provider "snowflake" {
  account_name = var.account
  role         = "PROD_ATLANTIS"
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/snowflake/delphi/security-integrations/oauth/power-automate/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

# Get Client ID and Client Secret after creating the OAuth integration in Snowflake
# snowsql: SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('POWER_AUTOMATE_OAUTH');
resource "snowflake_oauth_integration_for_custom_clients" "power_automate_oauth" {
  name                             = "POWER_AUTOMATE_OAUTH"
  oauth_client_type                = "CONFIDENTIAL"
  oauth_redirect_uri               = "https://global.consent.azure-apim.net/redirect/snowflake-2doauth-2ddelphi-2dprod-5f06e39432eb9-ef3f92f1862a0825"
  oauth_issue_refresh_tokens       = true
  oauth_refresh_token_validity     = 7776000 # 90 days
  oauth_use_secondary_roles        = "IMPLICIT"
  oauth_enforce_pkce               = "false"
  blocked_roles_list               = var.blocked_roles
  oauth_allow_non_tls_redirect_uri = "true"
  enabled                         = true
}