# Variables ====================================================================

variable "name_prefix" {
  description = "Prefix prepended to resource names created by this module"
  type        = string

  validation {
    condition     = length(trimspace(var.name_prefix)) > 0
    error_message = "name_prefix must not be empty."
  }
}

variable "endpoints" {
  description = "Map of resolver endpoint logical key to configuration"
  type = map(object({
    direction            = string
    endpoint_name_suffix = string
    endpoint_type        = optional(string, "IPV4")
    security_group_ids   = list(string)
    interfaces = list(object({
      subnet_id = string
      ip        = optional(string)
    }))
    tags = optional(map(string), {})
  }))
  default = {}

  validation {
    condition = alltrue([
      for k, v in var.endpoints : contains(["INBOUND", "OUTBOUND"], v.direction)
    ])
    error_message = "endpoints direction must be either INBOUND or OUTBOUND."
  }

  validation {
    condition = alltrue([
      for k, v in var.endpoints : contains(["IPV4", "IPV6", "DUALSTACK"], v.endpoint_type)
    ])
    error_message = "endpoints endpoint_type must be one of IPV4, IPV6, or DUALSTACK."
  }

  validation {
    condition = alltrue([
      for k, v in var.endpoints : can(regex("^[a-z0-9]+(-[a-z0-9]+)*$", v.endpoint_name_suffix))
    ])
    error_message = <<-EOT
      One or more endpoint_name_suffix values are not in kebab-case format.
      Use lowercase alphanumeric segments separated by single hyphens.
      No leading or trailing hyphens, no double hyphens, no underscores.
    EOT
  }
}

variable "rules" {
  description = <<-EOT
    Map of resolver rule logical key to configuration.
    endpoint_key must reference an OUTBOUND entry in var.endpoints.
  EOT
  type = map(object({
    domain_name      = string
    rule_type        = optional(string, "FORWARD")
    endpoint_key     = string
    rule_name_suffix = string
    target_ips = list(object({
      ip   = string
      port = optional(number, 53)
    }))
    vpc_ids = list(string)
    tags    = optional(map(string), {})
  }))
  default = {}

  validation {
    condition = alltrue([
      for k, v in var.rules : contains(["FORWARD", "RECURSIVE"], v.rule_type)
    ])
    error_message = <<-EOT
      One or more rule_type values are invalid.
      Valid values are FORWARD or RECURSIVE.

      SYSTEM rules are created automatically by AWS for a VPC's default
      domain and are not supported by this module.
    EOT
  }

  validation {
    condition = alltrue([
      for k, v in var.rules : can(regex("^[a-z0-9]+(-[a-z0-9]+)*$", v.rule_name_suffix))
    ])
    error_message = <<-EOT
      One or more rule_name_suffix values are not in kebab-case format.
      Use lowercase alphanumeric segments separated by single hyphens.
      No leading or trailing hyphens, no double hyphens, no underscores.
    EOT
  }
}

variable "tags" {
  description = "Resource tags to apply to all resources"
  type        = map(string)
  default     = {}
}