variable "zitadel_org_name" {
  description = "Name of the primary service organization to create in ZITADEL."
  type        = string
  default     = "Quorate"
}

variable "zitadel_org_id" {
  description = "Optional stable custom ID for the primary service organization. Leave null to let ZITADEL generate one."
  type        = string
  default     = null
}

variable "zitadel_project_name" {
  description = "Name of the ZITADEL project that groups service clients."
  type        = string
  default     = "Services"
}

variable "forgejo_base_url" {
  description = "Canonical Forgejo URL. This must match the Forgejo HTTPRoute hostname and ROOT_URL."
  type        = string
  default     = "https://forge.quorate.internal"
}

variable "forgejo_oauth_provider_name" {
  description = "Forgejo OAuth2 authentication source name; this value is part of the callback URL."
  type        = string
  default     = "Zitadel"
}

variable "vault_kv_mount" {
  description = "Vault KV v2 mount where generated service integration secrets are mirrored."
  type        = string
  default     = "secret"
}

variable "forgejo_oidc_vault_path" {
  description = "Vault KV path for Forgejo's ZITADEL OIDC client material."
  type        = string
  default     = "forgejo/oidc/zitadel"
}

variable "stalwart_oidc_vault_path" {
  description = "Vault KV path containing Stalwart's ZITADEL resource-server metadata."
  type        = string
  default     = "stalwart/oidc/zitadel"
}

variable "stalwart_zitadel_notification_vault_path" {
  description = "Vault KV path containing Stalwart's ZITADEL notification SMTP credentials."
  type        = string
  default     = "stalwart/zitadel-notification"
}

variable "stalwart_project_name" {
  description = "Name of the dedicated ZITADEL project for Stalwart tokens."
  type        = string
  default     = "Stalwart"
}

variable "stalwart_admin_zitadel_user_id" {
  description = "ZITADEL human user ID granted Stalwart administrative access."
  type        = string
  default     = "********"
}

variable "forgejo_public_base_url" {
  description = "Canonical authenticated URL for the public Forgejo database."
  type        = string
  default     = "https://git.quorate.dev"
}

variable "forgejo_public_oauth_provider_name" {
  description = "Public Forgejo OAuth2 authentication source name."
  type        = string
  default     = "Zitadel"
}

variable "forgejo_public_oidc_vault_path" {
  description = "Vault KV path for public Forgejo's ZITADEL OIDC client material."
  type        = string
  default     = "forgejo-public/oidc/zitadel"
}

variable "service_admin_zitadel_user_id" {
  description = "ZITADEL human user ID granted administrative access to GitOps-managed service applications."
  type        = string
  default     = "********"
}

variable "service_admin_zitadel_role_keys" {
  description = "Service project role keys assigned to service_admin_zitadel_user_id."
  type        = set(string)
  default = [
    "forgejo_admin",
    "frigate_admin",
    "grafana_admin",
    "longhorn_admin",
    "quay_admin",
  ]

  validation {
    condition = alltrue([
      for role_key in var.service_admin_zitadel_role_keys : contains([
        "forgejo_user",
        "forgejo_admin",
        "forgejo_restricted",
        "frigate_viewer",
        "frigate_admin",
        "grafana_viewer",
        "grafana_editor",
        "grafana_admin",
        "longhorn_admin",
        "quay_user",
        "quay_admin",
      ], role_key)
    ])
    error_message = "Service admin ZITADEL grants may only use known Forgejo, Frigate, Grafana, Longhorn, and Quay role keys."
  }
}

variable "frigate_base_url" {
  description = "Canonical Frigate URL. This must match the Frigate HTTPRoute hostname and oauth2-proxy redirect URL."
  type        = string
  default     = "https://frigate.quorate.internal"
}

variable "frigate_zitadel_user_grants" {
  description = "Map of ZITADEL user IDs to Frigate role keys to grant. Valid role keys are frigate_viewer and frigate_admin."
  type        = map(set(string))
  default     = {}

