data "aws_ssoadmin_instances" "this" {}

data "aws_identitystore_group" "this" {
  for_each          = { for idx, a in var.assignments : idx => a if a.principal_id == null && a.principal_type == "GROUP" }
  identity_store_id = try(tolist(data.aws_ssoadmin_instances.this.identity_store_ids)[0], "d-0000000000")
  alternate_identifier {
    unique_attribute {
      attribute_path  = "DisplayName"
      attribute_value = each.value.principal_name
    }
  }
}

data "aws_identitystore_user" "this" {
  for_each          = { for idx, a in var.assignments : idx => a if a.principal_id == null && a.principal_type == "USER" }
  identity_store_id = try(tolist(data.aws_ssoadmin_instances.this.identity_store_ids)[0], "d-0000000000")
  alternate_identifier {
    unique_attribute {
      attribute_path  = "UserName"
      attribute_value = each.value.principal_name
    }
  }
}

# locals =====================================================================

locals {
  tags = merge(
    {
      ManagedBy = "terraform"
      Module    = "governance/sso-assignment"
    },
    var.tags,
  )

  # Flatten managed policy attachments
  managed_policy_pairs = flatten([
    for ps_key, ps in var.permission_sets : [
      for policy_arn in ps.managed_policies : {
        ps_key     = ps_key
        policy_arn = policy_arn
      }
    ]
  ])

  managed_policy_map = {
    for pair in local.managed_policy_pairs :
    "${pair.ps_key}:${pair.policy_arn}" => pair
  }

  # Flatten customer-managed policy attachments
  customer_policy_pairs = flatten([
    for ps_key, ps in var.permission_sets : [
      for cmp in ps.customer_managed_policies : {
        ps_key = ps_key
        name   = cmp.name
        path   = cmp.path
      }
    ]
  ])

  customer_policy_map = {
    for pair in local.customer_policy_pairs :
    "${pair.ps_key}:${pair.name}" => pair
  }

  # Resolve principal_id using dynamic data lookup if not provided directly
  resolved_assignments = [
    for idx, a in var.assignments : {
      account_id         = a.account_id
      permission_set_key = a.permission_set_key
      principal_type     = a.principal_type
      principal_id = a.principal_id != null ? a.principal_id : (
        a.principal_type == "GROUP" ? data.aws_identitystore_group.this[idx].group_id : data.aws_identitystore_user.this[idx].user_id
      )
    }
  ]

  # Keyed assignment map for for_each
  assignment_map = {
    for a in local.resolved_assignments :
    "${a.account_id}:${a.permission_set_key}:${a.principal_id}" => a
  }
}