locals {
  read_global_actions = [
    "ecr:GetAuthorizationToken",
    "ecr:DescribeRepositories",
  ]
  read_repository_actions = [
    "ecr:BatchCheckLayerAvailability",
    "ecr:BatchGetImage",
    "ecr:DescribeImages",
    "ecr:DescribeImageScanFindings",
    "ecr:GetDownloadUrlForLayer",
    "ecr:GetLifecyclePolicy",
    "ecr:GetLifecyclePolicyPreview",
    "ecr:GetRepositoryPolicy",
    "ecr:ListImages",
    "ecr:ListTagsForResource",
  ]

  write_global_actions = []
  write_repository_actions = [
    "ecr:CompleteLayerUpload",
    "ecr:InitiateLayerUpload",
    "ecr:PutImage",
    "ecr:UploadLayerPart",
  ]

  delete_global_actions     = []
  delete_repository_actions = []

  global_actions = concat(
    (contains(var.action_types, "read") ? local.read_global_actions : []),
    (contains(var.action_types, "write") ? local.write_global_actions : []),
    (contains(var.action_types, "delete") ? local.delete_global_actions : []),
  )

  repository_actions = concat(
    (contains(var.action_types, "read") ? local.read_repository_actions : []),
    (contains(var.action_types, "write") ? local.write_repository_actions : []),
    (contains(var.action_types, "delete") ? local.delete_repository_actions : []),
  )

  sid_suffix = substr(sha256(jsonencode(var.repositories)), 0, 10)
}


data "aws_iam_policy_document" "policy" {
  version = "2012-10-17"

  dynamic "statement" {
    for_each = length(local.repository_actions) > 0 ? ["Enabled"] : []
    content {
      sid       = "AllowRepositoryActions${local.sid_suffix}"
      effect    = "Allow"
      actions   = sort(local.repository_actions)
      resources = var.repositories
    }
  }

  dynamic "statement" {
    for_each = var.enable_global_actions && length(local.global_actions) > 0 ? ["Enabled"] : []
    content {
      sid       = "AllowGlobalActions${local.sid_suffix}"
      effect    = "Allow"
      actions   = local.global_actions
      resources = ["*"]
    }
  }

  lifecycle {
    postcondition {
      condition     = self.statement != null
      error_message = "Policy must contain at least one statement"
    }
  }
}