/*
locals {
  dna_cms_secrets_list = [
    "CMS_CLIENT_SECRET_PROD",
    "SECRET_KEY",
    "SENTRY_DSN",
  ]

  dna_cms_common_secrets = {}

  dna_cms_secrets_mapping = [
    for k, v in merge(aws_secretsmanager_secret.dna_cms_secret, local.dna_cms_common_secrets) :
    {
      name      = k,
      valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:${v["name"]}"
    }
  ]

  dna_cms_secrets_combined = concat(local.dna_cms_secrets_mapping, [
    {
      name      = "POSTGRES_DB_PASS",
      valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:${local.project_group}/${local.env_prefix}/cms/pg/user:password::"
    },
    {
      name      = "POSTGRES_DB_USER",
      valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:${local.project_group}/${local.env_prefix}/cms/pg/user:username::"
    },
    {
      name      = "POSTGRES_DB_HOST",
      valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:${local.project_group}/${local.env_prefix}/cms/pg/user:host::"
    },
    {
      name      = "POSTGRES_DB_PORT",
      valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:${local.project_group}/${local.env_prefix}/cms/pg/user:port::"
    },
  ])

  dna_cms_env_vars = [
    {
      name  = "FLASK_ENV",
      value = local.environment
    },
    {
      name  = "POSTGRES_DB_NAME",
      value = "cms_${local.env_prefix}"
    },
    {
      name  = "AWS_S3_BUCKET_NAME",
      value = "${local.name_prefix}-cms-assets"
    },
    {
      name  = "ATLAS_LOGIN_URL",
      value = "https://${module.domains[local.env_prefix]["atlas-auth-proxy"]}/login"
    },
    {
      name  = "ATLAS_LOGOUT_URL",
      value = "https://${module.domains[local.env_prefix]["atlas-auth-proxy"]}/logout"
    },
    {
      name  = "ATLAS_REFRESH_TOKEN_URL",
      value = "https://${module.atlas_domains[local.env_prefix]["atlas-um"]}/usm/token/refresh"
    },
    {
      name  = "ATLAS_PUBLIC_KEY_URL",
      value = "https://${module.atlas_domains[local.env_prefix]["atlas-um-static"]}/pem/public.pem"
    },
    {
      name = "ATLAS_BEARER_TOKEN_COOKIE_NAME",
      value = "dna_bearer_token_${local.env_prefix}"
    },
    {
      name = "ATLAS_REFRESH_TOKEN_COOKIE_NAME",
      value = "dna_refresh_token_${local.env_prefix}"
    },
    {
      name  = "ALLOWED_HOSTS",
      value = module.domains[local.env_prefix]["cms"]
    },
    {
      name  = "ATLAS_BASE_URL_PROD",
      value = "https://${module.atlas_domains.prod["atlas-um"]}/"
    },
    {
      name  = "CMS_CLIENT_ID_PROD",
      value = "be6d034d-4c74-425d-92b1-0442df1a40b0"
    },
    {
      name  = "CMS_BASE_URL_PROD",
      value = "https://${module.domains.prod["cms"]}/"
    },
    {
      name  = "CMS_AUDIENCE_PROD",
      value = "dna|cms"
    },
    {
      name  = "ENVIRONMENT",
      value = local.environment
    },
  ]
}

data "aws_ecr_repository" "dna_cms_ecr" {
  name = "dna/cms"
}

resource "aws_secretsmanager_secret" "dna_cms_secret" {
  for_each = toset(local.dna_cms_secrets_list)

  name       = "${local.secrets_name_prefix}/cms/${each.value}"
  kms_key_id = data.aws_kms_key.secrets_general_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

module "dna_cms_ecs_role" {
  source      = "../../../modules/iam/roles/ecs_task_role"
  name        = "admin_panel_role"
  name_prefix = local.name_prefix

  policies_list = [
    data.aws_iam_policy.secrets_services_ro.arn,
    data.aws_iam_policy.logging_policy.arn,
  ]
}

module "cms_db_migrations_task_def" {
  source = "../../../modules/ecs/tasks/fargate_v3"

  env_prefix        = local.env_prefix
  project_group     = local.project_group
  family            = "${local.env_prefix}-${local.project_group}-cms_db_migrations"
  container_name    = "cms-db-migrations"
  container_image   = "${data.aws_ecr_repository.dna_cms_ecr.repository_url}:${local.docker_image_env_tag[local.env_prefix]}"
  cpu               = 512
  memory            = 1024
  working_directory = "/app/src"

  awslogs_retention = module.cloudwatch_logs_retention_by_env[local.env_prefix]

  task_role_arn = data.aws_iam_role.standard_exec.arn
  exec_role_arn = data.aws_iam_role.standard_exec.arn

  env_vars = local.dna_cms_env_vars
  secrets = [
    {
      name      = "POSTGRES_DB_PASS",
      valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:maintenance/common/${local.project_group}/${local.env_prefix}/cms_owner:password::"
    },
    {
      name      = "POSTGRES_DB_USER",
      valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:maintenance/common/${local.project_group}/${local.env_prefix}/cms_owner:username::"
    },
    {
      name      = "POSTGRES_DB_HOST",
      valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:maintenance/common/${local.project_group}/${local.env_prefix}/cms_owner:host::"
    },
    {
      name      = "POSTGRES_DB_PORT",
      valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:maintenance/common/${local.project_group}/${local.env_prefix}/cms_owner:port::"
    },
    {
      name      = "SECRET_KEY",
      valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:${local.secrets_name_prefix}/cms/SECRET_KEY"
    },
    {
      name      = "SENTRY_DSN",
      valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:${local.secrets_name_prefix}/cms/SENTRY_DSN"
    },
  ]

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_PRL_ECS"
    }
  )
}

/*
module "dna_cms" {
  source = "../../../modules/ecs/services/webservice"

  env_prefix         = local.env_prefix
  project_group      = local.project_group
  region             = var.aws_region_id
  vpc_id             = data.aws_vpc.main.id
  cluster_arn        = data.aws_ecs_cluster.main.arn
  security_groups    = [data.aws_security_group.ecs.id]
  https_listener_arn = data.aws_lb_listener.external_https_listener.arn
  task_exec_role_arn = data.aws_iam_role.standard_exec.arn

  # Networking parameters. Preferably use private subnets for containers
  is_public = false
  subnets   = data.aws_subnets.private_subnets.ids

  # Parameters that should be customized for each service
  project                 = "cms"
  task_role_arn           = module.dna_cms_ecs_role.role.arn
  url                     = module.domains[local.env_prefix]["cms"]
  tg_health_check_path    = "/health"
  tg_health_check_matcher = "200"
  container_port          = 8000
  cpu                     = 1024
  memory                  = 2048
  task_count              = 1
  secrets                 = jsonencode(local.dna_cms_secrets_combined)
  env_vars                = local.dna_cms_env_vars
  image                   = "${data.aws_ecr_repository.dna_cms_ecr.repository_url}:${local.docker_image_env_tag[local.env_prefix]}"
  enable_ecs_managed_tags = true

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_PRL_ECS"
    }
  )
}

resource "aws_route53_record" "dna_cms_record" {
  zone_id = data.aws_route53_zone.main.zone_id
  name    = module.domains[local.env_prefix]["cms"]
  type    = "A"

  alias {
    name                   = data.aws_lb.external_alb.dns_name
    zone_id                = data.aws_lb.external_alb.zone_id
    evaluate_target_health = false
  }

  provider = aws.gdb-whitelist-legacy
}
*/