# Google Cloud Solution Architecture Baseline
terraform {
  required_version = ">= 1.5.0"
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 5.0"
    }
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
}

# Cloud Run v2 Service
resource "google_cloud_run_v2_service" "app_service" {
  name     = "${var.environment}-app-service"
  location = var.region

  template {
    containers {
      image = var.container_image
      ports {
        container_port = 8080
      }
    }
  }
}

# Pub/Sub Topic for Event Ingestion
resource "google_pubsub_topic" "event_ingestion" {
  name = "${var.environment}-event-ingestion-topic"
  labels = {
    environment = var.environment
    managed_by  = "terraform"
  }
}

# Cloud Storage Bucket for Event Replay Audit
resource "google_storage_bucket" "audit_bucket" {
  name                        = "${var.project_id}-${var.environment}-audit-bucket"
  location                    = var.region
  force_destroy               = false
  uniform_bucket_level_access = true

  versioning {
    enabled = true
  }

  lifecycle_rule {
    condition {
      age = 30
    }
    action {
      type = "Delete"
    }
  }
}

# Least-Privilege IAM Service Account
resource "google_service_account" "ingress_sa" {
  account_id   = "${var.environment}-ingress-sa"
  display_name = "Cloud Run Ingress Identity"
}

resource "google_pubsub_topic_iam_member" "publisher_binding" {
  topic  = google_pubsub_topic.event_ingestion.name
  role   = "roles/pubsub.publisher"
  member = "serviceAccount:${google_service_account.ingress_sa.email}"
}