variables.tf

variable "api_version" {
  description = "API version for Microsoft.OperationalInsights/workspaces/summaryLogs. 2025-07-01 is the first stable version; variablised so consumers are never pinned to this module's release cadence."
  type        = string
  default     = "2025-07-01"
}

variable "summary_rules" {
  description = <<DESC
Summary rules keyed by rule name, all created on the parent workspace. Each rule batch-aggregates a
KQL query every bin_size minutes and re-ingests the results into destination_table (auto-created by
Azure Monitor from the query's schema, always on the Analytics plan; columns are appended when the
table already exists). A workspace allows up to 100 active rules, and rules process the recent past
only (no historical range beyond 24 hours).

- query (required): the aggregation KQL. Analytics-plan sources support all operators bar a small
  documented set; Basic/Auxiliary sources are single-table with lookup joins only.
- bin_size (required): the scheduled window in minutes: 20, 30, 60, 120, 180, 360, 720, or 1440.
- destination_table (required): the custom results table, must end _CL.
- bin_delay (optional): minimum seconds to wait before processing a bin (ingestion-latency slack).
- bin_start_time (optional): UTC time the first execution starts, yyyy-MM-ddTHH:mm format.
- time_selector (optional): the bin time cursor; the API currently accepts only TimeGenerated.
- display_name / description (optional): portal metadata; display_name defaults to the rule name.
DESC

  type = map(object({
    query             = string
    bin_size          = number
    destination_table = string
    bin_delay         = optional(number)
    bin_start_time    = optional(string)
    time_selector     = optional(string, "TimeGenerated")
    display_name      = optional(string)
    description       = optional(string)
  }))
  default = {}

  validation {
    condition     = alltrue([for r in values(var.summary_rules) : contains([20, 30, 60, 120, 180, 360, 720, 1440], r.bin_size)])
    error_message = "bin_size must be one of 20, 30, 60, 120, 180, 360, 720, or 1440 minutes."
  }

  validation {
    condition     = alltrue([for r in values(var.summary_rules) : endswith(r.destination_table, "_CL")])
    error_message = "destination_table must be a custom log table name ending _CL."
  }

  validation {
    condition     = alltrue([for r in values(var.summary_rules) : r.time_selector == "TimeGenerated"])
    error_message = "time_selector only accepts TimeGenerated (the API's single allowed value)."
  }

  validation {
    condition     = alltrue([for r in values(var.summary_rules) : r.bin_delay == null || try(r.bin_delay >= 0, false)])
    error_message = "bin_delay is in seconds and cannot be negative."
  }

  validation {
    condition     = alltrue([for r in values(var.summary_rules) : trimspace(r.query) != ""])
    error_message = "query must be non-empty KQL."
  }

  validation {
    condition     = length(var.summary_rules) <= 100
    error_message = "A workspace allows at most 100 active summary rules."
  }
}

variable "workspace_id" {
  description = "Resource id of the parent Log Analytics workspace (the azapi parent), per the pass-ids principle."
  type        = string

  validation {
    condition     = can(regex("(?i)/providers/Microsoft\\.OperationalInsights/workspaces/[^/]+$", var.workspace_id))
    error_message = "workspace_id must be a Log Analytics workspace resource id."
  }
}

variable "retry_error_message_regex" {
  description = <<DESC
Regular expressions azapi retries on when a summary rule call fails. The default covers the
freshly created workspace propagation race, where the workspace PUT has returned but the summary
rules provider still 404s it moments later (caught live: "The workspace could not be found" on a
rule created seconds after its workspace), plus transient service noise. azapi retries matching
errors with backoff until the operation timeout. Set null to disable retries.
DESC
  type        = list(string)
  default     = ["(?i)workspace could not be found", "(?i)too many requests", "(?i)service unavailable", "(?i)internal server error"]
}