locals {
  audio_validation_lambda_name = "${var.lambda_service_name}-audio-validation"
}

data "aws_iam_policy_document" "audio_validation_s3_read" {
  statement {
    effect    = "Allow"
    actions   = ["s3:GetObject"]
    resources = ["arn:aws:s3:::${var.environment}-${var.raw_assets_s3_bucket_suffix}/*"]
  }
}

resource "aws_iam_policy" "audio_validation_s3_read" {
  name   = "S3-${var.environment}-${local.audio_validation_lambda_name}-RO"
  policy = data.aws_iam_policy_document.audio_validation_s3_read.json
}

module "lambda_assets_audio_validation_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git//?ref=4.1.2"

  environment                  = var.environment
  platform                     = "python"
  service_name                 = "${local.audio_validation_lambda_name}-v2" # v2 to differentiate from old sentry project
  teams                        = [var.environment]
  application_family           = var.application_family
  secrets_manager_service_name = local.audio_validation_lambda_name
}

module "lambda_assets_audio_validation_owsrequest" {
  source = "git@github.com:theorchard/terraform-owsrequest.git?ref=1.0.1"

  environment_name = var.environment
  service_name     = local.audio_validation_lambda_name
}

module "lambda_assets_audio_validation" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=3.1.9"

  environment             = var.environment
  lambda_function_timeout = 900
  use_container_image     = true
  lambda_description      = "Validate audio."
  lambda_name             = local.audio_validation_lambda_name
  vpc_id                  = var.vpc_id
  vpc_subnet_ids          = var.vpc_subnet_ids
  application_family      = var.application_family

  lambda_function_reserved_concurrent_executions = local.max_concurrency
  lambda_function_memory_size                    = 1024

  lambda_function_environment_variables = {
    ENVIRONMENT                  = var.environment
    SENTRY_DSN                   = module.lambda_assets_audio_validation_sentry_project.sentry_key_dsn_public_output
    DD_API_KEY_SECRET_ARN        = data.aws_secretsmanager_secret.datadog_api.arn
    EXPECTED_BUCKET_OWNER        = data.aws_caller_identity.current.account_id
    MIN_DURATION_MS              = 2000
  }

  iam_managed_policy_attachments = [
    module.lambda_assets_audio_validation_owsrequest.policy_arn_output,
    aws_iam_policy.audio_validation_s3_read.arn,
  ]

}

module "datadog_lambda_assets_audio_validation" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.13.7"

  environment                       = var.environment
  service_name                      = local.audio_validation_lambda_name
  lambda_invocation_monitor_enabled = false
  lambda_error_monitor_enabled      = true
  notification_endpoints            = var.notification_endpoints
}

module "m2m_secrets" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//modules/auth0m2m?ref=1.6.1"

  environment        = var.environment
  service_name       = local.audio_validation_lambda_name
  application_family = var.application_family
}