// ExternalName contains all information that is necessary for naming operations,
// such as removal of those fields from spec schema and calling Configure function
// to fill attributes with information given in external name.
type ExternalName struct {
	// SetIdentifierArgumentFn sets the name of the resource in Terraform argument
	// map. In many cases, there is a field called "name" in the HCL schema, however,
	// there are cases like RDS DB Cluster where the name field in HCL is called
	// "cluster_identifier". This function is the place that you can take external
	// name and assign it to that specific key for that resource type.
	SetIdentifierArgumentFn SetIdentifierArgumentsFn

	// GetExternalNameFn returns the external name extracted from TF State. In most cases,
	// "id" field contains all the information you need. You'll need to extract
	// the format that is decided for external name annotation to use.
	// For example the following is an Azure resource ID:
	// /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/mygroup1
	// The function should return "mygroup1" so that it can be used to set external
	// name if it was not set already.
	GetExternalNameFn GetExternalNameFn

	// GetIDFn returns the string that will be used as "id" key in TF state. In
	// many cases, external name format is the same as "id" but when it is not
	// we may need information from other places to construct it. For example,
	// the following is an Azure resource ID:
	// /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/mygroup1
	// The function here should use information from supplied arguments to
	// construct this ID, i.e. "mygroup1" from external name, subscription ID
	// from terraformProviderConfig, and others from parameters map if needed.
	GetIDFn GetIDFn

	// OmittedFields are the ones you'd like to be removed from the schema since
	// they are specified via external name. For example, if you set
	// "cluster_identifier" in SetIdentifierArgumentFn, then you need to omit
	// that field.
	// You can omit only the top level fields.
	// No field is omitted by default.
	OmittedFields []string

	// DisableNameInitializer allows you to specify whether the name initializer
	// that sets external name to metadata.name if none specified should be disabled.
	// It needs to be disabled for resources whose external identifier is randomly
	// assigned by the provider, like AWS VPC where it gets vpc-21kn123 identifier
	// and not let you name it.
	DisableNameInitializer bool

	// IdentifierFields are the fields that are used to construct external
	// resource identifier. We need to know these fields no matter what the
	// management policy is including the Observe Only, different from other
	// (required) fields.
	IdentifierFields []string
}

// +kubebuilder:validation:XValidation:rule="self.managementPolicy == 'ObserveOnly' || has(self.forProvider.bucketName)",message="bucketName is a required parameter"

var (
	// NameAsIdentifier uses "name" field in the arguments as the identifier of
	// the resource.
	NameAsIdentifier = ExternalName{
		SetIdentifierArgumentFn: func(base map[string]any, name string) {
			base["name"] = name
		},
		GetExternalNameFn: IDAsExternalName,
		GetIDFn:           ExternalNameAsID,
		OmittedFields: []string{
			"name",
			"name_prefix",
		},
	}

	// IdentifierFromProvider is used in resources whose identifier is assigned by
	// the remote client, such as AWS VPC where it gets an identifier like
	// vpc-2213das instead of letting user choose a name.
	IdentifierFromProvider = ExternalName{
		SetIdentifierArgumentFn: NopSetIdentifierArgument,
		GetExternalNameFn:       IDAsExternalName,
		GetIDFn:                 ExternalNameAsID,
		DisableNameInitializer:  true,
	}

	parameterPattern = regexp.MustCompile(`{{\s*\.parameters\.([^\s}]+)\s*}}`)
)

// ParameterAsIdentifier uses the given field name in the arguments as the
// identifier of the resource.
func ParameterAsIdentifier(param string) ExternalName {
	e := NameAsIdentifier
	e.SetIdentifierArgumentFn = func(base map[string]any, name string) {
		base[param] = name
	}
	e.OmittedFields = []string{
		param,
		param + "_prefix",
	}
	e.IdentifierFields = []string{param}
	return e
}

