provider "snowflake" {
  account_name = var.account
  role         = "PROD_ATLANTIS"
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/snowflake/delphi/security-integrations/oauth/claude/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "snowflake_account_roles" "blocked_role_prefix" {
  like = "%READWRITE%"
}

resource "snowflake_oauth_integration_for_custom_clients" "claude_chatbot_mcp_integration" {
  name                         = "CLAUDE_CHATBOT_MCP_INTEGRATION"
  enabled                      = true
  oauth_client_type            = "CONFIDENTIAL"
  oauth_redirect_uri           = "https://claude.ai/api/mcp/auth_callback"
  oauth_issue_refresh_tokens   = true
  oauth_refresh_token_validity = 86400 # 1 day in seconds
  oauth_enforce_pkce           = false
  oauth_use_secondary_roles    = "IMPLICIT"
  blocked_roles_list = concat(
    var.blocked_roles,
    flatten([for role in data.snowflake_account_roles.blocked_role_prefix.account_roles : [for output_role in role.show_output : output_role.name]])
  )

  comment = "Managed by Terraform - OAuth Integration for Claude chatbot agent MCP connection"
}