# ── Artifact Registry ─────────────────────────────────────────────────────────
# One repository per service. Images are pushed here from Legion CI runners
# (the only compiled artifacts that cross the boundary to GCP).
# Source code and intelligence stay on Legion — only the built container
# crosses out.

resource "google_artifact_registry_repository" "marketing" {
  location      = "us-central1"
  repository_id = "neuron-marketing"
  description   = "Marketing site (Next.js) Docker images"
  format        = "DOCKER"
  project       = var.project_id

  cleanup_policies {
    id     = "keep-last-10"
    action = "KEEP"
    most_recent_versions {
      keep_count = 10
    }
  }
}

resource "google_artifact_registry_repository" "accounts" {
  location      = "us-central1"
  repository_id = "neuron-accounts"
  description   = "Accounts service (Go) Docker images"
  format        = "DOCKER"
  project       = var.project_id

  cleanup_policies {
    id     = "keep-last-10"
    action = "KEEP"
    most_recent_versions {
      keep_count = 10
    }
  }
}

resource "google_artifact_registry_repository" "api" {
  location      = "us-central1"
  repository_id = "neuron-api"
  description   = "REST API (neuron-rest, Go) Docker images"
  format        = "DOCKER"
  project       = var.project_id

  cleanup_policies {
    id     = "keep-last-10"
    action = "KEEP"
    most_recent_versions {
      keep_count = 10
    }
  }
}

# ── IAM: CI runner pushes images ──────────────────────────────────────────────
# The CI service account (from Legion's Gitea runner) needs Artifact Registry
# writer access so it can push compiled images after each build.

resource "google_service_account" "ci_pusher" {
  account_id   = "neuron-ci-pusher"
  display_name = "Neuron CI Image Pusher"
  description  = "Legion CI runner uses this SA to push compiled images to Artifact Registry"
  project      = var.project_id
}

resource "google_artifact_registry_repository_iam_member" "ci_marketing" {
  project    = var.project_id
  location   = "us-central1"
  repository = google_artifact_registry_repository.marketing.name
  role       = "roles/artifactregistry.writer"
  member     = "serviceAccount:${google_service_account.ci_pusher.email}"
}

resource "google_artifact_registry_repository_iam_member" "ci_accounts" {
  project    = var.project_id
  location   = "us-central1"
  repository = google_artifact_registry_repository.accounts.name
  role       = "roles/artifactregistry.writer"
  member     = "serviceAccount:${google_service_account.ci_pusher.email}"
}

resource "google_artifact_registry_repository_iam_member" "ci_api" {
  project    = var.project_id
  location   = "us-central1"
  repository = google_artifact_registry_repository.api.name
  role       = "roles/artifactregistry.writer"
  member     = "serviceAccount:${google_service_account.ci_pusher.email}"
}

# ── CI pusher Cloud Run deploy permissions ────────────────────────────────────
# The CI SA needs run.developer to deploy new revisions to Cloud Run.
# run.developer grants: services.get, services.update, revisions.list, etc.

resource "google_project_iam_member" "ci_pusher_run_developer" {
  project = var.project_id
  role    = "roles/run.developer"
  member  = "serviceAccount:${google_service_account.ci_pusher.email}"
}

# The CI SA must be able to impersonate each Cloud Run runtime SA when deploying
# new revisions. gcloud run services update requires iam.serviceaccounts.actAs
# on the target service account. Grant serviceAccountUser on each runtime SA.

resource "google_service_account_iam_member" "ci_pusher_act_as_marketing" {
  service_account_id = google_service_account.marketing.name
  role               = "roles/iam.serviceAccountUser"
  member             = "serviceAccount:${google_service_account.ci_pusher.email}"
}

resource "google_service_account_iam_member" "ci_pusher_act_as_accounts" {
  service_account_id = google_service_account.accounts.name
  role               = "roles/iam.serviceAccountUser"
  member             = "serviceAccount:${google_service_account.ci_pusher.email}"
}

resource "google_service_account_iam_member" "ci_pusher_act_as_api" {
  service_account_id = google_service_account.api.name
  role               = "roles/iam.serviceAccountUser"
  member             = "serviceAccount:${google_service_account.ci_pusher.email}"
}

# ── CI pusher JSON key (download once, store in Vault/Secret Manager) ─────────
# After `terraform apply`, create a key and save it to GCP Secret Manager:
#   gcloud iam service-accounts keys create /tmp/ci-pusher.json \
#     --iam-account=$(terraform output -raw ci_pusher_email)
#   gcloud secrets create ci-gcp-sa-key --data-file=/tmp/ci-pusher.json
#   rm /tmp/ci-pusher.json
# Then set it as a repo secret in Gitea: GCP_SA_KEY