A+B 複合 — ファーストクラスコレクション × StrEnum × match × frozen dataclass（クーポンスタッキング Bad→Good Ch3/Ch4/Ch8/Ch9/Ch10）× Cloud Run Jobs × Cloud Tasks × Secret Manager rotation × Scheduler OIDC（Terraform）

📋 コピーcart = Cart(
    total=12000,
    items=(CartItem(category="books"), CartItem(category="electronics")),
)

basket = CouponBasket()
basket = basket.add_coupon(Coupon(
    id="C1", type=CouponType.PERCENT, rate=0.1,
    conditions=(Condition(type=ConditionType.MIN_AMOUNT, value=10000),),
))
basket = basket.add_coupon(Coupon(
    id="C2", type=CouponType.FIXED, amount=5000,
    conditions=(Condition(type=ConditionType.CATEGORY, value="electronics"),),
))

print(calculate_total_discount(basket, cart))
# → 6200  (12000*0.1=1200 + 5000 = 6200、cart.total=12000未満なのでクランプなし)

# 重複ID登録は例外
basket.add_coupon(Coupon(id="C1", type=CouponType.FIXED, amount=1000))
# → ValueError: クーポンID重複: C1

# 元の basket は不変（add_coupon は新インスタンスを返す）
print(len(basket))  # → 2

# 割引が cart.total を超えるケース（クランプ確認）
huge_cart = Cart(total=3000, items=(CartItem(category="electronics"),))
huge_basket = CouponBasket().add_coupon(
    Coupon(id="C3", type=CouponType.FIXED, amount=8000)
)
print(calculate_total_discount(huge_basket, huge_cart))
# → 3000（8000ではなくcart.totalでクランプされる）

📋 コピー# terraform/modules/vendor-sync/main.tf
# Cloud Run Jobs × Cloud Tasks × Secret Manager rotation × Cloud Scheduler(OIDC)

locals {
  project_id       = var.project_id
  region           = var.region
  vendor_secret_id = "vendor-api-key"
}

# ── 1. Secret Manager — ベンダー API キー + ローテーション通知 ──────────────────
# Before: Cloud Run revision の環境変数に平文設定（閲覧可能・ローテーションなし）
resource "google_pubsub_topic" "secret_rotation" {
  name    = "secret-rotation-notify"
  project = local.project_id
}

resource "google_secret_manager_secret" "vendor_api_key" {
  secret_id = local.vendor_secret_id
  project   = local.project_id

  replication {
    auto {}
  }

  # 30日ごとにローテーション通知（実際のキー更新は通知を受けたハンドラーで実施）
  rotation {
    rotation_period    = "2592000s" # 30日
    next_rotation_time = timeadd(timestamp(), "720h")
  }

  topics {
    name = google_pubsub_topic.secret_rotation.id
  }
}

# ── 2. Job 実行用サービスアカウント（最小権限） ─────────────────────────────────
# Before: デフォルト SA（プロジェクト編集者相当）
resource "google_service_account" "vendor_sync_job_sa" {
  account_id   = "vendor-sync-job"
  display_name = "Vendor Sync Cloud Run Job SA"
  project      = local.project_id
}

# 対象シークレットのみ secretAccessor（プロジェクト全体には付与しない）
resource "google_secret_manager_secret_iam_member" "job_sa_secret_access" {
  secret_id = google_secret_manager_secret.vendor_api_key.id
  role      = "roles/secretmanager.secretAccessor"
  member    = "serviceAccount:${google_service_account.vendor_sync_job_sa.email}"
}

# Cloud Tasks へのタスク投入権限のみ
resource "google_project_iam_member" "job_sa_tasks_enqueuer" {
  project = local.project_id
  role    = "roles/cloudtasks.enqueuer"
  member  = "serviceAccount:${google_service_account.vendor_sync_job_sa.email}"
}

# ── 3. Cloud Tasks キュー — レート制御 + 指数バックオフ ─────────────────────────
# Before: for ループで無制限に同時リクエスト → ベンダーAPI 429 多発
resource "google_cloud_tasks_queue" "vendor_sync_queue" {
  name     = "vendor-sync-queue"
  location = local.region
  project  = local.project_id

  rate_limits {
    max_dispatches_per_second = 5   # ベンダーAPIのレート上限に合わせる
    max_concurrent_dispatches = 10
  }

  retry_config {
    max_attempts  = 5
    min_backoff   = "10s"
    max_backoff   = "300s"
    max_doublings = 4               # 指数バックオフ: 10s→20s→40s→80s→160s
  }
}

# ── 4. Cloud Run Jobs — バッチ本体 ─────────────────────────────────────────────
# Before: Cloud Run Service (min-instances=1) で24時間常時起動課金
# After : Cloud Run Jobs は実行時間のみ課金（実行は深夜数分のみ）
resource "google_cloud_run_v2_job" "vendor_sync_job" {
  name     = "vendor-sync-job"
  location = local.region
  project  = local.project_id

  template {
    task_count  = 1
    parallelism = 1

    template {
      service_account = google_service_account.vendor_sync_job_sa.email
      max_retries      = 3
      timeout          = "3600s"

      containers {
        image = "asia-northeast1-docker.pkg.dev/${local.project_id}/mops/vendor-sync:latest"

        env {
          # Secret 名のみを渡し、値は実行時に Secret Manager API 経由で取得する
          name  = "VENDOR_API_KEY_SECRET"
          value = google_secret_manager_secret.vendor_api_key.secret_id
        }
        env {
          name  = "TASKS_QUEUE"
          value = google_cloud_tasks_queue.vendor_sync_queue.id
        }

        resources {
          limits = {
            cpu    = "1"
            memory = "512Mi"
          }
        }
      }
    }
  }
}

# ── 5. Cloud Scheduler — OIDC 認証で Jobs Execution API を起動 ─────────────────
resource "google_service_account" "scheduler_invoker_sa" {
  account_id   = "vendor-sync-scheduler"
  display_name = "Vendor Sync Scheduler Invoker"
  project      = local.project_id
}

resource "google_cloud_run_v2_job_iam_member" "scheduler_invoker" {
  name     = google_cloud_run_v2_job.vendor_sync_job.name
  location = local.region
  project  = local.project_id
  role     = "roles/run.invoker"
  member   = "serviceAccount:${google_service_account.scheduler_invoker_sa.email}"
}

resource "google_cloud_scheduler_job" "vendor_sync_nightly" {
  name     = "vendor-sync-nightly"
  project  = local.project_id
  region   = local.region
  schedule = "0 3 * * *"  # 毎日 3:00 JST

  http_target {
    http_method = "POST"
    uri         = "https://${local.region}-run.googleapis.com/apis/run.googleapis.com/v1/namespaces/${local.project_id}/jobs/${google_cloud_run_v2_job.vendor_sync_job.name}:run"

    oauth_token {
      service_account_email = google_service_account.scheduler_invoker_sa.email
    }
  }
}