variables.tf

# ===================================================================================================
# Compute capacity (Azure ARM, via azapi). Folded in from terraform-azapi-security-copilot-compute-capacity.
# Microsoft.SecurityCopilot/capacities is the Azure resource that provisions Security Compute Units
# (SCUs); the Graph data-plane below runs on top of a provisioned tenant.
# ===================================================================================================
variable "compute_capacity" {
  description = <<-DESC
    Security Copilot compute capacities (Microsoft.SecurityCopilot/capacities) to deploy, keyed by a
    stable logical name. This is an Azure (ARM) resource managed through azapi, distinct from the
    Graph data-plane resources below. Verify azapi_version against the current provider API version.
  DESC

  type = map(object({
    resource_group_id         = string
    name                      = string
    location                  = string
    number_of_units           = optional(number, 1)
    geo                       = optional(string)
    cross_geo_compute         = optional(string)
    overage_state             = optional(string)
    overage_amount            = optional(number)
    azapi_version             = optional(string, "@2024-08-01-preview")
    tags                      = optional(map(string))
    schema_validation_enabled = optional(bool, false)
    response_export_values    = optional(list(string))
    ignore_missing_property   = optional(bool, true)
    ignore_null_property      = optional(bool, true)
    ignore_casing             = optional(bool, false)
  }))

  default = {}

  validation {
    condition = alltrue([
      for k, v in var.compute_capacity : can(regex("^@\\d{4}-\\d{2}-\\d{2}(-preview)?$", v.azapi_version))
    ])
    error_message = "azapi_version must be in the format @YYYY-MM-DD or @YYYY-MM-DD-preview."
  }
}

variable "default_api_version" {
  description = <<-DESC
    Default Microsoft Graph API version for the Security Copilot operations. The Security Copilot
    Graph surface currently exists only on beta, so this defaults to "beta". It is exposed as a flag
    so it can be moved to "v1.0" (or pinned per entry) once the API graduates.
  DESC
  type        = string
  default     = "beta"

  validation {
    condition     = contains(["v1.0", "beta"], var.default_api_version)
    error_message = "default_api_version must be v1.0 or beta."
  }
}

variable "evaluations" {
  description = <<-DESC
    Security Copilot evaluations to create under a prompt, keyed by a stable logical name. Creating an
    evaluation starts the AI reasoning over its prompt. Reference the parent session with exactly one
    of session_key or session_id, and the parent prompt with exactly one of prompt_key or prompt_id.
    POST .../sessions/{session}/prompts/{prompt}/evaluations.
  DESC

  type = map(object({
    body                   = optional(any, {})
    workspace_id           = optional(string, "default")
    session_key            = optional(string)
    session_id             = optional(string)
    prompt_key             = optional(string)
    prompt_id              = optional(string)
    api_version            = optional(string)
    update_method          = optional(string)
    response_export_values = optional(map(string))
  }))

  default = {}

  validation {
    condition     = alltrue([for k, v in var.evaluations : (v.session_key != null) != (v.session_id != null)])
    error_message = "each evaluations entry must set exactly one of session_key or session_id."
  }

  validation {
    condition     = alltrue([for k, v in var.evaluations : (v.prompt_key != null) != (v.prompt_id != null)])
    error_message = "each evaluations entry must set exactly one of prompt_key or prompt_id."
  }
}

variable "plugins" {
  description = "Security Copilot plugins to manage under a workspace, keyed by a stable logical name. url built as security/securityCopilot/workspaces/{workspace_id}/plugins. body is the plugin object."

  type = map(object({
    body                   = any
    workspace_id           = optional(string, "default")
    api_version            = optional(string)
    update_method          = optional(string)
    response_export_values = optional(map(string))
  }))

  default = {}
}

variable "prompts" {
  description = <<-DESC
    Security Copilot prompts to create under a session, keyed by a stable logical name. Reference the
    parent session with exactly one of session_key (a key in var.sessions, resolved to its created
    id) or session_id (a raw id). POST .../sessions/{session}/prompts. body is the prompt object (for
    example a content block).
  DESC

  type = map(object({
    body                   = any
    workspace_id           = optional(string, "default")
    session_key            = optional(string)
    session_id             = optional(string)
    api_version            = optional(string)
    update_method          = optional(string)
    response_export_values = optional(map(string))
  }))

  default = {}

  validation {
    condition     = alltrue([for k, v in var.prompts : (v.session_key != null) != (v.session_id != null)])
    error_message = "each prompts entry must set exactly one of session_key or session_id."
  }
}

variable "resources" {
  description = <<-DESC
    Generic passthrough for any other Security Copilot (or wider Graph) resource with full CRUD,
    keyed by a stable logical name. url is the resource path (for example
    "security/securityCopilot/workspaces"). Use this to reach endpoints without a first-class input.
  DESC

  type = map(object({
    url                    = string
    body                   = any
    api_version            = optional(string)
    update_method          = optional(string)
    response_export_values = optional(map(string))
  }))

  default = {}
}

variable "session_updates" {
  description = "Existing Security Copilot sessions to update (PATCH) by id, keyed by a stable logical name."

  type = map(object({
    session_id             = string
    body                   = any
    workspace_id           = optional(string, "default")
    api_version            = optional(string)
    response_export_values = optional(map(string))
  }))

  default = {}
}

variable "sessions" {
  description = "Security Copilot sessions to create under a workspace, keyed by a stable logical name. POST security/securityCopilot/workspaces/{workspace_id}/sessions. Reference a created session from prompts by this key. body is the session object (for example title, evaluationSettings)."

  type = map(object({
    body                   = any
    workspace_id           = optional(string, "default")
    api_version            = optional(string)
    update_method          = optional(string)
    response_export_values = optional(map(string))
  }))

  default = {}
}