# Test file for ORCD_SNOWFLAKE_2: SnowflakeGrantInApprovedModule
# This policy ensures Snowflake permission-related resources are only used within approved modules

# FAIL: snowflake_grant_* resources at root level (not in any module)
resource "snowflake_grant_privileges_to_role" "fail_root_level" {
  privileges     = ["CREATE USER"]
  account_role_name = "TEST_ROLE"
  on_account = true
}

# FAIL: snowflake_user at root level
resource "snowflake_user" "fail_user_root" {
  name     = "TEST_USER"
}

# FAIL: snowflake_role at root level
resource "snowflake_role" "fail_role_root" {
  name    = "TEST_ROLE"
}

# FAIL: snowflake_account_role at root level
resource "snowflake_account_role" "fail_account_role_root" {
  name    = "TEST_ACCOUNT_ROLE"
}

# FAIL: snowflake_database_role at root level
resource "snowflake_database_role" "fail_database_role_root" {
  database = "TEST_DB"
  name     = "TEST_DB_ROLE"
}

# FAIL: Snowflake permission resources inside non-approved modules
module "non_approved_snowflake_module" {
  source = "./modules/snowflake"
}

# PASS: Snowflake permission resources inside approved terraform-snowflake modules
module "approved_snowflake_module" {
  source = "git@github.com:theorchard/terraform-snowflake.git//modules/warehouse?ref=7.3.1"

  name = "TEST_WH"
}