data "aws_caller_identity" "current" {}

data "aws_iam_openid_connect_provider" "terraform_cloud" {
  count = var.create_tfc_oidc_provider ? 0 : 1
  url   = "https://app.terraform.io"
}

locals {
  account_id = data.aws_caller_identity.current.account_id

  hcp_sub_prefix = "organization:${var.hcp_organization}:project:${var.hcp_project}:workspace:${var.hcp_workload_workspace}:run_phase"

  tfc_oidc_arn = var.create_tfc_oidc_provider ? aws_iam_openid_connect_provider.terraform_cloud[0].arn : data.aws_iam_openid_connect_provider.terraform_cloud[0].arn

  github_deploy_role_arn = "arn:aws:iam::${local.account_id}:role/tf-managed/${var.github_deploy_role_name}"
  eb_ec2_role_arn        = "arn:aws:iam::${local.account_id}:role/tf-managed/${var.eb_ec2_role_name}"
  github_oidc_arn        = "arn:aws:iam::${local.account_id}:oidc-provider/token.actions.githubusercontent.com"
  hosted_zone_arn        = "arn:aws:route53:::hostedzone/${var.hosted_zone_id}"
  eb_service_role_arn    = "arn:aws:iam::${local.account_id}:role/${var.eb_service_role_name}"

  application_arn = "arn:aws:elasticbeanstalk:${var.aws_region}:${local.account_id}:application/${var.eb_application_name}"
  environment_arn = "arn:aws:elasticbeanstalk:${var.aws_region}:${local.account_id}:environment/${var.eb_application_name}/${var.eb_environment_name}"
  rds_arn         = "arn:aws:rds:${var.aws_region}:${local.account_id}:db:${var.rds_identifier}"

  live_protected_role_arns = [
    "arn:aws:iam::${local.account_id}:role/githubdeploy-shoc-backend-dev",
    "arn:aws:iam::${local.account_id}:role/cdk-hnb659fds-*",
    "arn:aws:iam::${local.account_id}:role/OrganizationAccountAccessRole",
    "arn:aws:iam::${local.account_id}:role/shoc-backend-dev",
  ]

  live_eb_environment_arn = "arn:aws:elasticbeanstalk:${var.aws_region}:${local.account_id}:environment/shoc-backend/shoc-backend-dev"
  live_cfn_stack_arn      = "arn:aws:cloudformation:${var.aws_region}:${local.account_id}:stack/awseb-e-hehnrqjjrt-stack/*"
}

resource "terraform_data" "account_guard" {
  lifecycle {
    precondition {
      condition     = local.account_id == var.aws_account_id
      error_message = "Refuse to apply outside seahaven-external-dev (${var.aws_account_id}). Caller is ${local.account_id}."
    }
  }
}