terraform {
  required_version = "1.1.5"
  required_providers {
    github = {
      source  = "integrations/github"
      version = "4.20.0"
    }
    graphql = {
      source  = "sullivtr/graphql"
      version = "2.5.0"
    }
  }
  backend "pg" {
  }
}

variable "GITHUB_TOKEN" {
  description = "Your personal access token. Needs scopes: repo, admin:org, delete_repo"
  type        = string
  sensitive   = true
}

variable "GITHUB_OWNER" {
  description = "The target GitHub organization or individual user account to manage"
  type        = string
}

provider "github" {
  token = var.GITHUB_TOKEN
  owner = var.GITHUB_OWNER
}

provider "graphql" {
  url = "https://api.github.com/graphql"
  headers = {
    "Authorization" : "token ${var.GITHUB_TOKEN}"
  }
}

data "graphql_query" "organization" {
  query_variables = {
    login : var.GITHUB_OWNER
  }
  query = file("./graphql/organization_read.gql")
}

locals {
  # Map of CIDR IP range to graphql properties of the IpAllowListEntry
  cidr_allow_list = {
    "127.0.0.1/8": {
      name = "Description shown at https://github.com/organizations/{org}/settings/security"
      # you could also set isActive or ownerId
    }
  }
}

resource "graphql_mutation" "ip_allow_list" {
  for_each = local.cidr_allow_list

  mutation_variables = {
    name           = each.value.name
    allowListValue = each.key
    isActive       = true
    ownerId        = jsondecode(data.graphql_query.organization.query_response).data.organization.id
  }

  compute_from_create = true

  compute_mutation_keys = {
    ipAllowListEntryId = "data.createIpAllowListEntry.ipAllowListEntry.id"
  }

  create_mutation = file("./graphql/ip_allow_list_create.gql")
  update_mutation = file("./graphql/ip_allow_list_update.gql")
  delete_mutation = file("./graphql/ip_allow_list_delete.gql")
  read_query      = file("./graphql/ip_allow_list_read.gql")
}