# Pure provider-mocked checks: no AWS requests, no real infrastructure changes.
mock_provider "aws" {}

variables {
  region     = "ap-southeast-1"
  account_id = "123456789012"
  vpc_id     = "vpc-0123456789abcdef0"
}

run "direction_and_scope" {
  command = apply

  assert {
    condition = (
      aws_vpc_security_group_ingress_rule.api_from_worker.security_group_id == aws_security_group.api.id &&
      aws_vpc_security_group_ingress_rule.api_from_worker.referenced_security_group_id == aws_security_group.worker.id &&
      aws_vpc_security_group_egress_rule.worker_to_api.security_group_id == aws_security_group.worker.id &&
      aws_vpc_security_group_egress_rule.worker_to_api.referenced_security_group_id == aws_security_group.api.id
    )
    error_message = "Worker-to-API traffic must use the correct source and destination groups."
  }

  assert {
    condition = (
      aws_vpc_security_group_ingress_rule.worker_from_api.security_group_id == aws_security_group.worker.id &&
      aws_vpc_security_group_ingress_rule.worker_from_api.referenced_security_group_id == aws_security_group.api.id &&
      aws_vpc_security_group_egress_rule.api_to_worker.security_group_id == aws_security_group.api.id &&
      aws_vpc_security_group_egress_rule.api_to_worker.referenced_security_group_id == aws_security_group.worker.id
    )
    error_message = "API callback traffic must have the reverse group direction."
  }

  assert {
    condition = alltrue([
      for rule in [
        aws_vpc_security_group_ingress_rule.api_from_worker,
        aws_vpc_security_group_ingress_rule.worker_from_api,
        aws_vpc_security_group_egress_rule.worker_to_api,
        aws_vpc_security_group_egress_rule.api_to_worker
      ] : rule.ip_protocol == "tcp" && rule.from_port == 8443 && rule.to_port == 8443
    ])
    error_message = "The connectivity contract must not expand beyond TCP/8443."
  }
}