infrastructure/servers/gcp/service-account.tf

# ── Service Accounts ──────────────────────────────────────────────────────────

resource "google_service_account" "marketing" {
  account_id   = "neuron-marketing-sa"
  display_name = "Neuron Marketing Cloud Run SA"
  description  = "Service account for the neurontechnologies.ai marketing site on Cloud Run"
  project      = var.project_id
}

resource "google_service_account" "accounts" {
  account_id   = "neuron-accounts-sa"
  display_name = "Neuron Accounts Cloud Run SA"
  description  = "Service account for the accounts service (auth, billing, marketplace)"
  project      = var.project_id
}

resource "google_service_account" "api" {
  account_id   = "neuron-api-sa"
  display_name = "Neuron REST API Cloud Run SA"
  description  = "Service account for the neuron-rest API service"
  project      = var.project_id
}

# ── IAM — Secret Manager ──────────────────────────────────────────────────────

resource "google_project_iam_member" "marketing_secret_accessor" {
  project = var.project_id
  role    = "roles/secretmanager.secretAccessor"
  member  = "serviceAccount:${google_service_account.marketing.email}"
}

resource "google_project_iam_member" "accounts_secret_accessor" {
  project = var.project_id
  role    = "roles/secretmanager.secretAccessor"
  member  = "serviceAccount:${google_service_account.accounts.email}"
}

resource "google_project_iam_member" "api_secret_accessor" {
  project = var.project_id
  role    = "roles/secretmanager.secretAccessor"
  member  = "serviceAccount:${google_service_account.api.email}"
}

# ── IAM — Cloud SQL ───────────────────────────────────────────────────────────
# Only accounts connects to Cloud SQL; API and marketing don't need DB access.

resource "google_project_iam_member" "accounts_sql_client" {
  project = var.project_id
  role    = "roles/cloudsql.client"
  member  = "serviceAccount:${google_service_account.accounts.email}"
}

# ── IAM — Public invocation (Cloud Run → LB) ──────────────────────────────────
# allUsers invoker allows the global HTTP(S) load balancer's health checks
# and traffic to reach the services without additional auth headers.

# Marketing
resource "google_cloud_run_v2_service_iam_member" "prod_us_public" {
  project  = var.project_id
  location = "us-central1"
  name     = google_cloud_run_v2_service.prod_us.name
  role     = "roles/run.invoker"
  member   = "allUsers"
}

resource "google_cloud_run_v2_service_iam_member" "prod_eu_public" {
  project  = var.project_id
  location = "europe-west1"
  name     = google_cloud_run_v2_service.prod_eu.name
  role     = "roles/run.invoker"
  member   = "allUsers"
}

resource "google_cloud_run_v2_service_iam_member" "prod_apac_public" {
  project  = var.project_id
  location = "asia-northeast1"
  name     = google_cloud_run_v2_service.prod_apac.name
  role     = "roles/run.invoker"
  member   = "allUsers"
}

# Accounts
resource "google_cloud_run_v2_service_iam_member" "accounts_us_public" {
  project  = var.project_id
  location = "us-central1"
  name     = google_cloud_run_v2_service.accounts_us.name
  role     = "roles/run.invoker"
  member   = "allUsers"
}

resource "google_cloud_run_v2_service_iam_member" "accounts_eu_public" {
  project  = var.project_id
  location = "europe-west1"
  name     = google_cloud_run_v2_service.accounts_eu.name
  role     = "roles/run.invoker"
  member   = "allUsers"
}

resource "google_cloud_run_v2_service_iam_member" "accounts_apac_public" {
  project  = var.project_id
  location = "asia-northeast1"
  name     = google_cloud_run_v2_service.accounts_apac.name
  role     = "roles/run.invoker"
  member   = "allUsers"
}

# API
resource "google_cloud_run_v2_service_iam_member" "api_us_public" {
  project  = var.project_id
  location = "us-central1"
  name     = google_cloud_run_v2_service.api_us.name
  role     = "roles/run.invoker"
  member   = "allUsers"
}

resource "google_cloud_run_v2_service_iam_member" "api_eu_public" {
  project  = var.project_id
  location = "europe-west1"
  name     = google_cloud_run_v2_service.api_eu.name
  role     = "roles/run.invoker"
  member   = "allUsers"
}

resource "google_cloud_run_v2_service_iam_member" "api_apac_public" {
  project  = var.project_id
  location = "asia-northeast1"
  name     = google_cloud_run_v2_service.api_apac.name
  role     = "roles/run.invoker"
  member   = "allUsers"
}

# ── Service accounts brought under Terraform management ───────────────────────
# Created manually; imported into TF state.

resource "google_service_account" "neuron_workspace_dwd" {
  account_id   = "neuron-workspace-dwd"
  display_name = "Neuron Workspace DWD (Gmail access)"
  description  = "Service account for domain-wide delegation to access neuron@neurontechnologies.ai Gmail"
  project      = var.project_id
}

resource "google_service_account" "docuseal_storage" {
  account_id   = "docuseal-storage"
  display_name = "DocuSeal Storage"
  description  = "Storage backend for DocuSeal document signing platform - read/write access to neuron-docuseal-prod bucket only"
  project      = var.project_id
}

resource "google_service_account" "analytics_reader" {
  account_id   = "analytics-reader"
  display_name = "Analytics Reader"
  project      = var.project_id
}

resource "google_service_account" "harmonic_search_console" {
  account_id   = "harmonic-search-console"
  display_name = "Harmonic Framework Search Console"
  description  = "Read-only access to Search Console for harmonic-framework.com"
  project      = var.project_id
}