locals {
  hf_callback = "https://chat.quorate.internal/login/callback"
}

resource "zitadel_project" "hf_chat_ui" {
  org_id                   = zitadel_org.primary.id
  name                     = "HF Chat UI"
  project_role_assertion   = true
  project_role_check       = true
  has_project_check        = false
  private_labeling_setting = "PRIVATE_LABELING_SETTING_UNSPECIFIED"
}

resource "zitadel_project_role" "hf_chat_ui" {
  org_id       = zitadel_org.primary.id
  project_id   = zitadel_project.hf_chat_ui.id
  role_key     = "hf_chat_ui_user"
  display_name = "HF Chat UI user"
  group        = "HF Chat UI"
}

resource "zitadel_application_oidc" "hf_chat_ui" {
  org_id                       = zitadel_org.primary.id
  project_id                   = zitadel_project.hf_chat_ui.id
  name                         = "HF Chat UI"
  redirect_uris                = [local.hf_callback]
  response_types               = ["OIDC_RESPONSE_TYPE_CODE"]
  grant_types                  = ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE", "OIDC_GRANT_TYPE_REFRESH_TOKEN"]
  post_logout_redirect_uris    = ["https://chat.quorate.internal"]
  app_type                     = "OIDC_APP_TYPE_WEB"
  auth_method_type             = "OIDC_AUTH_METHOD_TYPE_BASIC"
  version                      = "OIDC_VERSION_1_0"
  clock_skew                   = "0s"
  dev_mode                     = false
  access_token_type            = "OIDC_TOKEN_TYPE_BEARER"
  access_token_role_assertion  = false
  id_token_role_assertion      = false
  id_token_userinfo_assertion  = true
  additional_origins           = []
  skip_native_app_success_page = false
}

resource "vault_kv_secret_v2" "hf_chat_ui_oidc" {
  mount = var.vault_kv_mount
  name  = "hf-chat-ui/oidc/zitadel"

  data_json = jsonencode({
    OPENID_CLIENT_ID     = zitadel_application_oidc.hf_chat_ui.client_id
    OPENID_CLIENT_SECRET = zitadel_application_oidc.hf_chat_ui.client_secret
    client_id            = zitadel_application_oidc.hf_chat_ui.client_id
    client_secret        = zitadel_application_oidc.hf_chat_ui.client_secret
    discovery_url        = "https://${var.zitadel_domain}/.well-known/openid-configuration"
    redirect_uri         = local.hf_callback
  })

  lifecycle {
    ignore_changes = [data_json]
    replace_triggered_by = [
      zitadel_application_oidc.hf_chat_ui,
    ]
  }
}

resource "zitadel_user_grant" "hf_chat_ui" {
  org_id     = zitadel_org.primary.id
  project_id = zitadel_project.hf_chat_ui.id
  user_id    = var.service_admin_zitadel_user_id
  role_keys  = [zitadel_project_role.hf_chat_ui.role_key]
}