resource "aws_s3_bucket" "input_bucket" {
  bucket              = "${var.environment}-${var.input_bucket_name}"
  acl                 = "private"
  acceleration_status = "Enabled"

  dynamic "cors_rule" {
    for_each = var.input_bucket_cors
    content {
      allowed_headers = cors_rule.value.allowed_headers
      allowed_methods = cors_rule.value.allowed_methods
      allowed_origins = cors_rule.value.allowed_origins
      expose_headers  = cors_rule.value.expose_headers
      max_age_seconds = cors_rule.value.max_age_seconds
    }
  }

  dynamic "logging" {
    for_each = var.logging_target_bucket
    content {
      target_bucket = logging.value
      target_prefix = "${var.environment}-${var.input_bucket_name}"
    }
  }

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = "AES256"
      }
    }
  }
}

data "aws_iam_policy_document" "output_buckets_readonly_policy" {
  statement {
    actions = [
      "s3:ListBucket",
    ]

    effect    = "Allow"
    resources = formatlist("arn:aws:s3:::%s", var.output_buckets_names)
  }

  statement {
    actions = [
      "s3:GetObject",
      "s3:HeadObject",
    ]

    effect    = "Allow"
    resources = formatlist("arn:aws:s3:::%s/*", var.output_buckets_names)
  }
}

resource "aws_iam_policy" "output_buckets_readonly_policy" {
  name        = "${var.environment}-asset-transcoder-output-buckets-readonly-policy"
  description = "Read only access to output buckets for asset-transcoder lambdas"
  policy      = data.aws_iam_policy_document.output_buckets_readonly_policy.json
}

data "aws_iam_policy_document" "input_bucket_policy" {
  statement {
    effect  = "Deny"
    actions = ["s3:PutObject"]
    not_resources = [
      "arn:aws:s3:::${aws_s3_bucket.input_bucket.id}/*.jpg",
      "arn:aws:s3:::${aws_s3_bucket.input_bucket.id}/*.jpeg",
      "arn:aws:s3:::${aws_s3_bucket.input_bucket.id}/*.tif",
      "arn:aws:s3:::${aws_s3_bucket.input_bucket.id}/*.tiff",
      "arn:aws:s3:::${aws_s3_bucket.input_bucket.id}/*.wav",    
    ]
    principals {
      type        = "CanonicalUser"
      identifiers = ["*"]
    }
  }
}

resource "aws_s3_bucket_policy" "input_bucket_write_policy" {
  policy = data.aws_iam_policy_document.input_bucket_policy.json
  bucket = aws_s3_bucket.input_bucket.id
}

data "aws_iam_policy_document" "output_buckets_readwrite_policy" {
  statement {
    actions = [
      "s3:ListBucket",
    ]

    effect    = "Allow"
    resources = formatlist("arn:aws:s3:::%s", var.output_buckets_names)
  }

  statement {
    actions = [
      "s3:GetObject",
      "s3:HeadObject",
      "s3:CopyObject",
      "s3:PutObject",
      "s3:PutObjectAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectVersionTagging"
    ]

    effect    = "Allow"
    resources = formatlist("arn:aws:s3:::%s/*", var.output_buckets_names)
  }
}

resource "aws_iam_policy" "output_buckets_readwrite_policy" {
  name        = "${var.environment}-asset-transcoder-output-buckets-readwrite-policy"
  description = "Read / Write access to output buckets for asset-transcoder microservice"
  policy      = data.aws_iam_policy_document.output_buckets_readwrite_policy.json
}

data "aws_iam_policy_document" "input_bucket_readwrite_policy" {
  statement {
    actions = [
      "s3:ListBucket",
    ]

    effect    = "Allow"
    resources = [aws_s3_bucket.input_bucket.arn]
  }

  statement {
    actions = [
      "s3:GetObject",
      "s3:HeadObject",
      "s3:CopyObject",
      "s3:PutObject",
      "s3:PutObjectAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectVersionTagging"
    ]

    effect    = "Allow"
    resources = [
      "${aws_s3_bucket.input_bucket.arn}/*",
    ]
  }
}

resource "aws_iam_policy" "input_bucket_readwrite_policy" {
  name        = "${var.environment}-asset-transcoder-input-bucket-readwrite-policy"
  description = "Read / Write access to input buckets for asset-transcoder microservice"
  policy      = data.aws_iam_policy_document.input_bucket_readwrite_policy.json
}