terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 4.0"
    }
  }
}

provider "aws" {
  region = var.aws_region
  version = ">= 6.22, < 6.23"
}

locals {
  common_tags = {
    application_family = var.application_family
    environment        = var.environment
    service_name       = var.service_name
    terraformed        = true
  }
}

##########################
## S3 Buckets (Simplified)
##########################

# Royalties sales files bucket
resource "aws_s3_bucket" "royalties_sales_files" {
  bucket = "${var.environment}-royalties-sales-files"
  tags   = local.common_tags
}

resource "aws_s3_bucket_server_side_encryption_configuration" "royalties_sales_files" {
  bucket = aws_s3_bucket.royalties_sales_files.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

# Abacus payments bucket
resource "aws_s3_bucket" "abacus_payments" {
  bucket = "${var.environment}-abacus-payments"
  tags   = local.common_tags
}

resource "aws_s3_bucket_server_side_encryption_configuration" "abacus_payments" {
  bucket = aws_s3_bucket.abacus_payments.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

resource "aws_s3_bucket_cors_configuration" "abacus_payments" {
  bucket = aws_s3_bucket.abacus_payments.id

  cors_rule {
    allowed_headers = ["*"]
    allowed_methods = ["PUT", "POST"]
    allowed_origins = ["http://localhost:*", "https://abacus.qaorch.com"]
    expose_headers  = ["ETag"]
    max_age_seconds = 3000
  }
}

# Royalties airflow logs bucket
resource "aws_s3_bucket" "royalties_airflow_logs" {
  bucket = "${var.environment}-royalties-airflow-logs"
  tags   = local.common_tags
}

resource "aws_s3_bucket_server_side_encryption_configuration" "royalties_airflow_logs" {
  bucket = aws_s3_bucket.royalties_airflow_logs.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

# Abacus adjustments bucket
resource "aws_s3_bucket" "abacus_adjustments" {
  bucket = "${var.environment}-abacus-adjustments"
  tags   = local.common_tags
}

resource "aws_s3_bucket_server_side_encryption_configuration" "abacus_adjustments" {
  bucket = aws_s3_bucket.abacus_adjustments.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

resource "aws_s3_bucket_cors_configuration" "abacus_adjustments" {
  bucket = aws_s3_bucket.abacus_adjustments.id

  cors_rule {
    allowed_headers = ["*"]
    allowed_methods = ["PUT", "POST"]
    allowed_origins = ["http://localhost:*", "https://abacus.qaorch.com"]
    expose_headers  = ["ETag"]
    max_age_seconds = 3000
  }
}

########################
## SNS Topic for uploads
########################

resource "aws_sns_topic" "abacus_file_upload_events" {
  name = "${var.environment}-abacus-file-upload-events"
  tags = local.common_tags
}

resource "aws_sns_topic_policy" "abacus_file_upload_events_policy" {
  arn = aws_sns_topic.abacus_file_upload_events.arn

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "s3.amazonaws.com"
        }
        Action   = "sns:Publish"
        Resource = aws_sns_topic.abacus_file_upload_events.arn
        Condition = {
          ArnEquals = {
            "aws:SourceArn" = aws_s3_bucket.abacus_adjustments.arn
          }
        }
      }
    ]
  })
}

# S3 bucket notification to SNS
# NOTE: Commented out - conflicts with EventBridge notification in sfn_file_upload.tf
# Only one aws_s3_bucket_notification resource can exist per bucket.
# EventBridge is used for Step Functions workflow.
#
# resource "aws_s3_bucket_notification" "upload_notification" {
#   bucket = aws_s3_bucket.abacus_adjustments.id
#
#   topic {
#     topic_arn     = aws_sns_topic.abacus_file_upload_events.arn
#     events        = ["s3:ObjectCreated:*"]
#     filter_prefix = "uploads/"
#   }
#
#   depends_on = [aws_sns_topic_policy.abacus_file_upload_events_policy]
# }

##########
## Outputs
##########

output "royalties_sales_files_bucket" {
  value = aws_s3_bucket.royalties_sales_files.id
}

output "abacus_payments_bucket" {
  value = aws_s3_bucket.abacus_payments.id
}

output "abacus_adjustments_bucket" {
  value = aws_s3_bucket.abacus_adjustments.id
}

output "sns_topic_arn" {
  value = aws_sns_topic.abacus_file_upload_events.arn
}