  validation {
    condition = alltrue(flatten([
      for _, role_keys in var.frigate_zitadel_user_grants : [
        for role_key in role_keys : contains([
          "frigate_viewer",
          "frigate_admin",
        ], role_key)
      ]
    ]))
    error_message = "Frigate ZITADEL grants may only use frigate_viewer and frigate_admin."
  }
}

variable "forgejo_zitadel_user_grants" {
  description = "Map of ZITADEL user IDs to Forgejo role keys to grant. Valid role keys are forgejo_user, forgejo_admin, and forgejo_restricted."
  type        = map(set(string))
  default     = {}

  validation {
    condition = alltrue(flatten([
      for _, role_keys in var.forgejo_zitadel_user_grants : [
        for role_key in role_keys : contains([
          "forgejo_user",
          "forgejo_admin",
          "forgejo_restricted",
        ], role_key)
      ]
    ]))
    error_message = "Forgejo ZITADEL grants may only use forgejo_user, forgejo_admin, and forgejo_restricted."
  }
}

variable "grafana_base_url" {
  description = "Canonical Grafana URL. This must match the Grafana HTTPRoute hostname and root URL."
  type        = string
  default     = "https://grafana.quorate.internal"
}

variable "grafana_oidc_vault_path" {
  description = "Vault KV path for Grafana's ZITADEL OIDC client material."
  type        = string
  default     = "grafana/oidc/zitadel"
}

variable "grafana_zitadel_user_grants" {
  description = "Map of ZITADEL user IDs to Grafana role keys to grant. Valid role keys are grafana_viewer, grafana_editor, and grafana_admin."
  type        = map(set(string))
  default     = {}

  validation {
    condition = alltrue(flatten([
      for _, role_keys in var.grafana_zitadel_user_grants : [
        for role_key in role_keys : contains([
          "grafana_viewer",
          "grafana_editor",
          "grafana_admin",
        ], role_key)
      ]
    ]))
    error_message = "Grafana ZITADEL grants may only use grafana_viewer, grafana_editor, and grafana_admin."
  }
}

variable "longhorn_base_url" {
  description = "Canonical Longhorn URL. This must match the Longhorn HTTPRoute hostname and oauth2-proxy redirect URL."
  type        = string
  default     = "https://longhorn.quorate.internal"
}

variable "stalwart_account_webui_base_url" {
  description = "Public Stalwart account WebUI base URL."
  type        = string
  default     = "https://mail.quorate.dev"
}

variable "longhorn_oauth2_proxy_vault_path" {
  description = "Vault KV path for Longhorn's oauth2-proxy OIDC client material."
  type        = string
  default     = "longhorn/oauth2-proxy"
}

variable "longhorn_zitadel_user_grants" {
  description = "Map of ZITADEL user IDs to Longhorn role keys to grant. Valid role key is longhorn_admin."
  type        = map(set(string))
  default     = {}

  validation {
    condition = alltrue(flatten([
      for _, role_keys in var.longhorn_zitadel_user_grants : [
        for role_key in role_keys : contains([
          "longhorn_admin",
        ], role_key)
      ]
    ]))
    error_message = "Longhorn ZITADEL grants may only use longhorn_admin."
  }
}

variable "quay_base_url" {
  description = "Canonical Quay URL. This must match the Quay HTTPRoute hostname and SERVER_HOSTNAME."
  type        = string
  default     = "https://registry.quorate.internal"
}

variable "quay_oidc_vault_path" {
  description = "Vault KV path for Quay's ZITADEL OIDC client material."
  type        = string
  default     = "quay/oidc/zitadel"
}

variable "quay_zitadel_user_grants" {
  description = "Map of ZITADEL user IDs to Quay role keys to grant. Valid role keys are quay_user and quay_admin."
  type        = map(set(string))
  default     = {}

  validation {
    condition = alltrue(flatten([
      for _, role_keys in var.quay_zitadel_user_grants : [
        for role_key in role_keys : contains([
          "quay_user",
          "quay_admin",
        ], role_key)
      ]
    ]))
    error_message = "Quay ZITADEL grants may only use quay_user and quay_admin."
  }
}