# =============================================================================
# AI Software Factory — Terraform outputs
#
# Everything an operator needs after `terraform apply`. The "URL" values are
# what goes into the app's .env / SSM parameters (see compute.tf header).
# =============================================================================

# --- Network -------------------------------------------------------------------

output "vpc_id" {
  description = "VPC id."
  value       = aws_vpc.main.id
}

output "vpc_cidr" {
  description = "VPC CIDR block."
  value       = aws_vpc.main.cidr_block
}

output "public_subnet_ids" {
  description = "Public subnet ids (ALB lives here)."
  value       = aws_subnet.public[*].id
}

output "private_subnet_ids" {
  description = "Private subnet ids (app ASGs + RDS + ElastiCache + OpenSearch)."
  value       = aws_subnet.private[*].id
}

output "availability_zones" {
  description = "AZs used by the stack."
  value       = local.azs
}

# --- Security groups --------------------------------------------------------------

output "security_group_edge_id" {
  description = "Security group id — edge (ALB)."
  value       = aws_security_group.edge.id
}

output "security_group_app_id" {
  description = "Security group id — app (EC2 nodes)."
  value       = aws_security_group.app.id
}

output "security_group_data_id" {
  description = "Security group id — data (RDS / ElastiCache / OpenSearch)."
  value       = aws_security_group.data.id
}

# --- Data services -------------------------------------------------------------------

output "rds_endpoint" {
  description = "RDS PostgreSQL endpoint (host:port). Use with POSTGRES_USER=factory and DB_PASSWORD from SSM to build DATABASE_URL."
  value       = aws_db_instance.postgres.endpoint
  sensitive   = true
}

output "rds_database_name" {
  description = "RDS database name."
  value       = aws_db_instance.postgres.db_name
}

output "elasticache_endpoint" {
  description = "ElastiCache Redis primary endpoint (host:port). Use as REDIS_URL=redis://<endpoint> (no password in this config)."
  value       = aws_elasticache_replication_group.redis.primary_endpoint_address
}

output "s3_bucket_name" {
  description = "Uploads S3 bucket (S3_BUCKET in .env)."
  value       = aws_s3_bucket.uploads.id
}

output "s3_bucket_arn" {
  description = "Uploads S3 bucket ARN."
  value       = aws_s3_bucket.uploads.arn
}

# OpenSearch VPC endpoint (https). Use as SEARCH_URL with the admin credentials
# from SSM (OS_ADMIN_PASSWORD) or a domain user you create after first boot.
output "opensearch_endpoint" {
  description = "OpenSearch VPC endpoint URL (SEARCH_URL)."
  value       = "https://${aws_opensearch_domain.main.endpoint}"
}

# --- Edge / URL -------------------------------------------------------------------

output "web_alb_dns_name" {
  description = "Public ALB DNS name (point your A/ALIAS record here)."
  value       = aws_lb.web.dns_name
}

output "public_url" {
  description = "Configured public base URL (PUBLIC_BASE_URL / WEB_URL)."
  value       = var.public_url
}

output "api_url" {
  description = "Derived API base URL (API_URL)."
  value       = "${var.public_url}/api"
}

output "realtime_url" {
  description = "Derived WebSocket URL (REALTIME_URL) — wss:// for https public URLs, ws:// otherwise."
  value       = startswith(var.public_url, "https://") ? replace(var.public_url, "https://", "wss://") : replace(var.public_url, "http://", "ws://")
}

output "acm_validation_records" {
  description = "ACM DNS validation records to add to your DNS zone (CNAME records; add manually, then re-apply)."
  value = {
    for dvo in aws_acm_certificate.web.domain_validation_options :
    dvo.domain_name => {
      name  = dvo.resource_record_name
      type  = dvo.resource_record_type
      value = dvo.resource_record_value
    }
  }
}

# --- SSM parameter reference (for the .env assembly) -------------------------------

output "ssm_parameter_path" {
  description = "SSM Parameter Store namespace holding the app env (pre-create parameters here; cloud-init reads them at boot)."
  value       = "/${local.names.project}/${local.env}"
}

# --- Suggested .env (values to put in SSM / .env.example) --------------------------

output "suggested_env" {
  description = "Suggested .env values assembled from this stack (secrets are still in SSM, not here)."
  value = {
    DATABASE_URL = "postgresql://factory:<DB_PASSWORD>@${aws_db_instance.postgres.endpoint}?schema=public"
    REDIS_URL    = "redis://${aws_elasticache_replication_group.redis.primary_endpoint_address}"
    SEARCH_URL   = "https://${aws_opensearch_domain.main.endpoint}"
    S3_BUCKET    = aws_s3_bucket.uploads.id
    S3_REGION    = var.aws_region
    S3_ENDPOINT  = "https://${aws_s3_bucket.uploads.bucket_regional_domain_name}"
    S3_FORCE_PATH_STYLE = "false"
    PUBLIC_BASE_URL = var.public_url
    API_URL        = "${var.public_url}/api"
    REALTIME_URL   = replace(var.public_url, "https://", "wss://")
  }
  sensitive = true
}