provider "snowflake" {
  account_name = var.account
  role         = "PROD_ATLANTIS"
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/snowflake/delphi/security-integrations/oauth/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "snowflake_account_roles" "blocked_role_prefix" {
  like = "%READWRITE%"
}

resource "snowflake_external_oauth_integration" "azure_entra_sigma_oauth_integration" {
  comment                                         = "AZURE_ENTRA_SIGMA_SNOWFLAKE"
  name                                            = "AZURE_ENTRA_SIGMA_SNOWFLAKE"
  external_oauth_type                             = "azure"
  enabled                                         = true
  external_oauth_any_role_mode                    = "ENABLE"
  external_oauth_audience_list                    = [
    "https://SonyMusicEntertainment.onmicrosoft.com/${var.sigma_snowflake_delphi_prod_app_client_id}",
    var.power_platform_snowflake_oauth_client_registration_app_client_id,
    var.power_bi_snowflake_connector_audience,
    var.alteryx_snowflake_oauth_client_registration_app_client_id
  ]
  external_oauth_issuer                           = "https://sts.windows.net/${var.azure_entra_tenant_id}/"
  external_oauth_jws_keys_url                     = ["https://login.microsoftonline.com/${var.azure_entra_tenant_id}/discovery/v2.0/keys"]
  external_oauth_snowflake_user_mapping_attribute = "LOGIN_NAME"
  external_oauth_token_user_mapping_claim         = ["upn", "sub"]
  external_oauth_blocked_roles_list               = concat(
    var.blocked_roles,
    flatten([for role in data.snowflake_account_roles.blocked_role_prefix.account_roles : [for output_role in role.show_output: output_role.name]])
  )
}