terraform {
  required_version = ">= 1.11.0"
}

provider "aws" {
  region = "us-east-1"
}

variable "environment" {
  description = "Environment name"
  type        = string
  default     = "dev"
}

# AV Scan Lambda function
# Build Docker image from actual Lambda code
locals {
  lambda_source_dir = "/Users/michael.rojas/Library/CloudStorage/OneDrive-SonyMusicEntertainment/Documents/projects/lambda-av-scan/lambda/av_scan_containerized"
}

resource "null_resource" "build_av_scan" {
  triggers = {
    # Rebuild if handler code changes
    index_hash  = filemd5("${local.lambda_source_dir}/src/index.py")
    config_hash = filemd5("${local.lambda_source_dir}/config.py")
    dockerfile_hash = filemd5("${local.lambda_source_dir}/Dockerfile")
  }

  provisioner "local-exec" {
    command = <<-EOT
      cd ${local.lambda_source_dir}
      docker build --platform linux/amd64 --target deploy -t av-scan-containerized:latest .
    EOT
  }
}

resource "aws_iam_role" "av_scan_lambda_role" {
  name = "${var.environment}-lambda-av-scan-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "lambda.amazonaws.com"
        }
        Action = "sts:AssumeRole"
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "av_scan_lambda_basic" {
  role       = aws_iam_role.av_scan_lambda_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}

# Deploy Lambda from Docker image
resource "aws_lambda_function" "av_scan" {
  depends_on = [null_resource.build_av_scan]

  function_name = "${var.environment}-lambda-av-scan-containerized"
  role          = aws_iam_role.av_scan_lambda_role.arn
  package_type  = "Image"
  image_uri     = "av-scan-containerized:latest"
  timeout       = 300
  memory_size   = 1024

  environment {
    variables = {
      ENVIRONMENT = var.environment  # Use "dev" for local to skip M2M auth
      # LocalStack configuration
      AWS_ENDPOINT_URL = "http://host.docker.internal:4566"
      # Disable Datadog tracing in local environment
      DD_TRACE_ENABLED = "false"
      DD_INSTRUMENTATION_TELEMETRY_ENABLED = "false"
    }
  }
}

output "function_name" {
  value = aws_lambda_function.av_scan.function_name
}

output "function_arn" {
  value = aws_lambda_function.av_scan.arn
}