// TemplatedStringAsIdentifier accepts a template as the shape of the Terraform
// ID and lets you provide a field path for the argument you're using as external
// name. The available variables you can use in the template are as follows:
// parameters: A tree of parameters that you'd normally see in a Terraform HCL
//
//	file. You can use TF registry documentation of given resource to
//	see what's available.
//
// setup.configuration: The Terraform configuration object of the provider. You can
//
//	take a look at the TF registry provider configuration object
//	to see what's available. Not to be confused with ProviderConfig
//	custom resource of the Crossplane provider.
//
// setup.client_metadata: The Terraform client metadata available for the provider,
//
//	such as the AWS account ID for the AWS provider.
//
// external_name: The value of external name annotation of the custom resource.
//
//	It is required to use this as part of the template.
//
// The following template functions are available:
// ToLower: Converts the contents of the pipeline to lower-case
// ToUpper: Converts the contents of the pipeline to upper-case
// Please note that it's currently *not* possible to use
// the template functions on the .external_name template variable.
// Example usages:
// TemplatedStringAsIdentifier("index_name", "/subscriptions/{{ .setup.configuration.subscription }}/{{ .external_name }}")
// TemplatedStringAsIdentifier("index_name", "/resource/{{ .external_name }}/static")
// TemplatedStringAsIdentifier("index_name", "{{ .parameters.cluster_id }}:{{ .parameters.node_id }}:{{ .external_name }}")
// TemplatedStringAsIdentifier("", "arn:aws:network-firewall:{{ .setup.configuration.region }}:{{ .setup.client_metadata.account_id }}:{{ .parameters.type | ToLower }}-rulegroup/{{ .external_name }}")
func TemplatedStringAsIdentifier(nameFieldPath, tmpl string) ExternalName {
	t, err := template.New("getid").Funcs(template.FuncMap{
		"ToLower": strings.ToLower,
		"ToUpper": strings.ToUpper,
	}).Parse(tmpl)
	if err != nil {
		panic(errors.Wrap(err, "cannot parse template"))
	}

	// Note(turkenh): If a parameter is used in the external name template,
	// it is an identifier field.
	var identifierFields []string
	for _, node := range t.Root.Nodes {
		if node.Type() == parse.NodeAction {
			match := parameterPattern.FindStringSubmatch(node.String())
			if len(match) == 2 {
				identifierFields = append(identifierFields, match[1])
			}
		}
	}
	return ExternalName{
		SetIdentifierArgumentFn: func(base map[string]any, externalName string) {
			if nameFieldPath == "" {
				return
			}
			// TODO(muvaf): Return error in this function? Not returning error
			// is a valid option since the schemas are static so we'd get the
			// panic right when you create a resource. It's not generation-time
			// error though.
			if err := fieldpath.Pave(base).SetString(nameFieldPath, externalName); err != nil {
				panic(errors.Wrapf(err, "cannot set %s to fieldpath %s", externalName, nameFieldPath))
			}
		},
		OmittedFields: []string{
			nameFieldPath,
			nameFieldPath + "_prefix",
		},
		GetIDFn: func(ctx context.Context, externalName string, parameters map[string]any, setup map[string]any) (string, error) {
			o := map[string]any{
				"external_name": externalName,
				"parameters":    parameters,
				"setup":         setup,
			}
			b := bytes.Buffer{}
			if err := t.Execute(&b, o); err != nil {
				return "", errors.Wrap(err, "cannot execute template")
			}
			return b.String(), nil
		},
		GetExternalNameFn: func(tfstate map[string]any) (string, error) {
			id, ok := tfstate["id"]
			if !ok {
				return "", errors.New(errIDNotFoundInTFState)
			}
			return GetExternalNameFromTemplated(tmpl, id.(string))
		},
		IdentifierFields: identifierFields,
	}
}

spec:
  forProvider:
    vpcId: vpc-xxx
    vpcIdRef:
      name: demoVpc
    vpcIdSelector:
      matchLabels:
        testing.upbound.io/example-name: example

// Reference represents the Crossplane options used to generate
// reference resolvers for fields
type Reference struct {
	// Type is the type name of the CRD if it is in the same package or
	// <package-path>.<type-name> if it is in a different package.
	Type string
	// Extractor is the function to be used to extract value from the
	// referenced type. Defaults to getting external name.
	// Optional
	Extractor string
	// RefFieldName is the field name for the Reference field. Defaults to
	// <field-name>Ref or <field-name>Refs.
	// Optional
	RefFieldName string
	// SelectorFieldName is the field name for the Selector field. Defaults to
	// <field-name>Selector.
	// Optional
	SelectorFieldName string
}

p.AddResourceConfigurator("volcengine_subnet", func(r *config.Resource) {
    // We need to override the default group that upjet generated for
    // upjet根据volcengine_subnet获取group名，最终生成在CRD spec.group 字段
    // vpc.volcengine.upbound.io
    // volcengine_subnet 会生成 volcengine group，这里需要手动设置group为vpc
    // aws 有一个统一的GroupMap，会在生成代码的Provider初始化时设置，最后覆盖所有Resource
    // https://github.com/upbound/provider-aws/blob/7e57ea50d7c5ead808967aebbb02079fc3532b1f/config/groups.go#L56
    r.ShortGroup = "vpc"
    r.References["vpc_id"] = config.Reference{
        //三种配置均可
        //Type: "VPC"
        //Type: "github.com/volcengine/provider-volcengine/apis/vpc/v1alpha1.VPC",
        TerraformName: "volcengine_vpc",
    }
    // 当资源创建、删除超过1min时，需要设置为true，比如Kubernetes集群或数据库。
    // true时，tf操作会启协程操作，防止资源Controller阻塞
    r.UseAsync = false
})

