# Provider determines the method (AWS) and some basic provider properties
provider "aws" {
  region = "us-east-1"
}

# Caller Identity
data "aws_caller_identity" "current" {}

# Terraform backends cannot contain interpolations - of the form ${var.environment}-${var.service_name}-state
terraform {
  backend "s3" {
    bucket  = "dev-orcd-terraform-state"
    key     = "dev/lambda-sme-ext-meta/terraform.tfstate"
    region  = "us-east-1"
    encrypt = true
  }
}

data "aws_iam_policy_document" "generate_ddex_api_lambda_assume_role_policy_document" {
  statement {
    actions = [
      "sts:AssumeRole",
    ]

    principals {
      type = "Service"
      identifiers = [
        "apigateway.amazonaws.com"
      ]
    }
  }
}

resource "aws_api_gateway_rest_api" "generate_ddex_api" {
  name        = "sme-ext-meta-generate-ddex"
  description = "terraformed"

  endpoint_configuration {
    types = ["PRIVATE"]
    vpc_endpoint_ids = ["vpce-0b220fa99d0b727ad"]
  }
}

resource "aws_api_gateway_rest_api_policy" "generate_ddex_api_resouce_policy" {
  rest_api_id = aws_api_gateway_rest_api.generate_ddex_api.id

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "execute-api:Invoke",
      "Resource": "${aws_api_gateway_rest_api.generate_ddex_api.execution_arn}/*/GET/upc/*",
      "Condition": {
        "IpAddress": {
          "aws:VpcSourceIp": [
              "192.168.40.0/22",
              "192.168.32.0/24"
          ]
        }
      }
    }
  ]
}
EOF
}

# API Gateway Resources. /upc/-code-
resource "aws_api_gateway_resource" "aws_api_gateway_resource_upc" {
  rest_api_id = aws_api_gateway_rest_api.generate_ddex_api.id
  parent_id   = aws_api_gateway_rest_api.generate_ddex_api.root_resource_id
  path_part   = "upc"
}


resource "aws_api_gateway_resource" "aws_api_gateway_resource_code" {
  rest_api_id = aws_api_gateway_rest_api.generate_ddex_api.id
  parent_id   = aws_api_gateway_resource.aws_api_gateway_resource_upc.id
  path_part   = "{code}"
}

# API Gateway Resources method. /upc/-code- - GET
resource "aws_api_gateway_method" "generate_ddex_api_gateway_method" {
  rest_api_id   = aws_api_gateway_rest_api.generate_ddex_api.id
  resource_id   = aws_api_gateway_resource.aws_api_gateway_resource_code.id
  http_method   = "GET"
  authorization = "NONE"
}

# API Gateway method response
resource "aws_api_gateway_method_response" "generate_ddex_api_gateway_method_response" {
  rest_api_id = aws_api_gateway_rest_api.generate_ddex_api.id
  resource_id = aws_api_gateway_resource.aws_api_gateway_resource_code.id
  http_method = aws_api_gateway_method.generate_ddex_api_gateway_method.http_method
  status_code = "200"

  response_models = {
    "application/json" = "Empty"
  }
}

resource "aws_api_gateway_integration_response" "generate_ddex_api_api_gateway_integration_response" {
  rest_api_id = aws_api_gateway_rest_api.generate_ddex_api.id
  resource_id = aws_api_gateway_resource.aws_api_gateway_resource_code.id
  http_method = aws_api_gateway_method.generate_ddex_api_gateway_method.http_method
  status_code = aws_api_gateway_method_response.generate_ddex_api_gateway_method_response.status_code

  response_templates = {
    "application/json" = ""
  }
}

resource "aws_lambda_permission" "generate_ddex_lambda_api_gateway_permission" {
  statement_id  = "AllowAPIGatewayInvoke"
  action        = "lambda:InvokeFunction"
  function_name = module.lambda_generate_ddex.lambda_arn
  principal     = "apigateway.amazonaws.com"
  source_arn    = "arn:aws:execute-api:us-east-1:103233932089:${aws_api_gateway_rest_api.generate_ddex_api.id}/*/GET/upc/{code}"
}

# API Gateway integration
resource "aws_api_gateway_integration" "generate_ddex_api_stage" {
  rest_api_id             = aws_api_gateway_rest_api.generate_ddex_api.id
  resource_id             = aws_api_gateway_resource.aws_api_gateway_resource_code.id
  http_method             = aws_api_gateway_method.generate_ddex_api_gateway_method.http_method
  type                    = "AWS"
  uri                     = module.lambda_generate_ddex.lambda_invoke_arn
  integration_http_method = "POST"
  credentials             = module.lambda_generate_ddex.lambda_role_arn
  passthrough_behavior    = "WHEN_NO_TEMPLATES"
  request_templates = {
    "application/json" = file("${path.module}/${var.sme_ext_meta_api_gateway_request_template_json_schema}")
  }
}

# API Gateway deployment
resource "aws_api_gateway_deployment" "generate_ddex_api_deployment" {
  rest_api_id = aws_api_gateway_rest_api.generate_ddex_api.id

  triggers = {
    redeployment = sha1(jsonencode(aws_api_gateway_rest_api.generate_ddex_api.body))
  }

  lifecycle {
    create_before_destroy = true
  }
}

# API Gateway Stage
resource "aws_api_gateway_stage" "generate_ddex_api_gateway_stage" {
  stage_name = "sme-ext-meta-generate-ddex"
  rest_api_id = aws_api_gateway_rest_api.generate_ddex_api.id
  deployment_id = aws_api_gateway_deployment.generate_ddex_api_deployment.id

  tags = {
    environment  = var.environment
    service_name = var.service_name
    terraformed  = "true"
  }
}