# ── Service Account ───────────────────────────────────────────────────────────

resource "google_service_account" "marketing" {
  account_id   = "neuron-marketing-sa"
  display_name = "Neuron Marketing Cloud Run SA"
  description  = "Service account for the neurontechnologies.ai marketing site on Cloud Run"
}

# ── IAM — Secret Manager accessor ─────────────────────────────────────────────
# Grant the SA access to read all marketing secrets from Secret Manager.

resource "google_project_iam_member" "marketing_secret_accessor" {
  project = var.project_id
  role    = "roles/secretmanager.secretAccessor"
  member  = "serviceAccount:${google_service_account.marketing.email}"
}

# ── IAM — Public (unauthenticated) invocation for prod services ───────────────
# Cloud Run v2: allow-unauthenticated is set per-service via google_cloud_run_v2_service_iam_member.

resource "google_cloud_run_v2_service_iam_member" "prod_us_public" {
  project  = var.project_id
  location = "us-central1"
  name     = google_cloud_run_v2_service.prod_us.name
  role     = "roles/run.invoker"
  member   = "allUsers"
}

resource "google_cloud_run_v2_service_iam_member" "prod_eu_public" {
  project  = var.project_id
  location = "europe-west1"
  name     = google_cloud_run_v2_service.prod_eu.name
  role     = "roles/run.invoker"
  member   = "allUsers"
}

resource "google_cloud_run_v2_service_iam_member" "prod_apac_public" {
  project  = var.project_id
  location = "asia-northeast1"
  name     = google_cloud_run_v2_service.prod_apac.name
  role     = "roles/run.invoker"
  member   = "allUsers"
}

resource "google_cloud_run_v2_service_iam_member" "stage_public" {
  project  = var.project_id
  location = "us-central1"
  name     = google_cloud_run_v2_service.stage.name
  role     = "roles/run.invoker"
  member   = "allUsers"

  # Note: Cloudflare Access enforces authentication in front of stage.
  # Cloud Run itself allows allUsers so the LB health checks pass.
}