resource "oci_identity_user" "wan_controller" {
  compartment_id = local.tenancy_ocid
  name           = "oci-l4-relay-wan-controller"
  description    = "In-cluster controller for the relay WireGuard NSG source"
  email          = local.publisher_email
}

resource "oci_identity_group" "wan_controllers" {
  compartment_id = local.tenancy_ocid
  name           = "oci-l4-relay-wan-controllers"
  description    = "Principals allowed to update relay NSG security rules"
}

resource "oci_identity_user_group_membership" "wan_controller" {
  group_id = oci_identity_group.wan_controllers.id
  user_id  = oci_identity_user.wan_controller.id
}

resource "oci_identity_api_key" "wan_controller" {
  user_id   = oci_identity_user.wan_controller.id
  key_value = local.wan_controller_public_key
}

resource "oci_identity_user_capabilities_management" "wan_controller" {
  user_id                      = oci_identity_user.wan_controller.id
  can_use_api_keys             = true
  can_use_auth_tokens          = false
  can_use_console_password     = false
  can_use_customer_secret_keys = false
  can_use_smtp_credentials     = false
}

resource "oci_identity_policy" "wan_controller" {
  compartment_id = local.tenancy_ocid
  name           = "oci-l4-relay-wan-controller"
  description    = "Allow the WAN controller to update NSG rules in the relay compartment"
  statements = [
    "Allow group ${oci_identity_group.wan_controllers.name} to manage network-security-groups in compartment id ${local.compartment_id} where request.operation = 'UpdateNetworkSecurityGroupSecurityRules'"
  ]
}