terraform {
  required_providers {
    meraki = {
      source  = "CiscoDevNet/meraki"
      version = "1.9.0"
    }
  }
}

# Búsqueda automática de IDs (Data Sources)
data "meraki_organization" "org" {
  name = var.organization_name
}

data "meraki_networks" "net" {
  organization_id = data.meraki_organization.org.id
}

# Stacks de switches en la red (para resolución dinámica de seriales por nombre)
data "meraki_switch_stacks" "stacks" {
  network_id = local.network_id
}

# Local para extraer el network_id exacto de la lista de redes
locals {
  network_id = [for n in data.meraki_networks.net.items : n.id if n.name == var.network_name][0]

  # Helper: expande un port_range en lista de port_ids
  # "1-48" -> ["1","2",...,"48"] | "1" -> ["1"]
  _expand_range = {
    for config in concat(var.switch_port_configs, var.switch_stack_port_configs) :
    "${try(config.serial, config.stack_name)}:${config.port_range}" => (
      length(split("-", config.port_range)) == 2
      ? [for i in range(
          tonumber(split("-", config.port_range)[0]),
          tonumber(split("-", config.port_range)[1]) + 1
        ) : tostring(i)]
      : [config.port_range]
    )
  }

  # Mapa de nombre de stack -> lista de seriales de sus miembros
  stack_serials = {
    for stack in data.meraki_switch_stacks.stacks.items :
    stack.name => stack.serials
  }

  # Expande switch_port_configs (serial explícito) en entradas individuales
  switch_ports_expanded = flatten([
    for config in var.switch_port_configs : [
      for port_id in local._expand_range["${config.serial}:${config.port_range}"] : {
        key                  = "${config.serial}:${port_id}"
        serial               = config.serial
        port_id              = port_id
        name                 = config.name
        type                 = config.type
        vlan                 = config.vlan
        access_policy_type   = config.access_policy_type
        access_policy_number = config.access_policy_number
      }
    ]
  ])

  # Expande switch_stack_port_configs (por nombre de stack) en entradas individuales
  # Aplica el mismo port_range a TODOS los miembros del stack
  stack_ports_expanded = flatten([
    for config in var.switch_stack_port_configs : [
      for serial in local.stack_serials[config.stack_name] : [
        for port_id in local._expand_range["${config.stack_name}:${config.port_range}"] : {
          key                  = "${serial}:${port_id}"
          serial               = serial
          port_id              = port_id
          name                 = config.name
          type                 = config.type
          vlan                 = config.vlan
          access_policy_type   = config.access_policy_type
          access_policy_number = config.access_policy_number
        }
      ]
    ]
  ])

  # Unión de ambas listas para el resource meraki_switch_port
  all_ports = merge(
    { for p in local.switch_ports_expanded : p.key => p },
    { for p in local.stack_ports_expanded : p.key => p }
  )
}

# --- CONFIGURACIÓN GATEWAY (MX) ---

# 1. Activar VLANs en el Appliance (MX)
resource "meraki_appliance_vlans_settings" "activate_vlans" {
  network_id    = local.network_id
  vlans_enabled = true
}

# 2. Crear las interfaces L3 y VLANs en el MX
resource "meraki_appliance_vlan" "mx_gateways" {
  for_each   = var.switch_vlans
  depends_on = [meraki_appliance_vlans_settings.activate_vlans]

  network_id         = local.network_id
  vlan_id            = each.key
  name               = each.value.name
  subnet             = each.value.subnet
  appliance_ip       = each.value.appliance_ip
  reserved_ip_ranges = each.value.reserved_ip_ranges
  dhcp_handling      = each.value.dhcp_handling
}

# 3. SSIDs wireless
resource "meraki_wireless_ssid" "ssids" {
  for_each   = { for s in var.wireless_ssids : tostring(s.number) => s }
  depends_on = [meraki_appliance_vlans_settings.activate_vlans]

  network_id         = local.network_id
  number             = each.value.number
  name               = each.value.name
  enabled            = each.value.enabled
  auth_mode          = each.value.auth_mode
  splash_page        = each.value.splash_page
  ip_assignment_mode = each.value.ip_assignment_mode
  use_vlan_tagging   = each.value.use_vlan_tagging
  default_vlan_id    = each.value.default_vlan_id
  radius_servers = length(each.value.radius_servers) > 0 ? [
    for server in each.value.radius_servers : {
      host   = server.host
      port   = server.port
      secret = var.radius_secret
    }
  ] : []
}

# 4. Reglas de firewall L3
resource "meraki_appliance_l3_firewall_rules" "reglas_firewall" {
  network_id = local.network_id
  rules      = var.firewall_rules
}

# --- CONFIGURACIÓN SWITCHES (MS) ---

# 5. Políticas de acceso 802.1X
resource "meraki_switch_access_policy" "dot1x" {
  for_each   = { for p in var.switch_access_policies : p.name => p }
  network_id = local.network_id

  name                               = each.value.name
  access_policy_type                 = each.value.access_policy_type
  host_mode                          = each.value.host_mode
  radius_accounting_enabled          = each.value.radius_accounting_enabled
  radius_testing_enabled             = each.value.radius_testing_enabled
  radius_coa_support_enabled         = each.value.radius_coa_support_enabled
  radius_failed_auth_vlan_id         = each.value.radius_failed_auth_vlan_id
  radius_re_authentication_interval  = each.value.radius_re_authentication_interval
  url_redirect_walled_garden_enabled = each.value.url_redirect_walled_garden_enabled

  radius_servers = [
    for server in each.value.radius_servers : {
      host   = server.host
      port   = server.port
      secret = var.radius_secret
    }
  ]
}

# 6. Configuración de puertos de switch
# switch_port_configs: serial explícito | switch_stack_port_configs: por nombre de stack
resource "meraki_switch_port" "ports" {
  for_each   = local.all_ports
  depends_on = [meraki_switch_access_policy.dot1x]

  serial  = each.value.serial
  port_id = each.value.port_id
  name    = each.value.name
  type    = each.value.type

  vlan = each.value.vlan

  access_policy_type   = each.value.access_policy_type
  access_policy_number = each.value.access_policy_number
}