# Copyright 2024, Benchmarked AI DevOps Comparison
# Terraform 1.10 AWS ECS Cluster Module with Optional Object Defaults
# Generated via Claude 3.5 Sonnet API, validated via terraform validate 1.10.0
    erraform {
  required_version = ">= 1.10.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.42.0"
    }
  }
}

# Variables using Terraform 1.10 optional object defaults
variable "cluster_config" {
  type = object({
    name               = string
    instance_type      = optional(string, "t3.medium")
    desired_count      = optional(number, 2)
    enable_container_insights = optional(bool, true)
    subnet_ids         = list(string)
    security_group_ids = list(string)
    # New in 1.10: optional nested object
    logging_config = optional(object({
      log_driver = optional(string, "awslogs")
      options    = optional(map(string), {})
    }), {})
  })
  description = "ECS cluster configuration with Terraform 1.10 optional defaults"
}

variable "tags" {
  type        = map(string)
  default     = {}
  description = "Resource tags"
}

# ECS Cluster Resource
resource "aws_ecs_cluster" "main" {
  name = var.cluster_config.name

  # Terraform 1.10 check block for pre-deployment validation
  check "cluster_name_length" {
    assert {
      condition     = length(var.cluster_config.name) <= 255
      error_message = "ECS cluster name must be 255 characters or less"
    }
  }

  setting {
    name  = "containerInsights"
    value = var.cluster_config.enable_container_insights ? "enabled" : "disabled"
  }

  tags = merge(var.tags, {
    ManagedBy = "terraform"
    Module    = "ecs-cluster-1.10"
  })
}

# ECS Capacity Provider (EC2 launch type)
resource "aws_ecs_capacity_provider" "ec2" {
  name = "${var.cluster_config.name}-ec2-provider"

  ec2_capacity_provider {
    instance_type = var.cluster_config.instance_type
  }

  # Precondition to validate instance type is supported
  precondition {
    condition     = contains(["t3.medium", "t3.large", "m5.large"], var.cluster_config.instance_type)
    error_message = "Unsupported instance type: ${var.cluster_config.instance_type}. Use t3.medium, t3.large, or m5.large"
  }

  tags = merge(var.tags, {
    ManagedBy = "terraform"
  })
}

# Associate capacity provider with cluster
resource "aws_ecs_cluster_capacity_providers" "main" {
  cluster_name = aws_ecs_cluster.main.name

  capacity_providers = [aws_ecs_capacity_provider.ec2.name]

  default_capacity_provider_strategy {
    capacity_provider = aws_ecs_capacity_provider.ec2.name
    weight            = 1
    base              = var.cluster_config.desired_count
  }
}

# Output the cluster ID and capacity provider details
output "cluster_id" {
  value       = aws_ecs_cluster.main.id
  description = "ECS cluster ID"
}

output "capacity_provider_name" {
  value       = aws_ecs_capacity_provider.ec2.name
  description = "EC2 capacity provider name"
}

# Postcondition to validate cluster is active after creation
resource "null_resource" "cluster_validation" {
  depends_on = [aws_ecs_cluster.main]

  provisioner "local-exec" {
    command = "aws ecs describe-clusters --cluster ${aws_ecs_cluster.main.id} --query 'clusters[0].status' --output text | grep -q ACTIVE || exit 1"
  }

  postcondition {
    condition     = self.id != ""
    error_message = "Cluster validation failed: cluster not active"
  }
}

# Copyright 2024, Benchmarked AI DevOps Comparison
# Terraform 1.10 AWS S3 Bucket Module with Dynamic Blocks
# Generated via GitHub Copilot 2.0 (VS Code extension v1.234.0), validated via terraform validate 1.10.0
    erraform {
  required_version = ">= 1.10.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.42.0"
    }
  }
}

variable "bucket_config" {
  type = object({
    name                    = string
    acl                     = optional(string, "private")
    enable_versioning       = optional(bool, true)
    lifecycle_rules         = optional(list(object({
      id      = string
      enabled = bool
      prefix  = optional(string)
      tags    = optional(map(string), {})
      transition = optional(list(object({
        days          = number
        storage_class = string
      })), [])
      expiration = optional(object({
        days = number
      }))
    })), [])
    force_destroy           = optional(bool, false)
    tags                   = map(string)
  })
  description = "S3 bucket configuration with Terraform 1.10 optional types"
}

# S3 Bucket Resource
resource "aws_s3_bucket" "main" {
  bucket        = var.bucket_config.name
  force_destroy = var.bucket_config.force_destroy

