module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

data "aws_caller_identity" "current" {}

data "aws_canonical_user_id" "current" {}

terraform {
  backend "s3" {
    bucket  = "qa-accounting-terraform-state"
    key     = "uat/lambda-abacus/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.1.0"

  environment = "uat"
}

module "aws_accounts" {
  source = "git@github.com:theorchard/terraform-aws-accounts-map.git//modules/read_accounts_map?ref=3.0.3"
}

data "aws_lambda_function" "av_scan_lambda" {
  function_name = "${var.environment}-${var.av_scan_lambda_function_name}"
}

# START - PAYONEER PAYMENTS PAYOUT

module "lambda_abacus_payoneer_payments_payout_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.2"

  environment        = var.environment
  platform           = "python"
  service_name       = "${var.service_name}-payoneer-payments-payout"
  teams              = ["abacus-qa"]
  application_family = var.application_family

}

/*
module "lambda_abacus_payoneer_payments_payout_owsrequest" {
  source           = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.1.0"
  environment_name = var.environment
  service_name     = "${var.service_name}-payoneer-payments-payout"
}
*/

module "lambda_abacus_payoneer_payments_payout" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=3.2.0"

  environment                                       = var.environment
  lambda_function_timeout                           = 900
  use_container_image                               = true
  lambda_description                                = "Create the payments batches and send it to payoneer"
  lambda_name                                       = "${var.service_name}-payoneer-payments-payout"
  vpc_id                                            = module.vpc_info.vpc_id
  vpc_subnet_ids                                    = module.vpc_info.default_private_subnet_ids
  application_family                                = var.application_family
  lambda_function_provisioned_concurrent_executions = var.lambda_provisioned_concurrent_executions

  lambda_function_reserved_concurrent_executions = 2
  lambda_function_memory_size                    = 1024

  datadog_enabled          = true
  datadog_advanced_enabled = true

  lambda_function_environment_variables = {
    ENVIRONMENT = var.environment
  }

  iam_managed_policy_attachments = [
    #module.lambda_abacus_payoneer_payments_payout_owsrequest.policy_arn_output
  ]
}

# END - PAYONEER PAYMENTS PAYOUT

# START - INVOKE POLICY
# Note the statement for lambda:InvokeFunction allows both unqualified and and qualified (:*) access
data "aws_iam_role" "generic_engineer_role" {
  name = "generic-engineer-role"
}

