locals {
  account_login_uri  = "${trim(var.stalwart_account_webui_base_url, "/")}/account/oauth/callback"
  account_logout_uri = "${trim(var.stalwart_account_webui_base_url, "/")}/account/oauth/logout"
  stalwart_zitadel_roles = {
    stalwart_admin = {
      display_name = "Stalwart administrator"
      group        = "Stalwart"
    }
    stalwart_controller = {
      display_name = "Stalwart configuration controller"
      group        = "Stalwart"
    }
    stalwart_submitter = {
      display_name = "Stalwart alert submitter"
      group        = "Stalwart"
    }
    stalwart_notifier = {
      display_name = "Stalwart notification sender"
      group        = "Stalwart"
    }
    stalwart_test = {
      display_name = "Stalwart authenticated client test"
      group        = "Stalwart"
    }
  }

  stalwart_zitadel_role_keys = keys(local.stalwart_zitadel_roles)
}

resource "zitadel_application_oidc" "stalwart_account_webui" {
  org_id                      = zitadel_org.primary.id
  project_id                  = zitadel_project.stalwart.id
  name                        = "Mail app passwords"
  redirect_uris               = [local.account_login_uri]
  response_types              = ["OIDC_RESPONSE_TYPE_CODE"]
  grant_types                 = ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE"]
  post_logout_redirect_uris   = [local.account_logout_uri]
  app_type                    = "OIDC_APP_TYPE_USER_AGENT"
  auth_method_type            = "OIDC_AUTH_METHOD_TYPE_NONE"
  version                     = "OIDC_VERSION_1_0"
  clock_skew                  = "0s"
  dev_mode                    = false
  access_token_type           = "OIDC_TOKEN_TYPE_BEARER"
  access_token_role_assertion = true
  id_token_role_assertion     = true
  id_token_userinfo_assertion = true
}

resource "zitadel_project" "stalwart" {
  org_id                   = zitadel_org.primary.id
  name                     = var.stalwart_project_name
  project_role_assertion   = true
  project_role_check       = true
  has_project_check        = true
  private_labeling_setting = "PRIVATE_LABELING_SETTING_UNSPECIFIED"
}

resource "zitadel_project_role" "stalwart" {
  for_each = local.stalwart_zitadel_roles

  org_id       = zitadel_org.primary.id
  project_id   = zitadel_project.stalwart.id
  role_key     = each.key
  display_name = each.value.display_name
  group        = each.value.group
}

resource "zitadel_machine_user" "stalwart_controller" {
  org_id            = zitadel_org.primary.id
  user_name         = "stalwart-controller"
  name              = "Stalwart configuration controller"
  description       = "Credentialless Stalwart desired-state owner"
  access_token_type = "ACCESS_TOKEN_TYPE_JWT"
  with_secret       = true
}

resource "zitadel_machine_user" "stalwart_sender" {
  org_id            = zitadel_org.primary.id
  user_name         = "stalwart-submitter"
  name              = "Stalwart alert sender"
  description       = "Zitadel-owned Stalwart cluster-local SMTP identity"
  access_token_type = "ACCESS_TOKEN_TYPE_JWT"
  with_secret       = true
}

resource "zitadel_machine_user" "stalwart_notifier" {
  org_id            = zitadel_org.primary.id
  user_name         = "stalwart-notifier"
  name              = "Stalwart notification sender"
  description       = "Zitadel-owned Stalwart notification identity"
  access_token_type = "ACCESS_TOKEN_TYPE_JWT"
  with_secret       = true
}

resource "zitadel_machine_user" "stalwart_test" {
  org_id            = zitadel_org.primary.id
  user_name         = "stalwart-test-client"
  name              = "Stalwart authenticated client test"
  description       = "Zitadel-owned authenticated mail client test identity"
  access_token_type = "ACCESS_TOKEN_TYPE_JWT"
  with_secret       = true
}

resource "zitadel_user_grant" "stalwart_admin" {
  org_id     = zitadel_org.primary.id
  project_id = zitadel_project.stalwart.id
  user_id    = var.stalwart_admin_zitadel_user_id
  role_keys  = ["stalwart_admin"]

  depends_on = [zitadel_project_role.stalwart]
}

resource "zitadel_user_grant" "stalwart_controller" {
  org_id     = zitadel_org.primary.id
  project_id = zitadel_project.stalwart.id
  user_id    = zitadel_machine_user.stalwart_controller.id
  role_keys  = ["stalwart_controller"]

  depends_on = [zitadel_project_role.stalwart]
}

resource "zitadel_user_grant" "stalwart_sender" {
  org_id     = zitadel_org.primary.id
  project_id = zitadel_project.stalwart.id
  user_id    = zitadel_machine_user.stalwart_sender.id
  role_keys  = ["stalwart_submitter"]

  depends_on = [zitadel_project_role.stalwart]
}

resource "zitadel_user_grant" "stalwart_notifier" {
  org_id     = zitadel_org.primary.id
  project_id = zitadel_project.stalwart.id
  user_id    = zitadel_machine_user.stalwart_notifier.id
  role_keys  = ["stalwart_notifier"]

  depends_on = [zitadel_project_role.stalwart]
}

resource "zitadel_user_grant" "stalwart_test" {
  org_id     = zitadel_org.primary.id
  project_id = zitadel_project.stalwart.id
  user_id    = zitadel_machine_user.stalwart_test.id
  role_keys  = ["stalwart_test"]

  depends_on = [zitadel_project_role.stalwart]
}

resource "vault_kv_secret_v2" "stalwart_oidc" {
  mount = var.vault_kv_mount
  name  = var.stalwart_oidc_vault_path

  data_json = jsonencode({
    account_client_id      = zitadel_application_oidc.stalwart_account_webui.client_id
    audience               = zitadel_project.stalwart.id
    client_id              = zitadel_machine_user.stalwart_controller.client_id
    client_secret          = zitadel_machine_user.stalwart_controller.client_secret
    controller_subject     = zitadel_machine_user.stalwart_controller.id
    human_admin_subject    = var.stalwart_admin_zitadel_user_id
    issuer_url             = "https://${var.zitadel_domain}"
    notifier_client_id     = zitadel_machine_user.stalwart_notifier.client_id
    notifier_client_secret = zitadel_machine_user.stalwart_notifier.client_secret
    notifier_subject       = zitadel_machine_user.stalwart_notifier.id
    sender_client_id       = zitadel_machine_user.stalwart_sender.client_id
    sender_client_secret   = zitadel_machine_user.stalwart_sender.client_secret
    sender_subject         = zitadel_machine_user.stalwart_sender.id
    test_client_id         = zitadel_machine_user.stalwart_test.client_id
    test_client_secret     = zitadel_machine_user.stalwart_test.client_secret
    test_subject           = zitadel_machine_user.stalwart_test.id
  })
}

data "vault_kv_secret_v2" "stalwart_zitadel_notification" {
  mount = var.vault_kv_mount
  name  = var.stalwart_zitadel_notification_vault_path
}

resource "zitadel_email_provider_smtp" "stalwart" {
  sender_address = "noreply@quorate.dev"
  sender_name    = "Quorate"
  host           = "stalwart-submission.stalwart.svc.cluster.local:587"
  tls            = false
  user           = "noreply@quorate.dev"
  password       = data.vault_kv_secret_v2.stalwart_zitadel_notification.data["smtp_password"]
  description    = "Stalwart cluster-local notification submission"
  set_active     = true
}