provider "google" {
  project = var.project_id
  region  = var.region
}

resource "google_project_service" "apis" {
  for_each = toset([
    "aiplatform.googleapis.com",
    "storage.googleapis.com",
    "cloudbilling.googleapis.com",
    "cloudresourcemanager.googleapis.com",
    "iam.googleapis.com",
    "run.googleapis.com",
    "artifactregistry.googleapis.com",
    "cloudbuild.googleapis.com",
    "secretmanager.googleapis.com",
    "monitoring.googleapis.com",
    "logging.googleapis.com",
    "cloudtrace.googleapis.com",
    "pubsub.googleapis.com",
    "cloudfunctions.googleapis.com",
  ])
  service                    = each.key
  disable_dependent_services = true
}

resource "google_service_account" "agent_sa" {
  account_id   = "osvauco-agent-sa"
  display_name = "OSVauco Agent Runner SA"
}

resource "google_project_iam_member" "agent_sa_roles" {
  for_each = toset([
    "roles/aiplatform.user",
    "roles/storage.objectAdmin",
    "roles/logging.logWriter",
    "roles/cloudtrace.agent",
    "roles/monitoring.metricWriter",
    "roles/secretmanager.secretAccessor",
    "roles/run.invoker",
  ])
  project = var.project_id
  role    = each.key
  member  = "serviceAccount:${google_service_account.agent_sa.email}"
}

resource "google_pubsub_topic" "billing_alerts" {
  name = "billing-alert-auto-teardown"
}

resource "google_pubsub_subscription" "billing_alerts_sub" {
  name  = "billing-alert-subscription"
  topic = google_pubsub_topic.billing_alerts.name

  # Push to an email address
  push_config {
    push_endpoint = "mailto:${var.alert_email}"
  }
}

resource "google_artifact_registry_repository" "repo" {
  location      = var.artifact_region
  repository_id = var.artifact_repo_name
  format        = "DOCKER"
}

# Managed via Cloud Build CI/CD — not Terraform
# resource "google_cloud_run_v2_service" "agent_service" {
#   name     = var.cloud_run_service_name
#   location = var.cloud_run_region
#
#   template {
#     service_account = google_service_account.agent_sa.email
#
#     containers {
#       image = var.container_image
#       env {
#         name  = "CUSTOMER_ID"
#         value = var.customer_id
#       }
#     }
#   }
#
#   depends_on = [google_project_service.apis]
# }
#
# resource "google_cloud_run_v2_service_iam_member" "invoker" {
#   project  = var.project_id
#   location = google_cloud_run_v2_service.agent_service.location
#   name     = google_cloud_run_v2_service.agent_service.name
#   role     = "roles/run.invoker"
#   member   = "user:chris.christiansen@vauco.no"
# }