# -----------------------------------------------------------------------------
# ECR Repository — Collector Worker Lambda container image
# -----------------------------------------------------------------------------

resource "aws_ecr_repository" "collector_worker" {
  name = "lambda-resonance-collector-worker"

  # MUTABLE in dev to support :latest push-based deploys.
  # Switch to IMMUTABLE for prod with digest-based image references.
  image_tag_mutability = "MUTABLE"

  image_scanning_configuration {
    scan_on_push = true
  }

  # AWS-managed KMS key (aws/ecr) for simplicity in dev.
  # For prod, consider a customer-managed KMS key via kms_key parameter.
  encryption_configuration {
    encryption_type = "KMS"
  }
}

resource "aws_ecr_lifecycle_policy" "collector_worker" {
  repository = aws_ecr_repository.collector_worker.name

  policy = jsonencode({
    rules = [
      {
        rulePriority = 1
        description  = "Expire untagged images older than 14 days"
        selection = {
          tagStatus   = "untagged"
          countType   = "sinceImagePushed"
          countUnit   = "days"
          countNumber = 14
        }
        action = {
          type = "expire"
        }
      },
      {
        rulePriority = 2
        description  = "Keep only last 10 tagged images"
        selection = {
          tagStatus   = "any"
          countType   = "imageCountMoreThan"
          countNumber = 10
        }
        action = {
          type = "expire"
        }
      }
    ]
  })
}

# -----------------------------------------------------------------------------
# Lambda — Collector Worker
# -----------------------------------------------------------------------------

module "lambda_collector_worker" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=5.2.1"

  environment        = var.environment
  application_family = var.application_family
  lambda_name        = "lambda-resonance-collector-worker"
  lambda_description = "Collects Spotify data for consented fans and produces to Kafka"

  use_container_image = true

  # The module ignores image URI changes after creation — deployments happen
  # outside Terraform. After pushing a new :latest image, update the function:
  #   aws lambda update-function-code --function-name lambda-resonance-collector-worker \
  #     --image-uri "<ecr_url>:latest"
  container_image_custom_uri = "${aws_ecr_repository.collector_worker.repository_url}:latest"

  # Module creates a security group with full egress (0.0.0.0/0) by default —
  # needed for Spotify API calls and MSK connectivity via private subnets.
  vpc_enabled    = true
  vpc_id         = module.vpc_info.vpc_id
  vpc_subnet_ids = module.vpc_info.default_private_subnet_ids

  lambda_function_timeout                        = var.collector_worker_timeout
  lambda_function_memory_size                    = var.collector_worker_memory_size
  lambda_function_reserved_concurrent_executions = var.collector_worker_concurrency

  # Datadog disabled in dev — enable for prod
  datadog_enabled          = false
  datadog_advanced_enabled = false

  # Disable unused org integrations
  ows_machine_to_machine_enabled = false
  splitio_enabled                = false

  # Lambda-internal DLQ catches invocation failures (e.g. function cannot start).
  # Processing failures are handled by ReportBatchItemFailures → manifest-files DLQ.
  # TODO: Add Datadog monitoring for this DLQ when Datadog is enabled in prod.
  dlq_type = "sqs"

  # DEV ONLY: Spotify secrets passed as env vars for simplicity.
  # TODO (prod): Migrate to Secrets Manager (terraform-secrets-manager module)
  # and fetch at handler cold start via boto3 secretsmanager client.
  lambda_function_environment_variables = {
    ENVIRONMENT             = var.environment
    SPOTIFY_CLIENT_ID       = var.spotify_client_id
    SPOTIFY_CLIENT_SECRET   = var.spotify_client_secret
    KAFKA_BOOTSTRAP_SERVERS = var.kafka_bootstrap_servers
    KAFKA_TOPIC             = var.kafka_topic
    KAFKA_SECURITY_PROTOCOL = var.kafka_security_protocol
    KAFKA_SASL_MECHANISM    = var.kafka_sasl_mechanism
    TIMEOUT_BUFFER_MS       = "90000"
  }

  # IAM policies attached as inline role policies in iam.tf
  # (generic-engineer-role lacks iam:CreatePolicy for managed policies)

  zappa_s3_policy_enabled = false
}

# -----------------------------------------------------------------------------
# SQS Event Source Mapping — triggers Collector Worker from manifest files queue
# -----------------------------------------------------------------------------

resource "aws_lambda_event_source_mapping" "collector_worker_sqs" {
  event_source_arn = module.manifest_files_queue.queue_arn
  function_name    = module.lambda_collector_worker.lambda_arn
  batch_size       = var.collector_worker_batch_size
  enabled          = var.collector_worker_esm_enabled

  function_response_types = ["ReportBatchItemFailures"]

  scaling_config {
    maximum_concurrency = var.collector_worker_concurrency
  }
}