provider "aws" {
  region  = var.aws_region
  profile = var.aws_profile

  default_tags {
    tags = merge({
      Environment = var.environment
      ManagedBy   = "TerraformOrOpenTofu"
      Project     = "learn-terraform-capstone"
    }, var.tags)
  }
}

data "aws_caller_identity" "current" {}

resource "terraform_data" "approved_account" {
  input = data.aws_caller_identity.current.account_id

  lifecycle {
    precondition {
      condition     = data.aws_caller_identity.current.account_id == var.expected_aws_account_id
      error_message = "The named AWS profile must resolve to expected_aws_account_id."
    }
  }
}

resource "terraform_data" "production_guardrails" {
  input = var.environment

  lifecycle {
    precondition {
      condition = var.environment != "production" || (
        var.aws_region == "ap-south-1" &&
        var.nat_gateway_mode == "per_az" &&
        var.protect_flow_logs &&
        var.flow_logs_retention_days >= 365
      )
      error_message = "Production requires ap-south-1, per-AZ NAT, protected flow logs, and at least 365-day retention."
    }

    precondition {
      condition = var.gitlab_oidc_provider_arn == null || (
        var.ci_state_bucket_arn != null &&
        var.ci_state_key != null &&
        var.ci_state_kms_key_arn != null &&
        var.ci_permissions_boundary_arn != null
      )
      error_message = "An enabled GitLab OIDC role requires reviewed state and permissions-boundary ARNs."
    }
  }
}

data "aws_availability_zones" "available" {
  state = "available"
}

locals {
  az_names_by_id = zipmap(data.aws_availability_zones.available.zone_ids, data.aws_availability_zones.available.names)
  module_availability_zones = {
    for key, zone in var.availability_zones : key => {
      name                  = local.az_names_by_id[zone.zone_id]
      public_subnet_number  = zone.public_subnet_number
      private_subnet_number = zone.private_subnet_number
    }
  }
}

module "network" {
  source = "../../modules/network"

  name                     = "${var.name}-${var.environment}"
  region                   = var.aws_region
  vpc_cidr                 = var.vpc_cidr
  availability_zones       = local.module_availability_zones
  nat_gateway_mode         = var.nat_gateway_mode
  interface_endpoints      = var.interface_endpoints
  gateway_endpoints        = var.gateway_endpoints
  flow_logs_retention_days = var.flow_logs_retention_days
  protect_flow_logs        = var.protect_flow_logs
  tags                     = var.tags
}