locals {
  calendar_project_id = "octobot-486812"
}

resource "google_project_service" "calendar_api" {
  project            = local.calendar_project_id
  service            = "calendar-json.googleapis.com"
  disable_on_destroy = false
}

resource "google_project_organization_policy" "allow_calendar_key_creation" {
  project    = local.calendar_project_id
  constraint = "iam.disableServiceAccountKeyCreation"

  boolean_policy {
    enforced = false
  }
}

resource "google_service_account" "openclaw_calendar_sa" {
  project      = local.calendar_project_id
  account_id   = "openclaw-calendar"
  display_name = "OpenClaw Google Calendar Service Account"
  depends_on   = [google_project_service.calendar_api]
}

resource "google_service_account_key" "openclaw_calendar_sa_key" {
  service_account_id = google_service_account.openclaw_calendar_sa.name
  depends_on         = [google_project_organization_policy.allow_calendar_key_creation]
}

resource "local_file" "openclaw_calendar_sa_key_file" {
  content  = base64decode(google_service_account_key.openclaw_calendar_sa_key.private_key)
  filename = "${path.module}/../k8s/openclaw/calendar_sa.json.secret"
}

output "openclaw_calendar_sa_email" {
  value       = google_service_account.openclaw_calendar_sa.email
  description = "The email address of the Google Calendar Service Account. Share your Google Calendars with this email address and grant it 'Make changes to events' access."
}