locals {
  restore_objects_app_name = "${var.service_name}-restore-objects"
  restore_objects_app_dir  = "apps/lambda/restore-objects"
  restore_objects_app_hash = md5(join(",", [
    filemd5("${local.restore_objects_app_dir}/Dockerfile"),
    filemd5("${local.restore_objects_app_dir}/requirements.txt"),
    filemd5("${local.restore_objects_app_dir}/restore-objects.py"),
  ]))
}

resource "aws_ecr_repository" "restore_objects_app_repository" {
  name                 = local.restore_objects_app_name
  image_tag_mutability = "MUTABLE"

  encryption_configuration {
    encryption_type = "KMS"
  }

  image_scanning_configuration {
    scan_on_push = true
  }
}

resource "null_resource" "restore_objects_app_build" {
  triggers = {
    src_hash = local.restore_objects_app_hash
  }

  provisioner "local-exec" {
    command = "/bin/bash ./scripts/build-docker.sh"

    environment = {
      SRC_DIR             = local.restore_objects_app_dir
      ECR_REPOSITORY_NAME = aws_ecr_repository.restore_objects_app_repository.name
      ECR_REPOSITORY_TAG  = local.restore_objects_app_hash
      ECR_REPOSITORY_URL  = aws_ecr_repository.restore_objects_app_repository.repository_url
    }
  }
}

resource "aws_iam_policy" "restore_objects_app_policy" {
  name   = "${var.environment}-${local.restore_objects_app_name}-policy"
  policy = data.aws_iam_policy_document.restore_objects_app_policy.json
}

data "aws_iam_policy_document" "restore_objects_app_policy" {
  statement {
    effect    = "Allow"
    actions   = ["s3:ListBucketVersions"]
    resources = [data.aws_s3_bucket.bucket.arn]
  }

  statement {
    effect    = "Allow"
    actions   = ["s3:DeleteObjectVersion"]
    resources = ["${data.aws_s3_bucket.bucket.arn}/*"]
  }

  statement {
    effect    = "Allow"
    actions   = ["sqs:ReceiveMessage", "sqs:DeleteMessage"]
    resources = [module.object_queue.queue_arn]
  }

  statement {
    effect    = "Allow"
    actions   = ["cloudwatch:PutMetricData"]
    resources = ["*"]
    condition {
      test     = "StringEquals"
      variable = "cloudwatch:namespace"
      values   = [var.service_name]
    }
  }
}

module "restore_objects_app_lambda" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=2.6.1"

  environment        = var.environment
  lambda_name        = local.restore_objects_app_name
  application_family = var.application_family

  use_container_image        = true
  container_image_custom_uri = "${aws_ecr_repository.restore_objects_app_repository.repository_url}:latest"

  vpc_id         = var.vpc_id
  vpc_subnet_ids = var.vpc_subnet_ids

  datadog_enabled          = true
  datadog_advanced_enabled = false

  lambda_function_timeout                           = 90
  lambda_function_reserved_concurrent_executions    = var.lambda_concurrency
  lambda_function_provisioned_concurrent_executions = 0

  sqs_event_enabled               = true
  event_source_mapping_batch_size = var.sqs_batch_size
  event_source_mapping_queue_name = module.object_queue.queue_name

  lambda_function_environment_variables = {
    BUILD_ID             = null_resource.restore_objects_app_build.id
    OBJECT_DELETED_SINCE = var.object_deleted_since
    OBJECT_DELETED_TILL  = var.object_deleted_till
    CLOUDWATCH_NAMESPACE = var.service_name
    LOG_LEVEL            = var.log_level
  }

  iam_managed_policy_attachments = [
    aws_iam_policy.restore_objects_app_policy.arn,
  ]
}