# Variables ====================================================================

variable "name_prefix" {
  description = "Prefix prepended to resource names created by this module"
  type        = string

  validation {
    condition     = length(trimspace(var.name_prefix)) > 0
    error_message = "name_prefix must not be empty."
  }
}

variable "cidr_block" {
  description = "Primary IPv4 CIDR block for the VPC"
  type        = string
}

variable "secondary_cidr_blocks" {
  description = "List of secondary IPv4 CIDR blocks to associate with the VPC"
  type        = list(string)
  default     = []
}

variable "enable_dns_hostnames" {
  description = "Enable DNS hostnames in the VPC"
  type        = bool
  default     = true
}

variable "enable_dns_support" {
  description = "Enable DNS resolution in the VPC"
  type        = bool
  default     = true
}

variable "public_subnets" {
  description = "Map of public subnet logical key to configuration"
  type = map(object({
    cidr_block        = string
    availability_zone = string
    map_public_ip     = optional(bool, false)
  }))
  default = {}
}

variable "private_subnets" {
  description = "Map of private subnet logical key to configuration"
  type = map(object({
    cidr_block        = string
    availability_zone = string
  }))
  default = {}
}

variable "isolated_subnets" {
  description = "Map of isolated (no NAT/IGW) subnet logical key to configuration"
  type = map(object({
    cidr_block        = string
    availability_zone = string
  }))
  default = {}
}

variable "enable_nat_gateway" {
  description = "Create NAT gateways for private subnet internet access"
  type        = bool
  default     = false
}

variable "single_nat_gateway" {
  description = "Use a single NAT gateway instead of one per AZ"
  type        = bool
  default     = false
}

variable "transit_gateway_id" {
  description = "TGW ID to use as next hop for isolated subnet routes. Routes only created when set."
  type        = string
  default     = null
}

variable "transit_gateway_route_table_id" {
  description = "TGW route table ID to associate and propagate. Uses TGW default route table when null."
  type        = string
  default     = null
}

variable "tgw_subnet_keys" {
  description = "Isolated subnet keys used as TGW attachment subnets, excluded from the default TGW route to avoid routing loops"
  type        = list(string)
  default     = []
}

variable "tgw_default_route_table_association" {
  description = "Whether the VPC attachment should be associated with the TGW default route table"
  type        = bool
  default     = true
}

variable "tgw_default_route_table_propagation" {
  description = "Whether the VPC attachment should propagate routes to the TGW default route table"
  type        = bool
  default     = true
}

variable "enable_flow_logs" {
  description = "Enable VPC flow logs. Requires flow_log_destination_arn to be set."
  type        = bool
  default     = false
}

variable "flow_log_role_permissions_boundary_arn" {
  description = <<-EOT
    Optional permissions boundary ARN for the flow log IAM role.
    Leave it 'null' if this role is exempted from boundary
    requirements by organizational governance standards.
  EOT
  type        = string
  default     = null
}

variable "flow_log_destination_arn" {
  description = "CloudWatch log group ARN or S3 bucket ARN for VPC flow logs"
  type        = string
  default     = null
}

variable "flow_log_traffic_type" {
  description = "VPC flow log traffic type. ALL, ACCEPT, or REJECT"
  type        = string
  default     = "ALL"

  validation {
    condition     = contains(["ALL", "ACCEPT", "REJECT"], var.flow_log_traffic_type)
    error_message = "Valid values for flow_log_traffic_type are ALL, ACCEPT, or REJECT."
  }
}

variable "tags" {
  description = "Resource tags to apply to all resources"
  type        = map(string)
  default     = {}
}