provider "snowflake" {
  account_name = var.account
  role         = "PROD_ATLANTIS"
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/snowflake/delphi/security-integrations/oauth/tableau/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

resource "snowflake_oauth_integration_for_partner_applications" "tableau_desktop" {
  name                         = "TABLEAU_DESKTOP_OAUTH_INT"
  oauth_client                 = "TABLEAU_DESKTOP"
  enabled                      = "true"
  oauth_issue_refresh_tokens   = "true"
  oauth_refresh_token_validity = 36000
  oauth_use_secondary_roles    = "NONE"
  blocked_roles_list           = var.blocked_roles
}

resource "snowflake_oauth_integration_for_partner_applications" "tableau_server" {
  name                         = "TABLEAU_ONLINE_OAUTH_INT"
  oauth_client                 = "TABLEAU_SERVER"
  enabled                      = "true"
  oauth_issue_refresh_tokens   = "true"
  oauth_refresh_token_validity = 7776000
  oauth_use_secondary_roles    = "NONE"
  blocked_roles_list           = var.blocked_roles
}

resource "snowflake_oauth_integration_for_custom_clients" "tableau_server" {
  name                             = "TABLEAU_SERVER_OAUTH"
  oauth_client_type                = "CONFIDENTIAL"
  oauth_redirect_uri               = "https://initiatives.scuba.tools/auth/add_oauth_token"
  oauth_issue_refresh_tokens       = true
  oauth_refresh_token_validity     = 7776000
  oauth_use_secondary_roles        = "IMPLICIT"
  oauth_enforce_pkce               = "false"
  blocked_roles_list               = var.blocked_roles
  oauth_allow_non_tls_redirect_uri = "false"
  enabled                          = true
}