###############################################################################
# Module: conditional_access_policy
# Author: Andie Garcia (andie.garcia@garciaplatformgroup.example)
# Owner:  Platform Engineering — Garcia Platform Group LLC
# Repo:   azuredevops/GarciaPlatformGroup/_git/platform-iac
# Purpose:
#   Reusable wrapper around azuread_conditional_access_policy so every
#   Conditional Access policy in the Garcia Platform Group tenant is created
#   from a single, peer-reviewed code path. Replaces manual portal changes for
#   the 600+ user platform.
###############################################################################

terraform {
  required_providers {
    azuread = {
      source  = "hashicorp/azuread"
      version = "~> 2.47"
    }
  }
}

variable "display_name" {
  type        = string
  description = "Display name for the conditional access policy."
}

variable "state" {
  type        = string
  description = "Policy state."
  default     = "enabledForReportingButNotEnforced"

  validation {
    condition     = contains(["enabled", "disabled", "enabledForReportingButNotEnforced"], var.state)
    error_message = "state must be enabled, disabled, or enabledForReportingButNotEnforced."
  }
}

variable "included_users" {
  type    = list(string)
  default = ["All"]
}

variable "excluded_groups" {
  type    = list(string)
  default = []
}

variable "included_applications" {
  type    = list(string)
  default = ["All"]
}

variable "client_app_types" {
  type    = list(string)
  default = ["all"]
}

variable "sign_in_risk_levels" {
  type    = list(string)
  default = []
}

variable "require_mfa" {
  type    = bool
  default = true
}

variable "require_compliant_device" {
  type    = bool
  default = false
}

resource "azuread_conditional_access_policy" "this" {
  display_name = var.display_name
  state        = var.state

  conditions {
    client_app_types    = var.client_app_types
    sign_in_risk_levels = var.sign_in_risk_levels

    applications {
      included_applications = var.included_applications
    }

    users {
      included_users  = var.included_users
      excluded_groups = var.excluded_groups
    }
  }

  grant_controls {
    operator = "AND"

    built_in_controls = compact([
      var.require_mfa              ? "mfa"             : "",
      var.require_compliant_device ? "compliantDevice" : "",
    ])
  }
}

output "policy_id" {
  value       = azuread_conditional_access_policy.this.id
  description = "The ID of the created Conditional Access policy."