# Cloudflare Zero Trust Access — stage.neurontechnologies.ai
# Protects the staging marketing site with Google OAuth.
# Only @neurontechnologies.ai addresses and Tim's personal Gmail are allowed in.

locals {
  stage_allowed_emails = [
    "1timlingo@gmail.com",
  ]
}

resource "cloudflare_zero_trust_access_application" "nt_stage" {
  zone_id                   = local.zone_neurontechnologies_ai
  name                      = "Neuron Stage"
  domain                    = "stage.neurontechnologies.ai"
  type                      = "self_hosted"
  session_duration          = "24h"
  allowed_idps              = ["808f1913-5a8e-4a97-9e68-8ec58e362110"] # Google
  auto_redirect_to_identity = true
}

resource "cloudflare_zero_trust_access_policy" "nt_stage_allow_domain" {
  application_id = cloudflare_zero_trust_access_application.nt_stage.id
  account_id     = var.cloudflare_account_id
  name           = "Allow neurontechnologies.ai domain"
  precedence     = 1
  decision       = "allow"

  include {
    email_domain = ["neurontechnologies.ai"]
  }
}

resource "cloudflare_zero_trust_access_policy" "nt_stage_allow_tim" {
  application_id = cloudflare_zero_trust_access_application.nt_stage.id
  account_id     = var.cloudflare_account_id
  name           = "Allow Tim personal Gmail"
  precedence     = 2
  decision       = "allow"

  include {
    email = local.stage_allowed_emails
  }
}