# Cross-variable guardrails =====================================================
# validation blocks can only see the variable they're attached to, so anything
# spanning load_balancer_type + another variable is enforced here instead.

check "nlb_no_alb_only_listener_features" {
  assert {
    condition = local.is_alb || alltrue([
      for k, v in var.listeners : v.redirect == null
    ])
    error_message = <<-EOT
      One or more listeners set 'redirect', which is not supported on
      network load balancers.
    EOT
  }
}

check "alb_no_nlb_only_stickiness" {
  assert {
    condition = alltrue([
      for k, v in var.target_groups :
      v.stickiness == null || local.is_alb || v.stickiness.type == "source_ip"
    ])
    error_message = <<-EOT
      One or more target groups set stickiness.type other than 'source_ip'
      on a network load balancer.
    EOT
  }
}

check "alb_target_group_protocol" {
  assert {
    condition = alltrue([
      for k, v in var.target_groups :
      !local.is_alb || contains(["HTTP", "HTTPS"], v.protocol)
    ])
    error_message = <<-EOT
      One or more target groups use a non-HTTP(S) protocol on an
      application load balancer.
    EOT
  }
}

check "nlb_target_group_protocol" {
  assert {
    condition = alltrue([
      for k, v in var.target_groups :
      !local.is_nlb || contains(["TCP", "UDP", "TCP_UDP", "TLS"], v.protocol)
    ])
    error_message = <<-EOT
      One or more target groups use an HTTP(S) protocol on a network load
      balancer — use TCP, UDP, TCP_UDP, or TLS.
    EOT
  }
}

check "waf_only_on_alb" {
  assert {
    condition     = var.waf_web_acl_arn == null || local.is_alb
    error_message = <<-EOT
      waf_web_acl_arn was set but load_balancer_type is network — WAFv2
      does not support NLB as an association target.
    EOT
  }
}

check "ip_targets_require_port" {
  assert {
    condition = alltrue([
      for tg_key, tg in var.target_groups :
      tg.target_type != "ip" || alltrue([
        for target_key, target in tg.targets : target.port != null
      ])
    ])
    error_message = <<-EOT
      Targets on an ip-type target group must set an explicit port — AWS
      requires it when target_type is 'ip'.
    EOT
  }
}

check "security_group_count_within_default_quota" {
  assert {
    condition     = length(var.security_group_ids) <= 5
    error_message = <<-EOT
      security_group_ids has more than 5 entries. AWS's default per-ENI
      security group quota is 5 (soft limit). If your account has a raised
      quota, this check is being overly cautious — otherwise apply will
      fail at the AWS API. Verify your account's actual quota before
      proceeding.
    EOT
  }
}