# -----------------------------------------------------------------------------
# ECR Repository — Manifest Parser Lambda container image
# -----------------------------------------------------------------------------

resource "aws_ecr_repository" "manifest_parser" {
  name = "lambda-resonance-manifest-parser"

  # MUTABLE in dev to support :latest push-based deploys.
  # Switch to IMMUTABLE for prod with digest-based image references.
  image_tag_mutability = "MUTABLE"

  image_scanning_configuration {
    scan_on_push = true
  }

  # AWS-managed KMS key (aws/ecr) for simplicity in dev.
  # For prod, consider a customer-managed KMS key via kms_key parameter.
  encryption_configuration {
    encryption_type = "KMS"
  }
}

resource "aws_ecr_lifecycle_policy" "manifest_parser" {
  repository = aws_ecr_repository.manifest_parser.name

  policy = jsonencode({
    rules = [
      {
        rulePriority = 1
        description  = "Expire untagged images older than 14 days"
        selection = {
          tagStatus   = "untagged"
          countType   = "sinceImagePushed"
          countUnit   = "days"
          countNumber = 14
        }
        action = {
          type = "expire"
        }
      },
      {
        rulePriority = 2
        description  = "Keep only last 10 tagged images"
        selection = {
          tagStatus   = "any"
          countType   = "imageCountMoreThan"
          countNumber = 10
        }
        action = {
          type = "expire"
        }
      }
    ]
  })
}

# -----------------------------------------------------------------------------
# Lambda — Manifest Parser
# -----------------------------------------------------------------------------

module "lambda_manifest_parser" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=5.2.1"

  environment        = var.environment
  application_family = var.application_family
  lambda_name        = "lambda-resonance-manifest-parser"
  lambda_description = "Streams DDB export files and dispatches fan batches to SQS"

  use_container_image = true

  # The module ignores image URI changes after creation — deployments happen
  # outside Terraform. After pushing a new :latest image, update the function:
  #   aws lambda update-function-code --function-name lambda-resonance-manifest-parser \
  #     --image-uri "<ecr_url>:latest"
  container_image_custom_uri = "${aws_ecr_repository.manifest_parser.repository_url}:latest"

  # Module creates a security group (dev-lambda-resonance-manifest-parser-lambda-security-group)
  # with full egress (0.0.0.0/0) by default via vpc_create_security_group = true.
  vpc_enabled    = true
  vpc_id         = module.vpc_info.vpc_id
  vpc_subnet_ids = module.vpc_info.default_private_subnet_ids

  lambda_function_timeout                        = var.manifest_parser_timeout
  lambda_function_memory_size                    = var.manifest_parser_memory_size
  lambda_function_reserved_concurrent_executions = var.manifest_parser_concurrency

  # Datadog disabled in dev — enable for prod
  datadog_enabled          = false
  datadog_advanced_enabled = false

  # Disable unused org integrations — Manifest Parser has no OWS or Split.io deps
  ows_machine_to_machine_enabled = false
  splitio_enabled                = false

  dlq_type = "sqs"

  lambda_function_environment_variables = {
    ENVIRONMENT       = var.environment
    SQS_QUEUE_URL     = module.manifest_files_queue.queue_url
    DDB_EXPORT_BUCKET = var.ddb_export_bucket_name
    FAN_BATCH_SIZE    = tostring(var.fan_batch_size)
  }

  # IAM policies attached as inline role policies in iam.tf
  # (generic-engineer-role lacks iam:CreatePolicy for managed policies)

  zappa_s3_policy_enabled = false
}