resource "snowflake_account_role" "db_create_schema_role" {
  count   = var.enable_account_roles ? 1 : 0
  name    = coalesce(var.create_schema_role_name, "${snowflake_database.db.name}_DB_CREATE_SCHEMA")
  comment = "Managed by Terraform"
}

resource "snowflake_grant_ownership" "db_create_schema_account_role_ownership" {
  count               = var.enable_account_roles ? 1 : 0
  account_role_name   = "USERADMIN"
  outbound_privileges = "COPY"
  on {
    object_type = "ROLE"
    object_name = snowflake_account_role.db_create_schema_role[0].name
  }
}

resource "snowflake_grant_account_role" "db_create_schema_role_grants" {
  count            = var.enable_account_roles && var.grant_roles_to_sysadmin ? 1 : 0
  role_name        = snowflake_account_role.db_create_schema_role[0].name
  parent_role_name = "SYSADMIN"
}

resource "snowflake_grant_privileges_to_account_role" "db_create_schema_role_database_grants" {
  count             = var.enable_account_roles ? 1 : 0
  privileges        = setsubtract(local.db_read_write_privileges, ["MODIFY"])
  account_role_name = snowflake_account_role.db_create_schema_role[0].name

  on_account_object {
    object_type = "DATABASE"
    object_name = snowflake_database.db.name
  }
}

############### DATABASE ROLES ################
resource "snowflake_database_role" "db_create_schema_role" {
  count    = var.enable_database_roles ? 1 : 0
  name     = coalesce(var.create_schema_role_name, "DB_CREATE_SCHEMA")
  database = snowflake_database.db.name
  comment  = "Managed by Terraform"
}

resource "snowflake_grant_ownership" "db_create_schema_role_ownership" {
  count               = var.enable_database_roles ? 1 : 0
  account_role_name   = "USERADMIN"
  outbound_privileges = "COPY"
  on {
    object_type = "DATABASE ROLE"
    object_name = "${snowflake_database.db.name}.${snowflake_database_role.db_create_schema_role[0].name}"
  }
}

resource "snowflake_grant_database_role" "db_create_schema_role_grants" {
  count              = var.enable_database_roles && var.grant_roles_to_sysadmin ? 1 : 0
  database_role_name = "${snowflake_database.db.name}.${snowflake_database_role.db_create_schema_role[0].name}"
  parent_role_name   = "SYSADMIN"
}

resource "snowflake_grant_privileges_to_database_role" "db_create_schema_role_database_grants" {
  count              = var.enable_database_roles ? 1 : 0
  privileges         = setsubtract(local.db_read_write_privileges, ["MODIFY"])
  database_role_name = "${snowflake_database.db.name}.${snowflake_database_role.db_create_schema_role[0].name}"
  on_database        = snowflake_database.db.name
}