locals {
  hive_ai_detection_lambda_name    = "${var.lambda_service_name}-hive-ai-detection"
  hive_ai_detection_lambda_timeout = 300
}

module "lambda_hive_ai_detection" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=4.3.0"

  environment         = var.environment
  application_family  = var.application_family
  use_container_image = true
  lambda_name         = local.hive_ai_detection_lambda_name
  lambda_description  = "Calls Hive to perform AI detection"

  lambda_function_environment_variables = {
    Environment = var.environment
    SENTRY_DSN  = module.sentry_lambda_hive_ai_detection.sentry_key_dsn_public_output
  }

  msk_event_enabled                     = true
  event_source_mapping_msk_cluster_name = var.cdc_msk_cluster_name
  event_source_mapping_msk_cluster_uuid = var.cdc_msk_cluster_uuid
  event_source_mapping_batch_size       = 5
  event_source_mapping_batch_window     = 60

  kafka_topics = [
    var.msk_asset_flac_topic_name
  ]
  event_source_mapping_starting_position = "LATEST"

  lambda_function_timeout                        = local.hive_ai_detection_lambda_timeout
  vpc_enabled                                    = true
  vpc_id                                         = data.aws_vpc.main.id
  vpc_subnet_ids                                 = var.vpc_subnet_ids
  lambda_function_reserved_concurrent_executions = 25
  datadog_advanced_enabled                       = true
  datadog_enabled                                = true

  iam_managed_policy_attachments = [
    module.hive_ai_detection_backfill_queue.sqs_minimal_policy_arn_output,
  ]
}

# Bulk/historical scans (CDAM-4070) enqueue one asset per message:
# {"ASSET_FINAL_ID": <int>, "DURATION_MS": <int>}. New assets keep arriving
# via the MSK trigger above; this queue is only filled by manual backfills.
module "hive_ai_detection_backfill_queue" {
  source = "git@github.com:theorchard/terraform-sqs.git//?ref=2.5.0"

  environment        = var.environment
  queue_name         = "hive-ai-detection-backfill"
  application_family = var.application_family

  # 14-day max: a full-catalog backfill (~1M messages) takes days to
  # drain; the 4-day default leaves no margin
  sqs_message_retention_seconds = 1209600
  # AWS-recommended minimum (6x function timeout) so throttled deliveries can
  # retry within one visibility window —
  # https://docs.aws.amazon.com/lambda/latest/dg/services-sqs-configure.html
  sqs_visibility_timeout_seconds = local.hive_ai_detection_lambda_timeout * 6

  sqs_deadletter_enabled = true

  # Hive 5xx errors are mostly transient; what survives 5 receives lands in
  # the deadletter queue as the failed-asset ledger
  deadletter_max_receive_count         = 5
  deadletter_max_message_size          = 2048
  deadletter_message_retention_seconds = 1209600
}

resource "aws_lambda_event_source_mapping" "hive_ai_detection_backfill" {
  event_source_arn = module.hive_ai_detection_backfill_queue.queue_arn
  function_name    = module.lambda_hive_ai_detection.lambda_arn
  # one asset per invocation: a failure only redelivers its own message
  batch_size = 1

  scaling_config {
    # leave reserved-concurrency headroom for the MSK auto-scan flow
    maximum_concurrency = 20
  }
}

module "sentry_lambda_hive_ai_detection" {
  source = "git@github.com:theorchard/terraform-sentry.git//?ref=5.0.0"

  environment        = var.environment
  service_name       = local.hive_ai_detection_lambda_name
  application_family = var.application_family
}

module "datadog_lambda_hive_ai_detection" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.14.2"

  environment                       = var.environment
  service_name                      = local.hive_ai_detection_lambda_name
  lambda_invocation_monitor_enabled = false
  lambda_error_monitor_enabled      = false
  notification_endpoints            = var.notification_endpoints
}

module "hive_ai_detection_m2m_secret" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//modules/auth0m2m?ref=1.6.1"

  environment        = var.environment
  service_name       = local.hive_ai_detection_lambda_name
  application_family = var.application_family
}

module "hive_ai_detection_credentials" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"

  secret_name        = "hive_credentials"
  environment        = var.environment
  service_name       = local.hive_ai_detection_lambda_name
  application_family = var.application_family
}