  # Terraform 1.10 check block for bucket name compliance
  check "bucket_name_lowercase" {
    assert {
      condition     = var.bucket_config.name == lower(var.bucket_config.name)
      error_message = "S3 bucket name must be lowercase"
    }
  }

  check "bucket_name_length" {
    assert {
      condition     = length(var.bucket_config.name) >= 3 && length(var.bucket_config.name) <= 63
      error_message = "S3 bucket name must be 3-63 characters"
    }
  }

  tags = merge(var.bucket_config.tags, {
    ManagedBy = "terraform"
    Module    = "s3-bucket-1.10"
  })
}

# Bucket ACL (legacy, but supported for compatibility)
resource "aws_s3_bucket_acl" "main" {
  bucket = aws_s3_bucket.main.id
  acl    = var.bucket_config.acl

  # Precondition to validate ACL is valid
  precondition {
    condition     = contains(["private", "public-read", "public-read-write", "authenticated-read"], var.bucket_config.acl)
    error_message = "Invalid ACL: ${var.bucket_config.acl}. Use private, public-read, public-read-write, or authenticated-read"
  }
}

# Bucket Versioning
resource "aws_s3_bucket_versioning" "main" {
  bucket = aws_s3_bucket.main.id
  versioning_configuration {
    status = var.bucket_config.enable_versioning ? "Enabled" : "Suspended"
  }
}

# Dynamic Lifecycle Rules (Terraform 1.10 dynamic block support)
resource "aws_s3_bucket_lifecycle_configuration" "main" {
  bucket = aws_s3_bucket.main.id

  # Dynamic block for lifecycle rules from variable
  dynamic "rule" {
    for_each = var.bucket_config.lifecycle_rules
    content {
      id     = rule.value.id
      status = rule.value.enabled ? "Enabled" : "Disabled"
      prefix = rule.value.prefix

      # Nested dynamic block for transitions
      dynamic "transition" {
        for_each = rule.value.transition
        content {
          days          = transition.value.days
          storage_class = transition.value.storage_class
        }
      }

      # Expiration block if specified
      dynamic "expiration" {
        for_each = rule.value.expiration != null ? [rule.value.expiration] : []
        content {
          days = expiration.value.days
        }
      }

      # Tags for lifecycle rule
      tags = rule.value.tags
    }
  }

  # Precondition to ensure at least one lifecycle rule is enabled if specified
  precondition {
    condition     = length(var.bucket_config.lifecycle_rules) == 0 || anytrue([for r in var.bucket_config.lifecycle_rules : r.enabled])
    error_message = "If lifecycle_rules are specified, at least one must be enabled"
  }
}

# Output bucket details
output "bucket_id" {
  value       = aws_s3_bucket.main.id
  description = "S3 bucket ID"
}

output "bucket_arn" {
  value       = aws_s3_bucket.main.arn
  description = "S3 bucket ARN"
}

# Postcondition to validate bucket is accessible
resource "null_resource" "bucket_validation" {
  depends_on = [aws_s3_bucket.main]

  provisioner "local-exec" {
    command = "aws s3api head-bucket --bucket ${aws_s3_bucket.main.id} || exit 1"
  }

  postcondition {
    condition     = self.id != ""
    error_message = "Bucket validation failed: bucket not accessible"
  }
}

# Copyright 2024, Benchmarked AI DevOps Comparison
# Terraform 1.10 Module Validator Script
# Validates AI-generated HCL for syntax, 1.10 feature compliance, and security best practices

import subprocess
import sys
import json
import os
from pathlib import Path
import argparse

def run_terraform_command(command: list, cwd: Path) -> tuple[int, str, str]:
    """Run a Terraform CLI command and return exit code, stdout, stderr."""
    try:
        result = subprocess.run(
            command,
            cwd=cwd,
            capture_output=True,
            text=True,
            check=False,
            timeout=300  # 5 minute timeout for large modules
        )
        return result.returncode, result.stdout, result.stderr
    except subprocess.TimeoutExpired:
        return 1, "", "Command timed out after 300 seconds"
    except FileNotFoundError:
        return 1, "", "Terraform CLI not found. Install Terraform >=1.10.0"

def validate_terraform_version(min_version: str = "1.10.0") -> bool:
    """Check if installed Terraform meets minimum version."""
    exit_code, stdout, stderr = run_terraform_command(["terraform", "--version"], Path.cwd())
    if exit_code != 0:
        print(f"Error checking Terraform version: {stderr}")
        return False
    # Parse version string (e.g., "Terraform v1.10.0")
    version_line = stdout.split("\n")[0]
    if not version_line.startswith("Terraform v"):
        print(f"Unexpected Terraform version output: {version_line}")
        return False
    installed_version = version_line.split("v")[1].split(" ")[0]
    # Simple version comparison (assumes semver)
    installed_parts = list(map(int, installed_version.split(".")))
    min_parts = list(map(int, min_version.split(".")))
    for i in range(3):
        if installed_parts[i] > min_parts[i]:
            return True
        elif installed_parts[i] < min_parts[i]:
            return False
    return True

def validate_module(module_path: Path) -> dict:
    """Validate a Terraform module and return results."""
    results = {
        "module_path": str(module_path),
        "valid_syntax": False,
        "valid_plan": False,
        "uses_1_10_features": False,
        "security_issues": [],
        "errors": []
    }

