infrastructure/servers/gcp/stripe-billing.tf

# ── Stripe Billing — Secret Manager resources ─────────────────────────────────
#
# Secrets are created here as empty shell resources. Values are populated by:
#   scripts/provision_stripe_billing.py --env live
#   scripts/provision_stripe_billing.py --env test
#
# The provisioning script creates the secret versions via gcloud CLI after
# calling the Stripe API to create the meters, products, and prices.
#
# DO NOT hardcode secret values here.

# ── Stripe core secrets (existing — registered here for Terraform management) ──

resource "google_secret_manager_secret" "stripe_secret_key" {
  secret_id = "stripe-secret-key"
  project   = var.project_id
  replication {
    auto {}
  }

  lifecycle {
    ignore_changes = [replication]
  }
}

resource "google_secret_manager_secret" "stripe_webhook_secret" {
  secret_id = "stripe-webhook-secret"
  project   = var.project_id
  replication {
    auto {}
  }

  lifecycle {
    ignore_changes = [replication]
  }
}

# ── Plan flat price IDs ────────────────────────────────────────────────────────

resource "google_secret_manager_secret" "stripe_price_free_plan" {
  secret_id = "stripe-price-free-plan"
  project   = var.project_id
  replication {
    auto {}
  }
}

resource "google_secret_manager_secret" "stripe_price_professional_plan" {
  secret_id = "stripe-price-professional-plan"
  project   = var.project_id
  replication {
    auto {}
  }
}

resource "google_secret_manager_secret" "stripe_price_founding_plan" {
  secret_id = "stripe-price-founding-plan"
  project   = var.project_id
  replication {
    auto {}
  }
}

# ── Billing Meter IDs ─────────────────────────────────────────────────────────

resource "google_secret_manager_secret" "stripe_meter_id_input_tokens" {
  secret_id = "stripe-meter-id-input-tokens"
  project   = var.project_id
  replication {
    auto {}
  }
}

resource "google_secret_manager_secret" "stripe_meter_id_output_tokens" {
  secret_id = "stripe-meter-id-output-tokens"
  project   = var.project_id
  replication {
    auto {}
  }
}

# ── Overage price IDs — Free plan ─────────────────────────────────────────────

resource "google_secret_manager_secret" "stripe_price_free_input_overage" {
  secret_id = "stripe-price-free-input-overage"
  project   = var.project_id
  replication {
    auto {}
  }
}

resource "google_secret_manager_secret" "stripe_price_free_output_overage" {
  secret_id = "stripe-price-free-output-overage"
  project   = var.project_id
  replication {
    auto {}
  }
}

# ── Overage price IDs — Professional plan ─────────────────────────────────────

resource "google_secret_manager_secret" "stripe_price_professional_input_overage" {
  secret_id = "stripe-price-professional-input-overage"
  project   = var.project_id
  replication {
    auto {}
  }
}

resource "google_secret_manager_secret" "stripe_price_professional_output_overage" {
  secret_id = "stripe-price-professional-output-overage"
  project   = var.project_id
  replication {
    auto {}
  }
}

# ── Overage price IDs — Founding Member plan ──────────────────────────────────

resource "google_secret_manager_secret" "stripe_price_founding_input_overage" {
  secret_id = "stripe-price-founding-input-overage"
  project   = var.project_id
  replication {
    auto {}
  }
}

resource "google_secret_manager_secret" "stripe_price_founding_output_overage" {
  secret_id = "stripe-price-founding-output-overage"
  project   = var.project_id
  replication {
    auto {}
  }
}

# ── Secret accessor grants for Soma SA ────────────────────────────────────────
# soma_secret_accessor already has roles/secretmanager.secretAccessor on the
# project, so new secrets are automatically accessible. No per-secret grants needed.

# ── Outputs ───────────────────────────────────────────────────────────────────

output "stripe_billing_secrets" {
  description = "Stripe billing secret IDs — populate via provision_stripe_billing.py"
  value = {
    stripe_secret_key              = google_secret_manager_secret.stripe_secret_key.secret_id
    stripe_webhook_secret          = google_secret_manager_secret.stripe_webhook_secret.secret_id
    stripe_price_free_plan         = google_secret_manager_secret.stripe_price_free_plan.secret_id
    stripe_price_professional_plan = google_secret_manager_secret.stripe_price_professional_plan.secret_id
    stripe_price_founding_plan     = google_secret_manager_secret.stripe_price_founding_plan.secret_id
    stripe_meter_id_input_tokens   = google_secret_manager_secret.stripe_meter_id_input_tokens.secret_id
    stripe_meter_id_output_tokens  = google_secret_manager_secret.stripe_meter_id_output_tokens.secret_id
  }
}