package fastly

import (
	"context"
	"log"

	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"

	gofastly "github.com/fastly/go-fastly/v17/fastly"
)

func resourceServiceAuthorization() *schema.Resource {
	return &schema.Resource{
		CreateContext: resourceServiceAuthorizationCreate,
		ReadContext:   resourceServiceAuthorizationRead,
		UpdateContext: resourceServiceAuthorizationUpdate,
		DeleteContext: resourceServiceAuthorizationDelete,
		Importer: &schema.ResourceImporter{
			StateContext: schema.ImportStatePassthroughContext,
		},

		Schema: map[string]*schema.Schema{
			"id": {
				Type:        schema.TypeString,
				Computed:    true,
				Description: "The ID of this service authorization.",
			},
			"permission": {
				Type:             schema.TypeString,
				Required:         true,
				Description:      "The permissions to grant the user. Can be `full`, `read_only`, `purge_select` or `purge_all`.",
				ValidateDiagFunc: validateServiceAuthorizationPermission(),
			},
			"service_id": {
				Type:        schema.TypeString,
				ForceNew:    true,
				Required:    true,
				Description: "The ID of the service to grant permissions for.",
			},

			"user_id": {
				Type:        schema.TypeString,
				ForceNew:    true,
				Required:    true,
				Description: "The ID of the user which will receive the granted permissions.",
			},
		},
	}
}

func resourceServiceAuthorizationCreate(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
	conn := meta.(*APIClient).conn

	sa, err := conn.CreateServiceAuthorization(ctx, &gofastly.CreateServiceAuthorizationInput{
		Service:    &gofastly.SAService{ID: d.Get("service_id").(string)},
		User:       &gofastly.SAUser{ID: d.Get("user_id").(string)},
		Permission: d.Get("permission").(string),
	})
	if err != nil {
		return diag.FromErr(err)
	}

	d.SetId(sa.ID)

	return nil
}

func resourceServiceAuthorizationRead(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
	log.Printf("[DEBUG] Refreshing Service Authorization Configuration for (%s)", d.Id())

	conn := meta.(*APIClient).conn

	sa, err := conn.GetServiceAuthorization(ctx, &gofastly.GetServiceAuthorizationInput{
		ID: d.Id(),
	})
	if err != nil {
		return diag.FromErr(err)
	}
	d.SetId(sa.ID)
	err = d.Set("service_id", sa.Service.ID)
	if err != nil {
		return diag.FromErr(err)
	}
	err = d.Set("user_id", sa.User.ID)
	if err != nil {
		return diag.FromErr(err)
	}
	err = d.Set("permission", sa.Permission)
	if err != nil {
		return diag.FromErr(err)
	}

	return nil
}

func resourceServiceAuthorizationUpdate(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
	conn := meta.(*APIClient).conn

	if d.HasChanges("permission") {
		_, err := conn.UpdateServiceAuthorization(ctx, &gofastly.UpdateServiceAuthorizationInput{
			ID:         d.Id(),
			Permission: d.Get("permission").(string),
		})
		if err != nil {
			return diag.FromErr(err)
		}
	}

	return resourceServiceAuthorizationRead(ctx, d, meta)
}

func resourceServiceAuthorizationDelete(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
	conn := meta.(*APIClient).conn

	err := conn.DeleteServiceAuthorization(ctx, &gofastly.DeleteServiceAuthorizationInput{
		ID: d.Id(),
	})
	if err != nil {
		return diag.FromErr(err)
	}

	return nil
}
