module "role" {
  source           = "../../../internal/objects_access_database_role"
  database_name    = var.database
  role_name_suffix = "${var.schema}_SCHEMA_${var.agent}_AGENT_USAGE"

  schema_objects_by_type_and_privileges = [
    {
      schema     = var.schema,
      type       = "agent",
      objects    = [var.agent],
      # Pass empty list to avoid using snowflake_grant_privileges_to_database_role for
      # the agent grant, as the provider does not support AGENT as an object type.
      privileges = [],
    },
  ]
}

# Grant USAGE on the agent directly via SQL since the Snowflake provider does not
# yet support AGENT as an object type in snowflake_grant_privileges_to_database_role.
resource "snowflake_execute" "agent_grant" {
  execute = "GRANT USAGE ON AGENT \"${var.database}\".\"${var.schema}\".\"${var.agent}\" TO DATABASE ROLE \"${var.database}\".\"${module.role.role_name}\""
  revert  = "REVOKE USAGE ON AGENT \"${var.database}\".\"${var.schema}\".\"${var.agent}\" FROM DATABASE ROLE \"${var.database}\".\"${module.role.role_name}\""
}