variable "sso_instance_arn" {
  description = "ARN of the IAM Identity Center (SSO) instance"
  type        = string
}

variable "permission_sets" {
  description = <<-EOT
    Map of permission set definitions. Inline policies and managed policy ARNs
    are optional. session_duration follows ISO 8601 (e.g. PT8H).
    EOT
  type = map(object({
    name             = string
    description      = string
    session_duration = optional(string, "PT8H")
    managed_policies = optional(list(string), [])
    inline_policy    = optional(string, null)
    customer_managed_policies = optional(list(object({
      name = string
      path = optional(string, "/")
    })), [])
    relay_state = optional(string, null)
  }))
  default = {}
}

variable "assignments" {
  description = <<-EOT
    List of principal-to-account assignments. permission_set_key references a
    key in var.permission_sets. principal_type is USER or GROUP.
    Provide principal_id (raw GUID) or principal_name (user/group display name) for dynamic lookup.
    EOT
  type = list(object({
    account_id         = string
    permission_set_key = string
    principal_id       = optional(string, null)
    principal_name     = optional(string, null)
    principal_type     = string
  }))
  default = []
}

variable "tags" {
  description = "Resource tags to apply to all resources"
  type        = map(string)
  default     = {}
}