# Cloudflare Zero Trust Access — Plane project management
# Protects plane.neuralplatform.ai with Google OAuth.

locals {
  plane_zone_id        = local.zone_neuralplatform_ai
  plane_allowed_emails = [
    "andersonwilliam85@gmail.com",
    "1timlingo@gmail.com",
  ]
}

resource "cloudflare_zero_trust_access_application" "plane" {
  zone_id                   = local.plane_zone_id
  name                      = "Plane"
  domain                    = "plane.neuralplatform.ai"
  type                      = "self_hosted"
  session_duration          = "24h"
  allowed_idps              = ["808f1913-5a8e-4a97-9e68-8ec58e362110"] # Google
  auto_redirect_to_identity = true
}

resource "cloudflare_zero_trust_access_policy" "plane_allow" {
  application_id = cloudflare_zero_trust_access_application.plane.id
  account_id     = var.cloudflare_account_id
  name           = "Allow Will and Tim"
  precedence     = 1
  decision       = "allow"

  include {
    email = local.plane_allowed_emails
  }
}