locals {
  service_admin_zitadel_user_grants = {
    (var.service_admin_zitadel_user_id) = var.service_admin_zitadel_role_keys
  }

  service_grant_user_ids = setunion(
    keys(local.service_admin_zitadel_user_grants),
    keys(var.frigate_zitadel_user_grants),
    keys(var.forgejo_zitadel_user_grants),
    keys(var.grafana_zitadel_user_grants),
    keys(var.longhorn_zitadel_user_grants),
    keys(var.quay_zitadel_user_grants),
  )

  service_zitadel_user_grants = {
    for user_id in local.service_grant_user_ids : user_id => toset(flatten([
      tolist(lookup(local.service_admin_zitadel_user_grants, user_id, toset([]))),
      tolist(lookup(var.frigate_zitadel_user_grants, user_id, toset([]))),
      tolist(lookup(var.forgejo_zitadel_user_grants, user_id, toset([]))),
      tolist(lookup(var.grafana_zitadel_user_grants, user_id, toset([]))),
      tolist(lookup(var.longhorn_zitadel_user_grants, user_id, toset([]))),
      tolist(lookup(var.quay_zitadel_user_grants, user_id, toset([]))),
    ]))
  }
}

resource "zitadel_user_grant" "services" {
  for_each = local.service_zitadel_user_grants

  org_id     = zitadel_org.primary.id
  project_id = zitadel_project.services.id
  user_id    = each.key
  role_keys  = each.value

  depends_on = [
    zitadel_project_role.forgejo,
    zitadel_project_role.frigate,
    zitadel_project_role.grafana,
    zitadel_project_role.longhorn,
    zitadel_project_role.quay,
  ]
}