locals {
  grafana_oidc_redirect_uri = "${trim(var.grafana_base_url, "/")}/login/generic_oauth"

  grafana_zitadel_roles = {
    grafana_viewer = {
      display_name = "Grafana viewer"
      group        = "Grafana"
    }
    grafana_editor = {
      display_name = "Grafana editor"
      group        = "Grafana"
    }
    grafana_admin = {
      display_name = "Grafana administrator"
      group        = "Grafana"
    }
  }

  grafana_zitadel_role_keys = keys(local.grafana_zitadel_roles)
}

resource "zitadel_project_role" "grafana" {
  for_each = local.grafana_zitadel_roles

  org_id       = zitadel_org.primary.id
  project_id   = zitadel_project.services.id
  role_key     = each.key
  display_name = each.value.display_name
  group        = each.value.group
}

resource "zitadel_application_oidc" "grafana" {
  org_id                       = zitadel_org.primary.id
  project_id                   = zitadel_project.services.id
  name                         = "Grafana"
  redirect_uris                = [local.grafana_oidc_redirect_uri]
  response_types               = ["OIDC_RESPONSE_TYPE_CODE"]
  grant_types                  = ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE", "OIDC_GRANT_TYPE_REFRESH_TOKEN"]
  post_logout_redirect_uris    = [trim(var.grafana_base_url, "/")]
  app_type                     = "OIDC_APP_TYPE_WEB"
  auth_method_type             = "OIDC_AUTH_METHOD_TYPE_BASIC"
  version                      = "OIDC_VERSION_1_0"
  clock_skew                   = "0s"
  dev_mode                     = false
  access_token_type            = "OIDC_TOKEN_TYPE_BEARER"
  access_token_role_assertion  = false
  id_token_role_assertion      = true
  id_token_userinfo_assertion  = true
  additional_origins           = []
  skip_native_app_success_page = false
}

resource "vault_kv_secret_v2" "grafana_oidc" {
  mount = var.vault_kv_mount
  name  = var.grafana_oidc_vault_path

  data_json = jsonencode({
    GF_AUTH_GENERIC_OAUTH_CLIENT_ID     = zitadel_application_oidc.grafana.client_id
    GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET = zitadel_application_oidc.grafana.client_secret
    client_id                           = zitadel_application_oidc.grafana.client_id
    client_secret                       = zitadel_application_oidc.grafana.client_secret
    discovery_url                       = "https://${var.zitadel_domain}/.well-known/openid-configuration"
    redirect_uri                        = local.grafana_oidc_redirect_uri
  })

  # Vault is source of truth after first write. OIDC credential rotation is explicit.
  lifecycle { ignore_changes = [data_json] }
}