# ── Cloud Storage ─────────────────────────────────────────────────────────────
# Share card blobs from the marketing landing page demo chat.
# Separate buckets for prod and stage/test.
# Each blob is a small JSON file (~1KB) keyed by share ID.
# Public read so the landing server can serve card pages.
# Marketing SA has write access to upload new cards.

locals {
  share_bucket_labels = {
    "managed-by" = "terraform"
    "project"    = "neuron-marketing"
    "purpose"    = "share-cards"
  }
}

# ── Prod bucket ───────────────────────────────────────────────────────────────

resource "google_storage_bucket" "shares_prod" {
  name          = "neuron-shares-prod"
  project       = var.project_id
  location      = "US"
  storage_class = "STANDARD"

  uniform_bucket_level_access = true

  cors {
    origin          = ["https://neurontechnologies.ai"]
    method          = ["GET"]
    response_header = ["Content-Type"]
    max_age_seconds = 3600
  }

  lifecycle_rule {
    action {
      type = "Delete"
    }
    condition {
      age = 365
    }
  }

  labels = merge(local.share_bucket_labels, { "env" = "prod" })
}

resource "google_storage_bucket_iam_member" "shares_prod_public_read" {
  bucket = google_storage_bucket.shares_prod.name
  role   = "roles/storage.objectViewer"
  member = "allUsers"
}

resource "google_storage_bucket_iam_member" "shares_prod_marketing_write" {
  bucket = google_storage_bucket.shares_prod.name
  role   = "roles/storage.objectUser"
  member = "serviceAccount:${google_service_account.marketing.email}"
}

# ── Stage / test bucket ───────────────────────────────────────────────────────

resource "google_storage_bucket" "shares_stage" {
  name          = "neuron-shares-stage"
  project       = var.project_id
  location      = "US"
  storage_class = "STANDARD"

  uniform_bucket_level_access = true

  cors {
    origin          = ["https://stage.neurontechnologies.ai", "http://localhost:3001"]
    method          = ["GET"]
    response_header = ["Content-Type"]
    max_age_seconds = 3600
  }

  lifecycle_rule {
    action {
      type = "Delete"
    }
    condition {
      age = 30
    }
  }

  labels = merge(local.share_bucket_labels, { "env" = "stage" })
}

resource "google_storage_bucket_iam_member" "shares_stage_public_read" {
  bucket = google_storage_bucket.shares_stage.name
  role   = "roles/storage.objectViewer"
  member = "allUsers"
}

resource "google_storage_bucket_iam_member" "shares_stage_marketing_write" {
  bucket = google_storage_bucket.shares_stage.name
  role   = "roles/storage.objectUser"
  member = "serviceAccount:${google_service_account.marketing.email}"
}