provider "aws" {
  region = "us-east-1"
}

data "aws_caller_identity" "current" {}

data "aws_canonical_user_id" "current" {}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/lambda-abacus/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_iam_policy_document" "abacus_prod_sales_files_bucket_write_access_document" {
  statement {
    effect = "Allow"
    resources = [
      "${var.sales_files_bucket_arn}/*"
    ]
    actions = [
      "s3:GetObject",
      "s3:DeleteObject",
      "s3:PutObject"
    ]
  }

  statement {
    effect = "Allow"
    resources = [
      var.sales_files_bucket_arn
    ]
    actions = [
      "s3:ListBucket"
    ]
  }
}

resource "aws_iam_policy" "abacus_prod_sales_files_bucket_write_access_policy" {
  name        = "${var.environment}-abacus-sales-files-write-access-policy"
  description = "Policy for sales files bucket write permissions"
  policy      = data.aws_iam_policy_document.abacus_prod_sales_files_bucket_write_access_document.json
}

resource "aws_security_group" "lambda_abacus_custom_security_group" {
  name        = "${var.environment}-${var.service_name}-security-group"
  description = "Security group for ${var.environment} Abacus Lambda functions"
  vpc_id      = var.vpc_id

  tags = {
    environment        = var.environment
    service_name       = var.service_name
    application_family = var.application_family
    terraformed        = true
  }
}

resource "aws_security_group_rule" "allow_egress_for_lambda_custom_security_group" {
  type              = "egress"
  protocol          = "-1"
  cidr_blocks       = ["0.0.0.0/0"]
  from_port         = 0
  to_port           = 0
  security_group_id = aws_security_group.lambda_abacus_custom_security_group.id
}

data "aws_lambda_function" "av_scan_lambda" {
  function_name = "${var.environment}-${var.av_scan_lambda_function_name}"
}

data "aws_iam_policy" "splitio_api_key_ro" {
  name = var.splitio_api_key_ro_policy_name
}

# START - COMMIT ROYALTIES

module "lambda_abacus_commit_royalties_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.2"

  environment        = var.environment
  platform           = "python"
  service_name       = "${var.service_name}-commit-royalties"
  teams              = ["abacus-${var.environment}"]
  application_family = var.application_family
}

module "lambda_abacus_commit_royalties_owsrequest" {
  source           = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.0.1"
  environment_name = var.environment
  service_name     = "${var.service_name}-commit-royalties"
}

module "lambda_abacus_commit_royalties" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=3.1.4"

  environment                                       = var.environment
  lambda_function_timeout                           = 900
  use_container_image                               = true
  lambda_description                                = "Commit proceeds from royalties run"
  lambda_name                                       = "${var.service_name}-commit-royalties"
  vpc_subnet_ids                                    = var.vpc_subnet_ids
  vpc_id                                            = var.vpc_id
  application_family                                = var.application_family
  lambda_function_provisioned_concurrent_executions = var.lambda_provisioned_concurrent_executions

  lambda_function_reserved_concurrent_executions = 2
  lambda_function_memory_size                    = 1024

  datadog_enabled          = true
  datadog_advanced_enabled = true

  iam_managed_policy_attachments = [
    module.lambda_abacus_commit_royalties_owsrequest.policy_arn_output
  ]

  lambda_function_environment_variables = {
    ENVIRONMENT         = var.environment
    SNOWFLAKE_ACCOUNT   = var.lambda_snowflake_account
    SNOWFLAKE_DATABASE  = var.lambda_snowflake_database
    SNOWFLAKE_SCHEMA    = var.lambda_snowflake_schema
    SNOWFLAKE_WAREHOUSE = var.lambda_snowflake_warehouse
    SNOWFLAKE_ROLE      = var.lambda_snowflake_role
    SNOWFLAKE_USER      = var.lambda_snowflake_user
  }
}

module "lambda_abacus_commit_royalties_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.secrets_manager_secret_names)

  application_family = var.application_family
  environment        = var.environment
  service_name       = "${var.service_name}-commit-royalties"
  secret_name        = each.value
}

