data "oci_email_configuration" "relay" {
  compartment_id = local.tenancy_ocid
}

resource "oci_email_email_domain" "quorate_dev" {
  compartment_id = local.compartment_id
  name           = "quorate.dev"
  description    = "Stalwart outbound mail domain"
}

resource "oci_email_dkim" "quorate_dev" {
  email_domain_id = oci_email_email_domain.quorate_dev.id
  name            = "oci-osaka"
  description     = "OCI Email Delivery signing key"
}

resource "oci_email_sender" "stalwart" {
  for_each = toset(var.email_approved_senders)

  compartment_id = local.compartment_id
  email_address  = each.value

  depends_on = [oci_email_dkim.quorate_dev]
}

resource "oci_identity_user" "stalwart_email_delivery" {
  compartment_id = local.tenancy_ocid
  name           = "stalwart-email-delivery"
  description    = "Stalwart outbound SMTP submission"
  email          = "smtp@quorate.dev"
}

resource "oci_identity_user_capabilities_management" "stalwart_email_delivery" {
  user_id                      = oci_identity_user.stalwart_email_delivery.id
  can_use_api_keys             = false
  can_use_auth_tokens          = false
  can_use_console_password     = false
  can_use_customer_secret_keys = false
  can_use_smtp_credentials     = true
}

resource "oci_identity_group" "stalwart_email_delivery" {
  compartment_id = local.tenancy_ocid
  name           = "stalwart-email-delivery"
  description    = "Principals authorized for Stalwart outbound Email Delivery"
}

resource "oci_identity_user_group_membership" "stalwart_email_delivery" {
  group_id = oci_identity_group.stalwart_email_delivery.id
  user_id  = oci_identity_user.stalwart_email_delivery.id
}

resource "oci_identity_policy" "stalwart_email_delivery" {
  compartment_id = local.tenancy_ocid
  name           = "stalwart-email-delivery"
  description    = "Allow Stalwart to submit through OCI Email Delivery"
  statements = [
    "Allow group ${oci_identity_group.stalwart_email_delivery.name} to use email-family in compartment id ${local.compartment_id}",
  ]
}