resource "scaleway_iam_application" "backup_app" {
  name = "k8s_backup_app"
}

resource "scaleway_iam_policy" "object_read_write_backup" {
  name           = "K8s backup app policy"
  description    = "Gives k8s backup job access to object storage in project"
  application_id = scaleway_iam_application.backup_app.id

  rule {
    project_ids = [data.scaleway_account_project.default.id]
    permission_set_names = [
      "ObjectStorageObjectsWrite",
      "ObjectStorageObjectsRead",
      "ObjectStorageObjectsDelete",
      "ObjectStorageBucketsRead"
    ]
  }
}

resource "scaleway_iam_application" "mail_app" {
  name = "mail_app"
}

resource "scaleway_iam_policy" "email_full_access" {
  name           = "Email full access policy"
  description    = "Gives access to transactional email in project"
  application_id = scaleway_iam_application.mail_app.id

  rule {
    project_ids = [data.scaleway_account_project.default.id]
    permission_set_names = [
      "TransactionalEmailFullAccess",
    ]
  }
}

resource "scaleway_iam_application" "sftpgo_app" {
  name = "sftpgo_app"
}

resource "scaleway_iam_policy" "object_read_write_sftpgo" {
  name           = "SFtpGo app policy"
  description    = "Gives sftpgo job access to object storage in project"
  application_id = scaleway_iam_application.sftpgo_app.id

  rule {
    project_ids = [data.scaleway_account_project.default.id]
    permission_set_names = [
      "ObjectStorageObjectsWrite",
      "ObjectStorageObjectsRead",
      "ObjectStorageBucketsRead",
      "ObjectStorageBucketsWrite",
      "ObjectStorageObjectsDelete"
    ]
  }
}

resource "scaleway_iam_application" "gitea_app" {
  name = "gitea_app"
}

resource "scaleway_iam_policy" "object_read_write_gitea" {
  name           = "Gitea app policy"
  description    = "Gives gitea job access to object storage in project"
  application_id = scaleway_iam_application.gitea_app.id

  rule {
    project_ids = [data.scaleway_account_project.default.id]
    permission_set_names = [
      "ObjectStorageObjectsWrite",
      "ObjectStorageObjectsRead",
      "ObjectStorageBucketsRead",
      "ObjectStorageBucketsWrite",
      "ObjectStorageObjectsDelete"
    ]
  }
}

resource "scaleway_iam_api_key" "backup_app_api" {
  application_id = scaleway_iam_application.backup_app.id
  description    = "k8s backup app API key"
}

resource "scaleway_iam_api_key" "mail_app_api" {
  application_id = scaleway_iam_application.mail_app.id
  description    = "mail access API key"
}

resource "scaleway_iam_api_key" "sftpgo_app_api" {
  application_id = scaleway_iam_application.sftpgo_app.id
  description    = "sftpgo access API key"
}

resource "scaleway_iam_api_key" "gitea_app_api" {
  application_id = scaleway_iam_application.gitea_app.id
  description    = "gitea access API key"
}

resource "scaleway_iam_application" "ci_app" {
  name = "ci_app"
}

resource "scaleway_iam_policy" "registry_full_access" {
  name           = "CI Registry full access policy"
  description    = "Gives CI app full access to container registry in project"
  application_id = scaleway_iam_application.ci_app.id

  rule {
    project_ids = [data.scaleway_account_project.default.id]
    permission_set_names = [
      "RegistryFullAccess",
    ]
  }
}

resource "scaleway_iam_api_key" "ci_app_api" {
  application_id = scaleway_iam_application.ci_app.id
  description    = "CI app API key for registry push"
}