locals {
  handle_user_changes_secrets_set = toset([
    "SENTRY_DSN",
    "INTERCOM_ACCESS_TOKEN",
  ])
}

data "aws_ecr_repository" "handle_user_changes_ecr" {
  name = "${local.project_group}/lambda/handle-user-changes"

  provider = aws.gdb-apollo-dev
}

resource "aws_cloudwatch_log_group" "handle_user_changes_log_group" {
  name              = "/aws/lambda/${local.name_prefix}-handle_user_changes"
  retention_in_days = module.cloudwatch_logs_retention_by_env[local.env_prefix]

  tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "CloudWatch",
      plat_env_project_service = "${local.aggregated_tag}_PRL_CW"
    }
  )
}

resource "aws_secretsmanager_secret" "handle_user_changes_secret" {
  for_each = local.handle_user_changes_secrets_set

  name       = "${local.secrets_name_prefix}/handle_user_changes/${each.value}"
  kms_key_id = data.aws_kms_key.secrets_general_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

module "handle_user_changes_role" {
  source = "../../../modules/iam/roles/lambda_role"

  name_prefix                = local.name_prefix
  name                       = "handle_user_changes_role"
  allow_execution_inside_vpc = true

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "Lambda",
      plat_env_project_service = "${local.aggregated_tag}_PRL_LMB"
    }
  )

  policies_list = [
    data.aws_iam_policy.secrets_services_ro.arn,
    data.aws_iam_policy.logging_policy.arn,
  ]
}

resource "aws_lambda_function" "handle_user_changes_lambda" {
  function_name = "${local.name_prefix}-handle_user_changes"
  image_uri     = "${data.aws_ecr_repository.handle_user_changes_ecr.repository_url}:${local.docker_image_env_tag[local.env_prefix]}"
  package_type  = "Image"
  role          = module.handle_user_changes_role.role.arn
  description   = "Managed by Terraform."

  memory_size = 128
  timeout     = 900

  vpc_config {
    security_group_ids = [data.aws_security_group.lambda.id]
    subnet_ids         = data.aws_subnets.private_subnets.ids
  }

  environment {
    variables = {
      ADMIN_API_HOST                             = module.domains[local.env_prefix]["admin-api-proxy"]
      ADMIN_API_KEY                              = aws_secretsmanager_secret.common_secret["ADMINAPI_KEY"].name
      APOLLO_API_HOST                            = module.domains[local.env_prefix]["apollo-api"]
      APOLLO_API_KEY                             = aws_secretsmanager_secret.apollo_api_secret["AUTH_API_KEY"].name
      ENABLE_HOME_MARKET_UPDATE                  = "True"
      ENABLE_INTERCOM_USER_UPDATE                = "True"
      ENABLE_SETUP_DEFAULT_NOTIFICATION_SETTINGS = "True"
      ENVIRONMENT                                = local.environment
      INTERCOM_ACCESS_TOKEN                      = aws_secretsmanager_secret.handle_user_changes_secret["INTERCOM_ACCESS_TOKEN"].name
      MYSQL_DB_HOST                              = module.domains[local.env_prefix]["main-db-rw"]
      MYSQL_DB_NAME                              = "dbSony_dbo"
      MYSQL_DB_PASS                              = aws_secretsmanager_secret.apollo_api_secret["MYSQL_DB_PASS"].name
      MYSQL_DB_USER                              = aws_secretsmanager_secret.apollo_api_secret["MYSQL_DB_USER"].name
      REDIS_HOST                                 = data.aws_elasticache_cluster.main.cache_nodes.0.address
      SENTRY_DSN                                 = aws_secretsmanager_secret.handle_user_changes_secret["SENTRY_DSN"].name
    }
  }

  tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "Lambda",
      plat_env_project_service = "${local.aggregated_tag}_PRL_LMB",
      service_name             = "apollo-handle-user-changes"
    }
  )

  depends_on = [
    aws_secretsmanager_secret.handle_user_changes_secret,
    aws_cloudwatch_log_group.handle_user_changes_log_group,
    module.handle_user_changes_role,
  ]

  lifecycle {
    ignore_changes = [
      image_uri
    ]
  }
}

resource "aws_lambda_permission" "handle_user_changes_permissions" {
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.handle_user_changes_lambda.function_name
  principal     = "logs.${var.aws_region_id}.amazonaws.com"
}

resource "aws_cloudwatch_log_subscription_filter" "authentication_api_handle_user_changes_filter" {
  name            = "${local.name_prefix}-handle_user_changes_filter"
  log_group_name  = aws_cloudwatch_log_group.authentication_api.name
  filter_pattern  = ""
  destination_arn = aws_lambda_function.handle_user_changes_lambda.arn
}

resource "aws_cloudwatch_log_subscription_filter" "management_api_handle_user_changes_filter" {
  name            = "${local.name_prefix}-handle_user_changes_filter"
  log_group_name  = aws_cloudwatch_log_group.management_api.name
  filter_pattern  = ""
  destination_arn = aws_lambda_function.handle_user_changes_lambda.arn
}