# Project, roles and default-org lookup.
#
# ZITADEL has no group object. The plan §1.3 maps every Authentik group to a
# project role, and the groups-claim action (actions.tf) reconstructs the
# `groups` claim from those role keys. Role keys therefore EQUAL the existing
# Authentik group names, including the hyphens, so that the resulting claim is
# byte-identical and no consumer or RBAC file changes. The v4.19.2 API allows
# role keys of 1-200 characters with no character-set restriction (proto
# zitadel/project/v2/project_service.proto, AddProjectRole.role_key).

data "zitadel_org" "default" {
  id = var.org_id
}

locals {
  # Single source: the 19 groups of scripts/iam/provision-rbac.py GROUPS.
  # Descriptions are carried over so the console reads the same as before.
  roles = {
    "homelab-admins"       = "Cluster administrators with full access"
    "minio-admins"         = "MinIO administrators"
    "minio-photos"         = "Photos bucket (Immich) access"
    "minio-documents"      = "Documents bucket (Paperless) access"
    "minio-backups"        = "Backups bucket read-only access"
    "poimen-admins"        = "Poimen memory administrators"
    "poimen-devs"          = "Dev and staging projects access"
    "poimen-prod-readonly" = "Production projects read-only access"
    "paperless-admins"     = "Paperless administrators"
    "paperless-finance"    = "Finance documents"
    "paperless-legal"      = "Legal documents"
    "paperless-hr"         = "HR documents"
    "grafana-admins"       = "Grafana administrators"
    "grafana-editors"      = "Grafana dashboard editors"
    "grafana-viewers"      = "Grafana dashboard viewers"
    "sqs-users"            = "SQS/Temporal queue read access"
    "sqs-writers"          = "SQS/Temporal queue read/write access"
    "s3-users"             = "S3 read access"
    "s3-writers"           = "S3 read/write access"
  }
}

resource "zitadel_project_v2" "homelab" {
  org_id             = data.zitadel_org.default.id
  name               = var.project_name
  project_id         = var.project_id
  project_role_check = false

  # Roles must reach the tokens. Every consumer authorizes on them:
  # kube-apiserver RBAC reads `groups`, MinIO reads bucket policies, Grafana
  # reads grafana_org_role. Role assertion on the ID token is what most OIDC
  # clients inspect.
  project_role_assertion = true
}

resource "zitadel_project_role" "groups" {
  for_each = local.roles

  org_id       = data.zitadel_org.default.id
  project_id   = zitadel_project_v2.homelab.id
  role_key     = each.key
  display_name = each.key
  group        = "homelab"
}