locals {
  delphi_api_secrets_set = toset([
    "SENTRY_DSN",
  ])

  delphi_api_common_secrets = {
    SENTRY_DSN = aws_secretsmanager_secret.delphi_api_secret["SENTRY_DSN"]
  }

  delphi_api_secrets_json = jsonencode(
    [
      for k, v in local.delphi_api_common_secrets :
      {
        name      = k,
        valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:${v["name"]}"
      }
    ]
  )
}

resource "aws_secretsmanager_secret" "delphi_api_secret" {
  for_each   = local.delphi_api_secrets_set
  name       = "${local.secrets_name_prefix}/api/${each.value}"
  kms_key_id = data.aws_kms_key.secrets_general_key.id
  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

# Rotated user secrets
locals {
  maindb_rotated_secrets_set = toset([
    "api/pg/reader",
    "api/pg/user",
    "api/pg/data-health-user",
  ])
}

resource "aws_secretsmanager_secret" "maindb_rotated_secrets" {
  for_each   = local.maindb_rotated_secrets_set
  name       = "${local.secrets_name_prefix}/${each.value}"
  kms_key_id = data.aws_kms_key.secrets_general_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )

  lifecycle {
    ignore_changes = [description]
  }
}

resource "aws_secretsmanager_secret_rotation" "maindb_rotated_secrets" {
  for_each            = local.maindb_rotated_secrets_set
  secret_id           = aws_secretsmanager_secret.maindb_rotated_secrets[each.value].id
  rotation_lambda_arn = local.rotation_lambda_arn

  rotation_rules {
    automatically_after_days = 90
  }
}

# This secrets should be accessed programmatically and not as an env variable
resource "aws_secretsmanager_secret" "delphi_api_db_params" {
  name       = "${local.secrets_name_prefix}/api/db_params"
  kms_key_id = data.aws_kms_key.secrets_general_key.id
  #rotation_lambda_arn = ?
  #rotation_rules {
  #  automatically_after_days = ?
  #}
  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

resource "aws_secretsmanager_secret" "delphi_api_frozen_db_params" {
  name       = "${local.secrets_name_prefix}/api/frozen/db_params"
  kms_key_id = data.aws_kms_key.secrets_general_key.id
  #rotation_lambda_arn = ?
  #rotation_rules {
  #  automatically_after_days = ?
  #}
  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}