locals {
  # tags don't seem to be supported by the provider at this time :(
  warehouse                         = var.read_only ? "${upper(var.environment)}_OWS_WAREHOUSE" : "${upper(var.environment)}_ETL_WAREHOUSE"
  warehouse_access_role             = var.read_only ? "${upper(var.environment)}_OWS_WAREHOUSE_WAREHOUSE_ACCESS" : "${upper(var.environment)}_ETL_WAREHOUSE_WAREHOUSE_ACCESS"
  additional_warehouse_access_roles = [for wh in var.additional_warehouses : "${upper(wh)}_WAREHOUSE_ACCESS"]
}

variable "service_name" {
  type        = string
  description = "Service the service user is being created for, required to populate login_name"
  nullable    = false
}

variable "environment" {
  type     = string
  nullable = false
  validation {
    condition     = can(regex("(?i)(dev|qa|uat|prod)", var.environment))
    error_message = "Environment must be one of dev, qa, uat or prod"
  }
}

# Any additional warehouses this service user needs to access can be added here, however the primary warehouse should be the default one
variable "additional_warehouses" {
  type        = list(string)
  description = "Any additional warehouses this service user needs to access can be granted by passing them as a [list]"
  default     = []
}

variable "additional_roles" {
  type        = list(string)
  description = "A list of additional roles to grant to the service user. Typically these will be the names of pre-existing object access roles. If this is left empty, the only roles granted will be warehouse access"
  default     = []
}

variable "additional_database_roles" {
  type        = list(string)
  description = "A list of additional database roles to grant to the service user. These should be pre-existing object access roles defined on the database level ."
  default     = []
}

variable "read_only" {
  type        = bool
  description = "Specify whether the user needs read-only or read/write access to allocate an optimised warehouse. Defaults to true"
  default     = true
}

variable "rsa_public_key" {
  type        = string
  description = "Specifies the user’s RSA public key; used for key-pair authentication. Must be on 1 line without header and trailer"
  default     = null
}