terraform {
  required_version = ">= 1.5.0"

  required_providers {
    google = {
      source  = "hashicorp/google"
      version = ">= 5.0"
    }
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
}

variable "project_id" {
  description = "GCP project ID to scan with Watchmen."
  type        = string
}

variable "region" {
  description = "Default provider region."
  type        = string
  default     = "us-central1"
}

variable "service_account_id" {
  description = "Service account ID for Watchmen scanning."
  type        = string
  default     = "watchmen-scanner"
}

variable "enable_services" {
  description = "Enable the GCP APIs commonly scanned by Watchmen."
  type        = bool
  default     = true
}

locals {
  services = toset([
    "artifactregistry.googleapis.com",
    "bigquery.googleapis.com",
    "cloudasset.googleapis.com",
    "cloudresourcemanager.googleapis.com",
    "cloudtrace.googleapis.com",
    "compute.googleapis.com",
    "container.googleapis.com",
    "containeranalysis.googleapis.com",
    "iam.googleapis.com",
    "logging.googleapis.com",
    "pubsub.googleapis.com",
    "run.googleapis.com",
    "secretmanager.googleapis.com",
    "sqladmin.googleapis.com",
    "storage.googleapis.com",
  ])

  project_roles = toset([
    "roles/browser",
    "roles/viewer",
    "roles/bigquery.metadataViewer",
    "roles/cloudsql.viewer",
    "roles/compute.viewer",
    "roles/container.viewer",
    "roles/iam.securityReviewer",
    "roles/iam.serviceAccountViewer",
    "roles/logging.viewer",
    "roles/cloudtrace.user",
    "roles/containeranalysis.occurrences.viewer",
    "roles/pubsub.viewer",
    "roles/run.viewer",
    "roles/secretmanager.viewer",
    "roles/storage.viewer",
  ])
}

resource "google_project_service" "watchmen" {
  for_each = var.enable_services ? local.services : toset([])

  project            = var.project_id
  service            = each.value
  disable_on_destroy = false
}

resource "google_service_account" "watchmen_scanner" {
  project      = var.project_id
  account_id   = var.service_account_id
  display_name = "Watchmen Scanner"
  description  = "Read-only service account used by Watchmen for GCP scanning."

  depends_on = [google_project_service.watchmen]
}

resource "google_project_iam_member" "watchmen_scanner" {
  for_each = local.project_roles

  project = var.project_id
  role    = each.value
  member  = "serviceAccount:${google_service_account.watchmen_scanner.email}"
}

resource "google_service_account_key" "watchmen_scanner" {
  service_account_id = google_service_account.watchmen_scanner.name
}

output "service_account_email" {
  description = "GCP service account configured for Watchmen scanning."
  value       = google_service_account.watchmen_scanner.email
}

output "service_account_key_json" {
  description = "Paste this JSON into Watchmen Settings -> Cloud Credentials -> GCP."
  value       = base64decode(google_service_account_key.watchmen_scanner.private_key)
  sensitive   = true
}

output "service_account_key_base64" {
  description = "Use this value for GCP_SERVICE_ACCOUNT_KEY if you still configure GCP by env var."
  value       = google_service_account_key.watchmen_scanner.private_key
  sensitive   = true
}