resource "zitadel_project" "services" {
  org_id                   = zitadel_org.primary.id
  name                     = var.zitadel_project_name
  project_role_assertion   = true
  project_role_check       = true
  has_project_check        = false
  private_labeling_setting = "PRIVATE_LABELING_SETTING_UNSPECIFIED"
}

resource "zitadel_action" "service_roles_claim" {
  org_id          = zitadel_org.primary.id
  name            = "service_roles_claim"
  timeout         = "10s"
  allowed_to_fail = true

  script = <<-EOT
    function service_roles_claim(ctx, api) {
      api.v1.claims.setClaim('zitadel_action_ran', 'true');

      var grants = ctx.v1.user && ctx.v1.user.grants;
      if (!grants || !grants.grants || grants.count == 0) {
        api.v1.claims.setClaim('groups', []);
        return;
      }

      var roles = [];
      var serviceRoles = [
        'forgejo_user',
        'forgejo_admin',
        'forgejo_restricted',
        'grafana_viewer',
        'grafana_editor',
        'grafana_admin',
        'frigate_viewer',
        'frigate_admin',
        'longhorn_admin',
        'stalwart_admin'
      ];
      grants.grants.forEach(function(grant) {
        if (grant.roles && Array.isArray(grant.roles)) {
          grant.roles.forEach(function(role) {
            if (serviceRoles.indexOf(role) !== -1 && roles.indexOf(role) === -1) {
              roles.push(role);
            }
          });
        }
      });

      var hasForgejoRole = roles.some(function(role) {
        return role.indexOf('forgejo_') === 0;
      });
      if (hasForgejoRole && roles.indexOf('forgejo_login') === -1) {
        roles.push('forgejo_login');
      }

      api.v1.claims.setClaim('groups', roles);
    }
  EOT

  depends_on = [zitadel_project_role.forgejo, zitadel_project_role.frigate, zitadel_project_role.grafana, zitadel_project_role.longhorn, zitadel_project_role.stalwart]
}

resource "zitadel_trigger_actions" "service_roles_claim_userinfo" {
  org_id       = zitadel_org.primary.id
  flow_type    = "FLOW_TYPE_CUSTOMISE_TOKEN"
  trigger_type = "TRIGGER_TYPE_PRE_USERINFO_CREATION"
  action_ids   = [zitadel_action.service_roles_claim.id]
}

resource "zitadel_trigger_actions" "service_roles_claim_access_token" {
  org_id       = zitadel_org.primary.id
  flow_type    = "FLOW_TYPE_CUSTOMISE_TOKEN"
  trigger_type = "TRIGGER_TYPE_PRE_ACCESS_TOKEN_CREATION"
  action_ids   = [zitadel_action.service_roles_claim.id]
}