data "aws_iam_policy_document" "abacus_lambdas_invoke" {
  statement {
    effect = "Allow"
    resources = [
      module.lambda_abacus_adjustment_file_import.lambda_arn,
      module.lambda_abacus_adjustment_file_validation.lambda_arn,
      module.lambda_abacus_adjustments_apply.lambda_arn,
      module.lambda_abacus_adjustments_json_import.lambda_arn,
      module.lambda_abacus_adjustments_json_validation.lambda_arn,
      module.lambda_abacus_snapshot_contracts.lambda_arn,
      module.lambda_abacus_contract_lifecycle_automation.lambda_arn,
      module.lambda_abacus_schedule_auto_add.lambda_arn,
      module.lambda_abacus_sync_account.lambda_arn,
      module.lambda_abacus_commit_ledger_account_contract.lambda_arn,
      module.lambda_abacus_commit_royalties.lambda_arn,
      module.lambda_abacus_commit_mechanicals.lambda_arn,
      module.lambda_abacus_correction_apply.lambda_arn,
      module.lambda_abacus_correction_stage.lambda_arn,
      module.lambda_abacus_generate_flowthrough_adjustments.lambda_arn,
      module.lambda_abacus_ledger_accounting_run_balance.lambda_arn,
      module.lambda_abacus_payoneer_payments_payout.lambda_arn,
      module.lambda_abacus_payment_allocation.lambda_arn,
      module.lambda_abacus_payments_generate.lambda_arn,
      module.lambda_abacus_reserves_release.lambda_arn,
      module.lambda_abacus_reserves_take.lambda_arn,
      module.lambda_abacus_reserves_schedule.lambda_arn,
      module.lambda_abacus_royalty_collection_territory_backfill.lambda_arn,
      module.lambda_abacus_sync_contract.lambda_arn,
      module.lambda_abacus_sync_contract_sap.lambda_arn,
      module.lambda_abacus_earnings_transfer.lambda_arn,
      data.aws_lambda_function.av_scan_lambda.arn,
      "${module.lambda_abacus_adjustment_file_import.lambda_arn}:*",
      "${module.lambda_abacus_adjustment_file_validation.lambda_arn}:*",
      "${module.lambda_abacus_adjustments_apply.lambda_arn}:*",
      "${module.lambda_abacus_adjustments_json_import.lambda_arn}:*",
      "${module.lambda_abacus_adjustments_json_validation.lambda_arn}:*",
      "${module.lambda_abacus_snapshot_contracts.lambda_arn}:*",
      "${module.lambda_abacus_contract_lifecycle_automation.lambda_arn}:*",
      "${module.lambda_abacus_schedule_auto_add.lambda_arn}:*",
      "${module.lambda_abacus_sync_account.lambda_arn}:*",
      "${module.lambda_abacus_commit_ledger_account_contract.lambda_arn}:*",
      "${module.lambda_abacus_commit_mechanicals.lambda_arn}:*",
      "${module.lambda_abacus_commit_royalties.lambda_arn}:*",
      "${module.lambda_abacus_correction_apply.lambda_arn}:*",
      "${module.lambda_abacus_correction_stage.lambda_arn}:*",
      "${module.lambda_abacus_generate_flowthrough_adjustments.lambda_arn}:*",
      "${module.lambda_abacus_ledger_accounting_run_balance.lambda_arn}:*",
      "${module.lambda_abacus_payoneer_payments_payout.lambda_arn}:*",
      "${module.lambda_abacus_payments_generate.lambda_arn}:*",
      "${module.lambda_abacus_payment_allocation.lambda_arn}:*",
      "${module.lambda_abacus_reserves_release.lambda_arn}:*",
      "${module.lambda_abacus_reserves_take.lambda_arn}:*",
      "${module.lambda_abacus_reserves_schedule.lambda_arn}:*",
      "${module.lambda_abacus_royalty_collection_territory_backfill.lambda_arn}:*",
      "${module.lambda_abacus_sync_contract.lambda_arn}:*",
      "${module.lambda_abacus_sync_contract_sap.lambda_arn}:*",
      "${module.lambda_abacus_earnings_transfer.lambda_arn}:*",
      "${data.aws_lambda_function.av_scan_lambda.arn}:*",
    ]
    actions = [
      "lambda:InvokeFunction"
    ]
  }
}

resource "aws_iam_policy" "abacus_lambdas_invoke_policy" {
  name        = "${var.environment}-lambda-abacus-generic-invoke-policy"
  description = "Policy for invoking abacus lambdas"
  policy      = data.aws_iam_policy_document.abacus_lambdas_invoke.json
}

resource "aws_iam_role_policy_attachment" "generic_engineer_invoke_policy_attachment" {
  role       = data.aws_iam_role.generic_engineer_role.name
  policy_arn = aws_iam_policy.abacus_lambdas_invoke_policy.arn
}

# END - INVOKE POLICY

# START - SECRETS MANAGER POLICY

resource "aws_iam_role_policy" "generic_engineer_secrets_manager" {
  name = "${var.environment}-${var.service_name}-secrets-manager-access"
  role = data.aws_iam_role.generic_engineer_role.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "secretsmanager:GetSecretValue",
          "secretsmanager:DescribeSecret",
          "secretsmanager:ListSecretVersionIds",
          "secretsmanager:GetResourcePolicy",
          "secretsmanager:PutSecretValue",
          "secretsmanager:UpdateSecret",
          "secretsmanager:TagResource",
          "secretsmanager:UntagResource",
          "secretsmanager:RotateSecret",
          "secretsmanager:CancelRotateSecret"
        ]
        Resource = "arn:aws:secretsmanager:${var.aws_region}:${data.aws_caller_identity.current.account_id}:secret:${var.environment}/${var.service_name}-*"
      },
      {
        Effect   = "Allow"
        Action   = ["secretsmanager:ListSecrets"]
        Resource = "*"
      }
    ]
  })
}

# END - SECRETS MANAGER POLICY