resource "snowflake_account_role" "streamlit_usage_role" {
  count   = var.enable_account_roles ? 1 : 0
  name    = "${snowflake_database.db.name}_DB_STREAMLIT_USAGE"
  comment = "Managed by Terraform"
}

resource "snowflake_grant_ownership" "streamlit_usage_account_role_ownership" {
  count               = var.enable_account_roles ? 1 : 0
  account_role_name   = "USERADMIN"
  outbound_privileges = "COPY"
  on {
    object_type = "ROLE"
    object_name = snowflake_account_role.streamlit_usage_role[0].name
  }
}

resource "snowflake_grant_account_role" "streamlit_usage_account_role_sysadmin_grant" {
  count            = var.enable_account_roles && var.grant_roles_to_sysadmin ? 1 : 0
  role_name        = snowflake_account_role.streamlit_usage_role[0].name
  parent_role_name = "SYSADMIN"
}

resource "snowflake_grant_account_role" "streamlit_usage_account_role_all_streamlit_usage_grant" {
  count            = var.enable_account_roles && var.grant_streamlit_usage_to_all_streamlit_usage ? 1 : 0
  role_name        = snowflake_account_role.streamlit_usage_role[0].name
  parent_role_name = "ALL_STREAMLIT_USAGE"
}

resource "snowflake_grant_privileges_to_account_role" "streamlit_usage_account_role_database_grants" {
  count             = var.enable_account_roles ? 1 : 0
  privileges        = local.db_read_privileges
  account_role_name = snowflake_account_role.streamlit_usage_role[0].name

  on_account_object {
    object_type = "DATABASE"
    object_name = snowflake_database.db.name
  }
}

resource "snowflake_grant_privileges_to_account_role" "streamlit_usage_account_role_schema_grants" {
  for_each = var.enable_account_roles ? snowflake_schema.schema : {}

  privileges        = local.schema_read_privileges
  account_role_name = snowflake_account_role.streamlit_usage_role[0].name

  on_schema {
    schema_name = "\"${snowflake_database.db.name}\".\"${each.value.name}\""
  }
}

resource "snowflake_grant_privileges_to_account_role" "streamlit_usage_account_role_all_schema_grants" {
  count             = var.enable_account_roles ? 1 : 0
  privileges        = local.schema_read_privileges
  account_role_name = snowflake_account_role.streamlit_usage_role[0].name

  on_schema {
    all_schemas_in_database = snowflake_database.db.name
  }
}

resource "snowflake_grant_privileges_to_account_role" "streamlit_usage_account_role_future_schema_grants" {
  count             = var.enable_account_roles ? 1 : 0
  privileges        = local.schema_read_privileges
  account_role_name = snowflake_account_role.streamlit_usage_role[0].name

  on_schema {
    future_schemas_in_database = snowflake_database.db.name
  }
}

module "streamlit_usage_account_role_object_grants" {
  count  = var.enable_account_roles ? 1 : 0
  source = "../../internal/database_object_grants"

  database_name      = snowflake_database.db.name
  object_type_plural = "STREAMLITS"
  schemas            = [for schema in snowflake_schema.schema : schema.name]
  role_name          = snowflake_account_role.streamlit_usage_role[0].name
  role_type          = "account"
  privileges         = ["USAGE"]
}

############### DATABASE ROLES ################
resource "snowflake_database_role" "streamlit_usage_role" {
  count    = var.enable_database_roles ? 1 : 0
  name     = "DB_STREAMLIT_USAGE"
  database = snowflake_database.db.name
  comment  = "Managed by Terraform"
}

resource "snowflake_grant_ownership" "streamlit_usage_role_ownership" {
  count               = var.enable_database_roles ? 1 : 0
  account_role_name   = "USERADMIN"
  outbound_privileges = "COPY"
  on {
    object_type = "DATABASE ROLE"
    object_name = "${snowflake_database.db.name}.${snowflake_database_role.streamlit_usage_role[0].name}"
  }
}

resource "snowflake_grant_database_role" "streamlit_usage_role_sysadmin_grant" {
  count              = var.enable_database_roles && var.grant_roles_to_sysadmin ? 1 : 0
  database_role_name = "${snowflake_database.db.name}.${snowflake_database_role.streamlit_usage_role[0].name}"
  parent_role_name   = "SYSADMIN"
}

resource "snowflake_grant_database_role" "streamlit_usage_to_all_streamlit_usage" {
  count              = var.enable_database_roles && var.grant_streamlit_usage_to_all_streamlit_usage ? 1 : 0
  database_role_name = "${snowflake_database.db.name}.${snowflake_database_role.streamlit_usage_role[0].name}"
  parent_role_name   = "ALL_STREAMLIT_USAGE"
}

resource "snowflake_grant_privileges_to_database_role" "streamlit_usage_role_database_grants" {
  count              = var.enable_database_roles ? 1 : 0
  privileges         = local.db_read_privileges
  database_role_name = "${snowflake_database.db.name}.${snowflake_database_role.streamlit_usage_role[0].name}"
  on_database        = snowflake_database.db.name
}

resource "snowflake_grant_privileges_to_database_role" "streamlit_usage_role_schema_grants" {
  for_each = var.enable_database_roles ? snowflake_schema.schema : {}

  privileges         = local.schema_read_privileges
  database_role_name = "${snowflake_database.db.name}.${snowflake_database_role.streamlit_usage_role[0].name}"

  on_schema {
    schema_name = "\"${snowflake_database.db.name}\".\"${each.value.name}\""
  }
}

resource "snowflake_grant_privileges_to_database_role" "streamlit_usage_role_all_schema_grants" {
  count              = var.enable_database_roles ? 1 : 0
  privileges         = local.schema_read_privileges
  database_role_name = "${snowflake_database.db.name}.${snowflake_database_role.streamlit_usage_role[0].name}"

  on_schema {
    all_schemas_in_database = snowflake_database.db.name
  }
}

resource "snowflake_grant_privileges_to_database_role" "streamlit_usage_role_future_schema_grants" {
  count              = var.enable_database_roles ? 1 : 0
  privileges         = local.schema_read_privileges
  database_role_name = "${snowflake_database.db.name}.${snowflake_database_role.streamlit_usage_role[0].name}"

  on_schema {
    future_schemas_in_database = snowflake_database.db.name
  }
}

module "streamlit_usage_database_role_object_grants" {
  count  = var.enable_database_roles ? 1 : 0
  source = "../../internal/database_object_grants"

  database_name      = snowflake_database.db.name
  object_type_plural = "STREAMLITS"
  schemas            = [for schema in snowflake_schema.schema : schema.name]
  role_name          = snowflake_database_role.streamlit_usage_role[0].name
  role_type          = "database"
  privileges         = ["USAGE"]
}