// Copyright (c) 2025 Aiven, Helsinki, Finland. https://aiven.io/
// Code generated by user config generator. DO NOT EDIT.

package permission

import (
	"context"

	"github.com/hashicorp/terraform-plugin-framework-timeouts/resource/timeouts"
	"github.com/hashicorp/terraform-plugin-framework-validators/setvalidator"
	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
	"github.com/hashicorp/terraform-plugin-framework/types"

	"github.com/aiven/terraform-provider-aiven/internal/plugin/adapter"
)

func newResourceModel() adapter.Model[tfModel] {
	return new(resourceModel)
}

// resourceModel with specific resource timeouts
type resourceModel struct {
	tfModel
	Timeouts timeouts.Value `tfsdk:"timeouts"`
}

func (tf *resourceModel) SharedModel() *tfModel {
	return &tf.tfModel
}

func (tf *resourceModel) TimeoutsObject() types.Object {
	return tf.Timeouts.Object
}

/*
newResourceSchema:

	resource "aiven_organization_permission" "example" {
	  organization_id = "org1a23f456789" // Force new
	  resource_type   = "organization" // Force new
	  resource_id     = "foo" // Force new
	  permissions {
	    permissions    = ["foo"]
	    principal_id   = "foo"
	    principal_type = "user"
	    create_time    = "foo"
	    update_time    = "foo"
	  }
	}
*/
func newResourceSchema(ctx context.Context) schema.Schema {
	return schema.Schema{
		Attributes: map[string]schema.Attribute{
			"id": schema.StringAttribute{
				Computed:            true,
				MarkdownDescription: "Resource ID, a composite of `organization_id`, `resource_type` and `resource_id` IDs.",
				PlanModifiers:       []planmodifier.String{stringplanmodifier.UseStateForUnknown()},
			},
			"organization_id": schema.StringAttribute{
				MarkdownDescription: "ID of an organization. Changing this property forces recreation of the resource.",
				PlanModifiers:       []planmodifier.String{stringplanmodifier.RequiresReplace()},
				Required:            true,
			},
			"resource_id": schema.StringAttribute{
				MarkdownDescription: "Resource Id. Changing this property forces recreation of the resource.",
				PlanModifiers:       []planmodifier.String{stringplanmodifier.RequiresReplace()},
				Required:            true,
			},
			"resource_type": schema.StringAttribute{
				MarkdownDescription: "Resource type. The possible values are `organization`, `organization_unit` and `project`. Changing this property forces recreation of the resource.",
				PlanModifiers:       []planmodifier.String{stringplanmodifier.RequiresReplace()},
				Required:            true,
				Validators:          []validator.String{stringvalidator.OneOf("organization", "organization_unit", "project")},
			},
		},
		Blocks: map[string]schema.Block{
			"permissions": schema.SetNestedBlock{
				MarkdownDescription: "Required property. List of roles to set.",
				NestedObject: schema.NestedBlockObject{Attributes: map[string]schema.Attribute{
					"create_time": schema.StringAttribute{
						Computed:            true,
						MarkdownDescription: "Create Time.",
					},
					"permissions": schema.SetAttribute{
						ElementType:         types.StringType,
						MarkdownDescription: "List of [roles and permissions](https://aiven.io/docs/platform/concepts/permissions) to grant\".",
						Required:            true,
					},
					"principal_id": schema.StringAttribute{
						MarkdownDescription: "ID of the user or group to grant permissions to. Only active users who have accepted an [invite](https://aiven.io/docs/platform/howto/manage-org-users) to join the organization can be granted permissions.",
						Required:            true,
					},
					"principal_type": schema.StringAttribute{
						MarkdownDescription: "An enumeration. The possible values are `user` and `user_group`.",
						Required:            true,
						Validators:          []validator.String{stringvalidator.OneOf("user", "user_group")},
					},
					"update_time": schema.StringAttribute{
						Computed:            true,
						MarkdownDescription: "Update Time.",
					},
				}},
				Validators: []validator.Set{setvalidator.IsRequired()},
			},
			"timeouts": timeouts.BlockAll(ctx),
		},
		MarkdownDescription: "Grants [roles and permissions](https://aiven.io/docs/platform/concepts/permissions) to a principal for a resource. Permissions can be granted at the organization, organizational unit, and project level. Unit-level permissions aren't shown in the Aiven Console. To assign permissions to multiple users and groups on the same combination of organization ID, resource ID and resource type, don't use multiple `aiven_organization_permission` resources. Instead, use multiple permission blocks as in the example usage. **Do not use the `aiven_project_user` or `aiven_organization_group_project` resources with this resource**. By default, Aiven Terraform Provider validates whether the resource already exists in the Aiven API. This validation prevents you from managing permissions for a specific resource using multiple `aiven_organization_group_project` resources, which leads to overwrites and conflicts. In case of a conflict, you can import the resource using the `terraform import` command to continue managing it. Alternatively, you can disable this validation by setting the `AIVEN_ORGANIZATION_PERMISSION_VALIDATE_CONFLICT` environment variable to `false`, which will cause Terraform to override the remote state.",
	}
}
