provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/github/python-pdp-sdk/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "github_repositories" {
  source = "git@github.com:theorchard/terraform-github.git//?ref=2.1.8"
  github_repository_names = {

    python-pdp-sdk = {
      branch_protection_enabled        = true
      branch_protection_enforce_admins = false
      repo_auto_init                   = true
      archived_repository              = false
      github_code_owner_reviews        = false
      visibility                       = "private"
      description                      = "Policy decision point (PDP) sdk client for Python"
      has_downloads                    = false
      homepage_url                     = "https://github.com/theorchard/python-pdp-sdk"
    }
  }
}

provider "github" {
  token = var.github_token != "" ? var.github_token : null
  owner = var.github_organization
}

data "github_repository" "python_pdp_sdk" {
  full_name = "theorchard/python-pdp-sdk"
}

resource "github_actions_repository_access_level" "github_actions_access" {
  access_level = "none"
  repository   = data.github_repository.python_pdp_sdk.name
}

module "deploy_key_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.1.0"
  for_each = toset(var.secrets_manager_secret_names)

  environment                    = var.environment
  service_name                   = var.service_name
  secret_name                    = each.value
  application_family             = var.application_family
  secret_recovery_window_in_days = 30
}

data "aws_secretsmanager_secret" "python_pdp_sdk_deploy_key" {
  name = "prod/python-pdp-sdk/DEPLOY_KEY_PRIVATE"
}

data "aws_secretsmanager_secret_version" "python_pdp_sdk_deploy_key" {
  secret_id = data.aws_secretsmanager_secret.python_pdp_sdk_deploy_key.id
}

resource "github_actions_secret" "python_pdp_sdk_deploy_key" {
  repository      = data.github_repository.python_pdp_sdk.name
  secret_name     = "DEPLOY_KEY_PYTHON_PDP_SDK"
  plaintext_value = data.aws_secretsmanager_secret_version.python_pdp_sdk_deploy_key.secret_string
}