resource "snowflake_database" "test_snowflake_resource" {
  # This resource will FAIL because tests/ is not prod/snowflake/
  name = "test_db"
}

resource "snowflake_schema" "test_snowflake_resource" {
  # This resource will FAIL because tests/ is not prod/snowflake/
  name = "test_schema"
  database = snowflake_database.test_snowflake_resource.name
}

resource "snowflake_warehouse" "test_snowflake_resource" {
  # This resource will FAIL because tests/ is not prod/snowflake/
  name = "test_warehouse"
  warehouse_size = "XSMALL"
}

#---

resource "snowflake_role" "test_snowflake_resource" {
  # This resource will FAIL because tests/ is not prod/snowflake/
  name = "test_role"
}

resource "snowflake_user" "test_snowflake_resource" {
  # This resource will FAIL because tests/ is not prod/snowflake/
  name = "test_user"
  login_name = "test_user"
}

#---

# Additional Snowflake resources for comprehensive testing
resource "snowflake_grant_privileges_to_role" "test_snowflake_resource" {
  # This resource will FAIL because tests/ is not prod/snowflake/
  privileges     = ["USAGE"]
  role_name      = snowflake_role.test_snowflake_resource.name
  database_name  = snowflake_database.test_snowflake_resource.name
}

resource "snowflake_table" "test_snowflake_resource" {
  # This resource will FAIL because tests/ is not prod/snowflake/
  name     = "test_table"
  database = snowflake_database.test_snowflake_resource.name
  schema   = snowflake_schema.test_snowflake_resource.name
  
  column {
    name = "id"
    type = "NUMBER(38,0)"
  }
}

#---

# Examples using terraform-snowflake module
# Note: The policy checks resources inside modules based on where the module is CALLED from,
# not where the module source is located. These will FAIL because tests/ is not prod/snowflake/
module "snowflake_database" {
  # Resources inside this module will FAIL - the calling path (tests/) is not prod/snowflake/
  source = "git@github.com:theorchard/terraform-snowflake.git//modules/database?ref=v7.0.0"
  
  database_name = "EXAMPLE"
}

module "snowflake_service_user" {
  # Resources inside this module will FAIL - the calling path (tests/) is not prod/snowflake/
  source = "git@github.com:theorchard/terraform-snowflake.git//modules/service-user?ref=v7.0.0"
  
  environment    = "QA"
  service_name   = "test-service"
  read_only      = false
  rsa_public_key = "test-key"
  additional_roles = ["TEST_ROLE"]
}

module "snowflake_warehouse" {
  # Resources inside this module will FAIL - the calling path (tests/) is not prod/snowflake/
  source = "git@github.com:theorchard/terraform-snowflake.git//modules/warehouse?ref=v7.0.0"

  warehouse_name = "TEST_WAREHOUSE"
  warehouse_size = "XSMALL"
}

#---

# Excluded resource types: snowflake_stage, snowflake_stage_*, snowflake_storage_integration,
# and snowflake_storage_integration_* are exempt from the placement policy and should PASS
# regardless of directory.

resource "snowflake_stage" "test_excluded" {
  # This resource will PASS - snowflake_stage is excluded from placement enforcement
  name     = "test_stage"
  database = "TEST_DB"
  schema   = "TEST_SCHEMA"
}

resource "snowflake_stage_external_s3" "test_excluded" {
  # This resource will PASS - snowflake_stage_* is excluded from placement enforcement
  name     = "test_stage"
  database = "TEST_DB"
  schema   = "TEST_SCHEMA"
}

resource "snowflake_storage_integration" "test_excluded" {
  # This resource will PASS - snowflake_storage_integration is excluded from placement enforcement
  name    = "test_storage_integration"
  type    = "EXTERNAL_STAGE"
  enabled = true

  storage_allowed_locations = ["s3://test-bucket/"]
  storage_provider          = "S3"
  storage_aws_role_arn      = "arn:aws:iam::123456789012:role/test-role"
}

resource "snowflake_storage_integration_aws" "test_excluded" {
  # This resource will PASS - snowflake_storage_integration_* is excluded from placement enforcement
  name    = "test_storage_integration"
  enabled = true

  storage_allowed_locations = ["s3://test-bucket/"]
  storage_provider          = "S3"
  storage_aws_role_arn      = "arn:aws:iam::123456789012:role/test-role"
}