# svfe's oauth client metadata is the one public thing, since the pds fetches it itself. deploy
# writes it from the source it builds, so its scope can't drift from core's
resource "google_storage_bucket" "oauth_metadata" {
  count = try(local.env.oauth_metadata, null) == null ? 0 : 1

  project                     = local.project
  name                        = local.env.oauth_metadata.bucket
  location                    = local.region
  uniform_bucket_level_access = true
}

resource "google_storage_bucket_iam_member" "oauth_metadata_public" {
  count = try(local.env.oauth_metadata, null) == null ? 0 : 1

  bucket = google_storage_bucket.oauth_metadata[0].name
  role   = "roles/storage.objectViewer"
  member = "allUsers"
}

# in control because the blueprint's deployer can't set iap policy
resource "google_iap_web_cloud_run_service_iam_member" "svfe" {
  for_each = {
    for p in setproduct(try(local.env.iap_members, []), distinct([for c in local.env.regions : c.region])) :
    "${p[0]}/${p[1]}" => p
  }

  project                = local.project
  location               = each.value[1]
  cloud_run_service_name = "svfe-${local.env.env_suffix}"
  role                   = "roles/iap.httpsResourceAccessor"
  member                 = each.value[0]

  # the service only exists once the blueprint has run
  depends_on = [google_config_deployment.this]
}