resource "snowflake_compute_pool" "compute_pool" {
  name            = var.name
  instance_family = var.instance_family
  min_nodes       = var.min_nodes
  max_nodes       = var.max_nodes

  auto_resume       = var.auto_resume
  auto_suspend_secs = var.auto_suspend_secs
  comment           = var.comment
  for_application   = var.for_application

  timeouts {
    create = var.timeouts.create
    update = var.timeouts.update
    delete = var.timeouts.delete
    read   = var.timeouts.read
  }
}

# Create access role which can in turn be granted to functional roles.
resource "snowflake_account_role" "access_role" {
  name    = "${snowflake_compute_pool.compute_pool.name}_COMPUTE_POOL_ACCESS"
  comment = "Managed by Terraform"
}

resource "snowflake_grant_ownership" "access_role_ownership" {
  account_role_name   = "USERADMIN"
  outbound_privileges = "COPY"

  on {
    object_type = "ROLE"
    object_name = snowflake_account_role.access_role.name
  }
}

# assign team tag
resource "snowflake_tag_association" "team_compute_pool_association" {
  count = var.team != "" ? 1 : 0

  object_identifiers = [snowflake_compute_pool.compute_pool.name]
  object_type        = "COMPUTE POOL"
  tag_id             = var.team_tag_name
  tag_value          = var.team
}

resource "snowflake_grant_privileges_to_account_role" "compute_pool" {
  privileges        = ["MONITOR", "OPERATE", "USAGE"]
  account_role_name = snowflake_account_role.access_role.name

  on_account_object {
    object_type = "COMPUTE POOL"
    object_name = snowflake_compute_pool.compute_pool.name
  }
}

# Create monitor role which can in turn be granted to functional roles.
resource "snowflake_account_role" "monitor_role" {
  name    = "${snowflake_compute_pool.compute_pool.name}_COMPUTE_POOL_MONITOR"
  comment = "Managed by Terraform"
}

resource "snowflake_grant_ownership" "monitor_role_ownership" {
  account_role_name   = "USERADMIN"
  outbound_privileges = "COPY"

  on {
    object_type = "ROLE"
    object_name = snowflake_account_role.monitor_role.name
  }
}

resource "snowflake_grant_privileges_to_account_role" "monitor_compute_pool" {
  privileges        = ["MONITOR"]
  account_role_name = snowflake_account_role.monitor_role.name

  on_account_object {
    object_type = "COMPUTE POOL"
    object_name = snowflake_compute_pool.compute_pool.name
  }
}

resource "snowflake_grant_account_role" "monitor_compute_pool_to_all_compute_pool_monitor_role" {
  role_name        = snowflake_account_role.monitor_role.name
  parent_role_name = "ALL_COMPUTE_POOL_MONITOR"
}