module "lambda_abacus_sync_contract_sap_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.2"

  environment        = var.environment
  platform           = "python"
  service_name       = "lambda-abacus-sync-contract-sap"
  teams              = ["abacus-qa"]
  application_family = var.application_family
}

# module "lambda_abacus_sync_contract_sap_owsrequest" {
#   source           = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.1.0"
#   environment_name = var.environment
#   service_name     = "lambda-abacus-sync-contract-sap"
# }

module "lambda_abacus_sync_contract_sap" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=3.2.0"

  environment                                       = var.environment
  lambda_function_timeout                           = 900
  use_container_image                               = true
  lambda_description                                = "Sends new contract and account records to the SAP system."
  lambda_name                                       = "${var.service_name}-sync-contract-sap"
  vpc_id                                            = module.vpc_info.vpc_id
  vpc_subnet_ids                                    = module.vpc_info.default_private_subnet_ids
  application_family                                = var.application_family
  lambda_function_provisioned_concurrent_executions = var.lambda_provisioned_concurrent_executions

  lambda_function_reserved_concurrent_executions = 2
  lambda_function_memory_size                    = 1024

  datadog_enabled          = true
  datadog_advanced_enabled = true

  lambda_function_environment_variables = {
    ENVIRONMENT = var.environment
    SAP_ENV     = var.sap_env
    SAP_API     = var.sap_api

    MYSQL_DB_HOST = var.lambda_abacus_mysql_host
    MYSQL_DB_NAME = var.lambda_abacus_mysql_database
    MYSQL_DB_USER = var.lambda_abacus_mysql_user
  }

  iam_managed_policy_attachments = [
    # module.lambda_abacus_sync_contract_sap_owsrequest.policy_arn_output
  ]
}

module "lambda_abacus_sync_contract_sap_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.sync_contract_sap_secrets_manager_secret_names)

  application_family = var.application_family
  environment        = var.environment
  service_name       = "${var.service_name}-sync-contract-sap"
  secret_name        = each.value
}

# START - SYNC CONTRACT SAP DAILY SCHEDULE

# IAM role for the sync_contract_sap_daily_schedule to assume
resource "aws_iam_role" "sync_contract_sap_scheduler_execution_role" {
  name               = "${var.environment}-${var.service_name}-sync-contract-sap-scheduler-role"
  assume_role_policy = data.aws_iam_policy_document.assume_scheduler_role.json
}

# Policy document to allow Lambda invocation
data "aws_iam_policy_document" "invoke_sync_contract_sap_lambda_policy" {
  statement {
    effect  = "Allow"
    actions = ["lambda:InvokeFunction"]

    resources = [module.lambda_abacus_sync_contract_sap.lambda_arn]
  }
}

# Invoke Lambda role policy for the sync_contract_sap_scheduler_execution_role
resource "aws_iam_role_policy" "sync_contract_sap_scheduler_invoke_lambda_policy" {
  name   = "${var.environment}-${var.service_name}-sync-contract-sap-scheduler-role-policy"
  role   = aws_iam_role.sync_contract_sap_scheduler_execution_role.name
  policy = data.aws_iam_policy_document.invoke_sync_contract_sap_lambda_policy.json
}

# KMS key required by EventBridge Scheduler
resource "aws_kms_key" "sync_contract_sap_scheduler_kms_key" {
  description             = "${var.environment}-${var.service_name}-sync-contract-sap-scheduler-kms-key"
  enable_key_rotation     = true
  deletion_window_in_days = 30

  tags = {
    environment        = var.environment
    service_name       = var.service_name
    application_family = var.application_family
    terraformed        = true
  }
}

# Alias for the KMS key
resource "aws_kms_alias" "sync_contract_sap_scheduler_kms_alias" {
  name          = "alias/${var.environment}-${var.service_name}-sync-contract-sap-scheduler"
  target_key_id = aws_kms_key.sync_contract_sap_scheduler_kms_key.key_id
}

# Policy document for the KMS role policy
data "aws_iam_policy_document" "sync_contract_sap_kms_decryption_policy" {
  statement {
    actions = [
      "kms:Encrypt",
      "kms:Decrypt",
      "kms:DescribeKey",
    ]

    resources = [aws_kms_key.sync_contract_sap_scheduler_kms_key.arn]
  }
}

# KMS role policy for the sync_contract_sap_scheduler_execution_role
resource "aws_iam_role_policy" "sync_contract_sap_scheduler_kms_policy" {
  name   = "${var.environment}-${var.service_name}-sync-contract-sap-scheduler-kms-policy"
  role   = aws_iam_role.sync_contract_sap_scheduler_execution_role.name
  policy = data.aws_iam_policy_document.sync_contract_sap_kms_decryption_policy.json
}

# EventBridge Scheduler Schedule to trigger the Lambda function daily at
# 11pm Eastern. The empty input selects the lambda's batch mode; engineers
# can still trigger ad-hoc runs by invoking the lambda manually with {}.
resource "aws_scheduler_schedule" "sync_contract_sap_daily_schedule" {
  name        = "${var.environment}-${var.service_name}-sync-contract-sap-daily-schedule"
  group_name  = aws_scheduler_schedule_group.contract_lifecycle_automation_schedule_group.name
  state       = "ENABLED"
  kms_key_arn = aws_kms_key.sync_contract_sap_scheduler_kms_key.arn

  flexible_time_window {
    mode                      = "FLEXIBLE"
    maximum_window_in_minutes = 5
  }

  schedule_expression          = "cron(0 23 * * ? *)"
  schedule_expression_timezone = "America/New_York"

  target {
    arn      = module.lambda_abacus_sync_contract_sap.lambda_arn
    role_arn = aws_iam_role.sync_contract_sap_scheduler_execution_role.arn
    input    = jsonencode({})

    retry_policy {
      maximum_event_age_in_seconds = 300
      maximum_retry_attempts       = 1
    }
  }
}

# Allow the scheduler to invoke the Lambda function
resource "aws_lambda_permission" "allow_scheduler_invoke_sync_contract_sap" {
  statement_id  = "AllowSchedulerInvoke"
  action        = "lambda:InvokeFunction"
  function_name = module.lambda_abacus_sync_contract_sap.lambda_arn
  principal     = "scheduler.amazonaws.com"
  source_arn    = aws_scheduler_schedule.sync_contract_sap_daily_schedule.arn
}

# END - SYNC CONTRACT SAP DAILY SCHEDULE