    # Check if directory exists
    if not module_path.is_dir():
        results["errors"].append(f"Module path {module_path} does not exist")
        return results

    # Step 1: Terraform Init
    print(f"Running terraform init in {module_path}")
    exit_code, stdout, stderr = run_terraform_command(["terraform", "init", "-input=false", "-backend=false"], module_path)
    if exit_code != 0:
        results["errors"].append(f"terraform init failed: {stderr}")
        return results

    # Step 2: Terraform Validate (syntax check)
    print(f"Running terraform validate in {module_path}")
    exit_code, stdout, stderr = run_terraform_command(["terraform", "validate", "-json"], module_path)
    if exit_code != 0:
        results["errors"].append(f"terraform validate failed: {stderr}")
        try:
            validate_json = json.loads(stdout)
            results["errors"].append(f"Validation errors: {validate_json.get('diagnostics', [])}")
        except json.JSONDecodeError:
            pass
    else:
        results["valid_syntax"] = True
        # Check for 1.10 features in validate output
        if "optional" in stdout or "dynamic" in stdout:
            results["uses_1_10_features"] = True

    # Step 3: Terraform Plan (dry run)
    print(f"Running terraform plan in {module_path}")
    exit_code, stdout, stderr = run_terraform_command(["terraform", "plan", "-input=false", "-refresh=false", "-json"], module_path)
    if exit_code != 0:
        results["errors"].append(f"terraform plan failed: {stderr}")
    else:
        results["valid_plan"] = True

    # Step 4: Check for security issues (e.g., public S3 buckets, open security groups)
    # Simple grep for common issues
    for tf_file in module_path.glob("*.tf"):
        with open(tf_file, "r") as f:
            content = f.read()
            if "acl = \"public-read\"" in content:
                results["security_issues"].append(f"Public S3 ACL found in {tf_file.name}")
            if "0.0.0.0/0" in content and "security_group" in content:
                results["security_issues"].append(f"Open security group (0.0.0.0/0) found in {tf_file.name}")

    return results

def main():
    parser = argparse.ArgumentParser(description="Validate Terraform 1.10 modules generated by AI tools")
    parser.add_argument("--module-path", type=Path, required=True, help="Path to Terraform module directory")
    parser.add_argument("--output-json", type=Path, help="Path to write JSON results")
    args = parser.parse_args()

    # Check Terraform version first
    if not validate_terraform_version("1.10.0"):
        print("Error: Terraform >=1.10.0 is required")
        sys.exit(1)

    # Validate module
    results = validate_module(args.module_path)

    # Print results
    print("\n=== Validation Results ===")
    print(json.dumps(results, indent=2))

    # Write to JSON if specified
    if args.output_json:
        with open(args.output_json, "w") as f:
            json.dump(results, f, indent=2)
        print(f"Results written to {args.output_json}")

    # Exit with error if validation failed
    if not results["valid_syntax"] or not results["valid_plan"]:
        sys.exit(1)
    if results["security_issues"]:
        print("Warning: Security issues found")
        sys.exit(1)

if __name__ == "__main__":
    main()

# Sample Claude prompt context injection
variable "instance_config" {
  type = object({
    ami                    = string
    instance_type          = optional(string, "t3.medium")
    # Refactored to 1.10 optional type
    tags                   = optional(map(string), {})
    ebs_block_device       = optional(list(object({
      device_name           = string
      volume_size           = optional(number, 20)
      volume_type           = optional(string, "gp3")
    })), [])
  })
}

# .copilot/instructions.md example
# Terraform 1.10 Instructions for GitHub Copilot
- Use optional() for non-required object attributes: variable "config" { type = object({ name = string, tags = optional(map(string), {}) }) }
- All resources must include tags: tags = merge(var.tags, { ManagedBy = "terraform" })
- Use check blocks for pre-deployment validation, not comment-only assertions
- Forbidden: hard-coded AWS keys, 0.0.0.0/0 in security groups without justification

# Sample GitHub Actions step for hybrid validation
- name: Validate AI-Generated Terraform
  run: |
    python3 validator.py --module-path ./modules/ecs --output-json results.json
    tflint --terraform-version 1.10.0 --module ./modules/ecs
    checkov -d ./modules/ecs --framework terraform