/*Cognito service for locations authentication*/
resource "aws_cognito_identity_pool" "smf_location_service" {
  identity_pool_name               = "SMFLocationService"
  allow_unauthenticated_identities = true
}

//terraform import aws_cognito_identity_pool.smf_location_service us-east-1:4f2eca1c-4c58-49a9-b067-e8cfb88baeb5

data "aws_iam_policy_document" "smf_location_service_unauthenticated" {
  statement {
    effect = "Allow"

    principals {
      type        = "Federated"
      identifiers = ["cognito-identity.amazonaws.com"]
    }

    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "cognito-identity.amazonaws.com:aud"
      values   = [aws_cognito_identity_pool.smf_location_service.id]
    }

    condition {
      test     = "ForAnyValue:StringLike"
      variable = "cognito-identity.amazonaws.com:amr"
      values   = ["unauthenticated"]
    }
  }
}

resource "aws_iam_role" "smf_location_service_unauthenticated" {
  name               = "smf_location_service_unauthenticated"
  assume_role_policy = data.aws_iam_policy_document.smf_location_service_unauthenticated.json
}

data "aws_iam_policy_document" "smf_location_service_unauthenticated_policy" {
  statement {
    effect = "Allow"
    actions = [
      "geo:SearchPlaceIndex*",
      "geo:GetPlace"
    ]
    resources = ["arn:aws:geo:${var.aws_region_id}:${local.account_id}:place-index/SMFLocationService"]

    condition {
      test     = "StringLike"
      variable = "aws:referer"

      values = var.smf_locations_urls
    }
  }
}

resource "aws_iam_policy" "smf_location_service_unauthenticated_policy" {
  name   = "smf_location_service_unauthenticated_policy"
  policy = data.aws_iam_policy_document.smf_location_service_unauthenticated_policy.json

  lifecycle {
    ignore_changes = [policy]
  }
}

resource "aws_iam_role_policy_attachment" "smf_location_service_unauthenticated_policy" {
  role       = aws_iam_role.smf_location_service_unauthenticated.name
  policy_arn = aws_iam_policy.smf_location_service_unauthenticated_policy.arn
}

resource "aws_cognito_identity_pool_roles_attachment" "smf_location_service" {
  identity_pool_id = aws_cognito_identity_pool.smf_location_service.id

  roles = {
    "unauthenticated" = aws_iam_role.smf_location_service_unauthenticated.arn
  }
}

/* Allow developer role to change the policy*/

data "aws_iam_policy_document" "dev_access_to_policy" {
  version = "2012-10-17"

  statement {
    sid    = "AllowPolicyChanges"
    effect = "Allow"

    actions = [
      "iam:GetPolicy",
      "iam:GetPolicyVersion",
      "iam:CreatePolicyVersion",
      "iam:DeletePolicyVersion",
      "iam:DeletePolicy",
      "iam:AttachRolePolicy",
      "iam:DetachRolePolicy",
    ]

    resources = [
      aws_iam_policy.smf_location_service_unauthenticated_policy.arn,
    ]
  }
}

resource "aws_iam_policy" "dev_access_to_policy" {
  name   = "smf_location_service_unauthenticated_policy_dev_access"
  policy = data.aws_iam_policy_document.dev_access_to_policy.json
}

resource "aws_iam_role_policy_attachment" "dev_access_to_policy" {
  role       = "cross_account_developer"
  policy_arn = aws_iam_policy.dev_access_to_policy.arn
}