apiVersion: cr.volcengine.upbound.io/v1alpha1
  kind: Registry
metadata:
  annotations:
    meta.upbound.io/example-id: cr/v1alpha1/registry
  labels:
    testing.upbound.io/example-name: foo
  name: foo
spec:
  forProvider:
    deleteImmediately: false
    passwordSecretRef:
      key: example-key
      name: example-secret
      namespace: upbound-system

---

func Configure(p *config.Provider) {
    p.AddResourceConfigurator("aws_iam_access_key", func(r *config.Resource) {
        r.Sensitive.AdditionalConnectionDetailsFn = func(attr map[string]any) (map[string][]byte, error) {
            conn := map[string][]byte{}
            if a, ok := attr["id"].(string); ok {
                conn["aws_access_key_id"] = []byte(a)
            }
            if a, ok := attr["secret"].(string); ok {
                conn["aws_secret_access_key"] = []byte(a)
            }
            return conn, nil
        }
    })
}

apiVersion: v1
data:
  attribute.id: QUtJQVk0QUZUVFNFNDI2TlhKS0I=
  attribute.secret: ABCxyzRedacted==
  attribute.ses_smtp_password_v4: QQ00REDACTED==
  aws_access_key_id: QUtJQVk0QUZUVFNFNDI2TlhKS0I=
  aws_secret_access_key: ABCxyzRedacted==
kind: Secret

observe failed: cannot run refresh: refresh failed: Invalid combination of arguments:
  "address_prefix": only one of `address_prefix,address_prefixes` can be specified, but `address_prefix,address_prefixes` were specified.: File name: main.tf.json

func Configure(p *config.Provider) {
    p.AddResourceConfigurator("azurerm_subnet", func(r *config.Resource) {
        r.LateInitializer = config.LateInitializer{
            IgnoredFields: []string{"address_prefix"},
        }
    })
}

p.AddResourceConfigurator("aws_autoscaling_group", func(r *config.Resource) {
    // Managed by Attachment resource.
    if s, ok := r.TerraformResource.Schema["load_balancers"]; ok {
        s.Optional = false
        s.Computed = true
    }
    if s, ok := r.TerraformResource.Schema["target_group_arns"]; ok {
        s.Optional = false
        s.Computed = true
    }
    r.TerraformResource.Schema["region"] = &schema.Schema{
        Type:        schema.TypeString,
        Required:    true,
        Description: comment.String(),
    }
})

// 初始化 Controller
// ...
{{- if .Initializers }}
for _, i := range o.Provider.Resources["{{ .ResourceType }}"].InitializerFns {
    initializers = append(initializers,i(mgr.GetClient()))
}
{{- end}}

opts := []managed.ReconcilerOption{
    // ...
    managed.WithInitializers(initializers),
    // ...
}
// ...
r := managed.NewReconciler(mgr, xpresource.ManagedKind(v1alpha1.Subnet_GroupVersionKind), opts...)
// ...

// TagInitializer returns a tagger to use default tag initializer.
var TagInitializer NewInitializerFn = func(client client.Client) managed.Initializer {
	return NewTagger(client, "tags")
}

// Tagger implements the Initialize function to set external tags
type Tagger struct {
	kube      client.Client
	fieldName string
}

// NewTagger returns a Tagger object.
func NewTagger(kube client.Client, fieldName string) *Tagger {
	return &Tagger{kube: kube, fieldName: fieldName}
}

// Initialize is a custom initializer for setting external tags
func (t *Tagger) Initialize(ctx context.Context, mg xpresource.Managed) error {
	if mg.GetManagementPolicy() == xpv1.ManagementObserveOnly {
		// We don't want to add tags to the spec.forProvider if the resource is
		// in ObserveOnly mode.
		return nil
	}
	paved, err := fieldpath.PaveObject(mg)
	if err != nil {
		return err
	}
	pavedByte, err := setExternalTagsWithPaved(xpresource.GetExternalTags(mg), paved, t.fieldName)
	if err != nil {
		return err
	}
	if err := json.Unmarshal(pavedByte, mg); err != nil {
		return err
	}
	if err := t.kube.Update(ctx, mg); err != nil {
		return err
	}
	return nil
}