resource "opensearch_role" "default_role" {
  role_name   = "default_role"
  description = "Default role for engineer user access."

  cluster_permissions = [
    "cluster_all",
    # explicitly grant these as they seem to be missing after granting cluster_all.
    "indices:data/read/scroll",
    "indices:data/read/search",
    "indices:data/write/bulk",
    "indices:data/write/reindex",
    "indices:admin/template/get",
  ]

  index_permissions {
    index_patterns  = ["*"]
    allowed_actions = ["indices_all"]
  }

  tenant_permissions {
    tenant_patterns = ["global_tenant"]
    allowed_actions = ["kibana_all_write"]
  }
}

# Opensearch sink connector role for backfilling data into opensearch.
resource "opensearch_role" "product_track_project_index_rw" {
  role_name   = "product-track-project-index-rw"
  description = "Read/Write/search role for product-track-project alias"

  cluster_permissions = [
    "cluster_composite_ops",
    "indices:data/read/scroll",
    "indices:data/read/search",
    "indices:data/write/bulk",
  ]

  index_permissions {
    index_patterns = [
      "product_write",
      "track_write",
      "project_write",
      "label_write",
      "dim_release_write",
      "dim_artist_write",
      "dim_catalog_write",
      "dim_isrc_write",
    ]
    allowed_actions      = ["indices_all"]
    field_level_security = []
    masked_fields        = []
  }
}

# Read all content-search indexes
resource "opensearch_role" "product_track_project_read_search" {
  role_name   = "product-track-project-read-search"
  description = "Read/search role for all 3 aliases"

  index_permissions {
    index_patterns = [
      "product_read",
      "track_read",
      "project_read",
      "label_read",
      "dim_release_read",
      "dim_artist_read",
      "dim_catalog_read",
      "dim_isrc_read",
    ]
    allowed_actions      = ["read", "search"]
    field_level_security = []
    masked_fields        = []
  }
}