), "sonymusicpub.com") ||
      contains([
        lower("Justin.Yew@sonymusicpub.com"),
        lower("Nate.Edinburg@sonymusicpub.com"),
        lower("Marin.Lau@sonymusicpub.com"),
        lower("andrzej.milewski@sonymusicpub.com"),
        lower("marcin.slawinski@sonymusicpub.com"),
        lower("miguel.colmenares@sonymusicpub.com"),
        lower("alice.chiu@sonymusicpub.com"),
        lower("henry.naldjian@sonymusicpub.com"),
        lower("lucy.keys@sonymusicpub.com"),
        lower("margarita.panayotova@sonymusicpub.com"),
        lower("martin.down@sonymusicpub.com"),
        lower("marianna.linares@sonymusicpub.com"),
        lower("matt.palazzolo@sonymusicpub.com"),
        lower("Nuria.PicondelCampo@sonymusicpub.com"),
        lower("pavel.lipen@sonymusicpub.com"),
        lower("stephanie.caress@sonymusicpub.com"),
        lower("sai.kolusu@sonymusicpub.com"),
        lower("thekla.brandt@sonymusicpub.com"),
        lower("vishwaraj.gupta@sonymusicpub.com"),
        lower("Colin.Moriarty@sonymusicpub.com"),
        lower("felix.canetty-clarke@sonymusicpub.com"),
        lower("kayla.henry@sonymusicpub.com"),
        lower("Godfrey.Tse@sonymusicpub.com"),
        lower("Jack.Yau@sonymusicpub.com"),
        lower("Joanna.Adde@sonymusicpub.com"),
        lower("sebastien.soumier@sonymusicpub.com"),
        lower("ed.hillel@sonymusicpub.com"),
      ], lower(v.email))
    ])
    error_message = "ERROR: Attempted to create users with sonymusicpub.com email domain that are not in the approved list. For competitive reasons, adding new sonymusicpub.com users requires explicit approval from either Farouk, Myron or Jacob."
  }
}