# Variables ====================================================================

variable "name_prefix" {
  description = "Prefix prepended to resource names created by this module"
  type        = string

  validation {
    condition     = length(trimspace(var.name_prefix)) > 0
    error_message = "name_prefix must not be empty."
  }
}

variable "vpc_id" {
  description = "ID of the VPC to associate NACLs with"
  type        = string

  validation {
    condition     = length(var.vpc_id) > 0
    error_message = "vpc_id must not be empty."
  }
}

variable "network_acls" {
  description = "Map of NACLs to create. Each entry defines a NACL with its subnet associations and ingress/egress rules. The NACL name is generated from name_prefix."
  type = map(object({
    subnet_ids = list(string)
    ingress_rules = list(object({
      rule_number = number
      action      = string # allow or deny
      protocol    = string # -1 for all, 6 for TCP, 17 for UDP, 1 for ICMP
      from_port   = optional(number, 0)
      to_port     = optional(number, 65535)
      cidr_block  = optional(string, null)
      icmp_type   = optional(number, null) # only when protocol = "1"
      icmp_code   = optional(number, null) # only when protocol = "1"
    }))
    egress_rules = list(object({
      rule_number = number
      action      = string # allow or deny
      protocol    = string # -1 for all, 6 for TCP, 17 for UDP, 1 for ICMP
      from_port   = optional(number, 0)
      to_port     = optional(number, 65535)
      cidr_block  = optional(string, null)
      icmp_type   = optional(number, null) # only when protocol = "1"
      icmp_code   = optional(number, null) # only when protocol = "1"
    }))
  }))
  default = {}

  validation {
    condition = alltrue(flatten([
      for k, v in var.network_acls : [
        for r in v.ingress_rules : r.rule_number >= 1 && r.rule_number <= 32766
      ]
    ]))
    error_message = "Each ingress rule_number must be between 1 and 32766."
  }

  validation {
    condition = alltrue(flatten([
      for k, v in var.network_acls : [
        for r in v.egress_rules : r.rule_number >= 1 && r.rule_number <= 32766
      ]
    ]))
    error_message = "Each egress rule_number must be between 1 and 32766."
  }
}

variable "tags" {
  description = "Resource tags to apply to all resources"
  type        = map(string)
  default     = {}
}