resource "opensearch_role" "label_participant_index_rw" {
  role_name   = "label-participant-index-rw"
  description = "Read/Write/search role for label_participant_write alias"

  cluster_permissions = ["cluster_composite_ops"]

  index_permissions {
    index_patterns       = [var.label_participant_write_alias]
    allowed_actions      = ["indices_all"]
    field_level_security = []
    masked_fields        = []
  }
}

resource "opensearch_role" "global_participant_index_rw" {
  role_name   = "global-participant-index-rw"
  description = "Read/Write/search role for global_participant_write alias"

  cluster_permissions = ["cluster_composite_ops"]

  index_permissions {
    index_patterns       = [var.global_participant_write_alias]
    allowed_actions      = ["indices_all"]
    field_level_security = []
    masked_fields        = []
  }
}

resource "opensearch_role" "global_sound_recording_index_rw" {
  role_name   = "global-sound-recording-index-rw"
  description = "Read/Write/search role for global_sound_recording_write alias"

  cluster_permissions = ["cluster_composite_ops"]

  index_permissions {
    index_patterns       = [var.global_sound_recording_write_alias]
    allowed_actions      = ["indices_all"]
    field_level_security = []
    masked_fields        = []
  }
}

resource "opensearch_role" "read_search_all_index" {
  role_name   = "read-search-all-index"
  description = "Read/search role for all 3 aliases"

  index_permissions {
    index_patterns       = [
      "label_participant_read",
      "global_participant_read",
      "global_sound_recording_read",
    ]
    allowed_actions      = ["read", "search"]
    field_level_security = []
    masked_fields        = []
  }
}

resource "opensearch_role" "default_role" {
  role_name   = "default_role"
  description = "Default role for engineer user access."

  cluster_permissions = [
    "cluster_all",
    "indices:data/write/bulk"
  ]

  index_permissions {
    index_patterns       = ["*"]
    allowed_actions      = [
      "indices_all",
      "indices:data/write/bulk"
    ]
  }

  tenant_permissions {
    tenant_patterns = ["global_tenant"]
    allowed_actions = ["kibana_all_write"]
  }
}

# Reindex role
resource "opensearch_role" "reindex_role" {
  role_name   = "reindex_all"
  description = "Role to allow reindexing between indices."
  
  cluster_permissions = [
    "cluster_monitor",
    "indices:data/write/reindex",
    "indices:data/write/bulk",
    "indices:data/read/scroll"
  ]

  index_permissions {
    index_patterns       = ["*"]
    allowed_actions      = ["indices_all"]
  }
}