# END - COMMIT ROYALTIES


# START - PAYMENTS GENERATE

module "lambda_abacus_payments_generate_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.2"

  environment        = var.environment
  platform           = "python"
  service_name       = "${var.service_name}-payments-generate"
  teams              = ["abacus-${var.environment}"]
  application_family = var.application_family
}

module "lambda_abacus_payments_generate_owsrequest" {
  source           = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.0.1"
  environment_name = var.environment
  service_name     = "${var.service_name}-payments-generate"
}

module "lambda_abacus_payments_generate" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=3.1.4"

  environment                                       = var.environment
  lambda_function_timeout                           = 900
  use_container_image                               = true
  lambda_description                                = "Generates a set of payments for a group of payees"
  lambda_name                                       = "${var.service_name}-payments-generate"
  vpc_id                                            = var.vpc_id
  vpc_subnet_ids                                    = var.vpc_subnet_ids
  application_family                                = var.application_family
  lambda_function_provisioned_concurrent_executions = var.lambda_provisioned_concurrent_executions

  lambda_function_reserved_concurrent_executions = 2
  lambda_function_memory_size                    = 1024

  datadog_enabled          = true
  datadog_advanced_enabled = true

  lambda_function_environment_variables = {
    ENVIRONMENT = var.environment
  }

  iam_managed_policy_attachments = [
    module.lambda_abacus_payments_generate_owsrequest.policy_arn_output
  ]
}

# END - PAYMENTS GENERATE


# START - LEDGER ACCOUNTING RUN BALANCE

module "lambda_abacus_ledger_accounting_run_balance_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.2"

  environment        = var.environment
  platform           = "python"
  service_name       = "${var.service_name}-ledger-accounting-run-balance"
  teams              = ["abacus-${var.environment}"]
  application_family = var.application_family
}

module "lambda_abacus_ledger_accounting_run_balance_owsrequest" {
  source           = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.0.1"
  environment_name = var.environment
  service_name     = "${var.service_name}-ledger-accounting-run-balance"
}

module "lambda_abacus_ledger_accounting_run_balance" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=3.1.4"

  environment                                       = var.environment
  lambda_function_timeout                           = 900
  use_container_image                               = true
  lambda_description                                = "Write run summary from snowflake to ledger service"
  lambda_name                                       = "${var.service_name}-ledger-accounting-run-balance"
  vpc_id                                            = var.vpc_id
  vpc_subnet_ids                                    = var.vpc_subnet_ids
  application_family                                = var.application_family
  lambda_function_provisioned_concurrent_executions = var.lambda_provisioned_concurrent_executions

  lambda_function_reserved_concurrent_executions = 2
  lambda_function_memory_size                    = 1024

  datadog_enabled          = true
  datadog_advanced_enabled = true

  lambda_function_environment_variables = {
    ENVIRONMENT         = var.environment
    SNOWFLAKE_ACCOUNT   = var.lambda_snowflake_account
    SNOWFLAKE_DATABASE  = var.lambda_snowflake_database
    SNOWFLAKE_SCHEMA    = var.lambda_snowflake_schema
    SNOWFLAKE_WAREHOUSE = var.lambda_snowflake_warehouse
    SNOWFLAKE_ROLE      = var.lambda_snowflake_role
    SNOWFLAKE_USER      = var.lambda_snowflake_user
  }

  iam_managed_policy_attachments = [
    module.lambda_abacus_ledger_accounting_run_balance_owsrequest.policy_arn_output,
    aws_iam_policy.abacus_prod_sales_files_bucket_write_access_policy.arn
  ]
}

module "lambda_abacus_ledger_accounting_run_balance_secrets" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each  = toset(concat(var.secrets_manager_secret_names, var.accounting_run_balance_secrets_manager_secret_names))

  application_family = var.application_family
  environment        = var.environment
  service_name       = "${var.service_name}-ledger-accounting-run-balance"
  secret_name        = each.value
}

# END - LEDGER ACCOUNTING RUN BALANCE


# START - SYNC CONTRACT

module "lambda_abacus_sync_contract_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.2"

  environment        = var.environment
  platform           = "python"
  service_name       = "${var.service_name}-sync-contract"
  teams              = ["abacus-${var.environment}"]
  application_family = var.application_family
}

module "lambda_abacus_sync_contract_owsrequest" {
  source           = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.0.1"
  environment_name = var.environment
  service_name     = "${var.service_name}-sync-contract"
}

module "lambda_abacus_sync_contract" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=3.1.4"

  environment                                       = var.environment
  lambda_function_timeout                           = 900
  use_container_image                               = true
  lambda_description                                = "Synchronize contract information between ABACUS and legacy."
  lambda_name                                       = "${var.service_name}-sync-contract"
  vpc_id                                            = var.vpc_id
  vpc_subnet_ids                                    = var.vpc_subnet_ids
  application_family                                = var.application_family
  lambda_function_provisioned_concurrent_executions = var.lambda_provisioned_concurrent_executions

  lambda_function_reserved_concurrent_executions = 2
  lambda_function_memory_size                    = 1024

  datadog_enabled          = true
  datadog_advanced_enabled = true

  lambda_function_environment_variables = {
    ENVIRONMENT = var.environment
  }

  iam_managed_policy_attachments = [
    module.lambda_abacus_sync_contract_owsrequest.policy_arn_output
  ]
}

# END - SYNC CONTRACT

# START - PAYONEER PAYMENTS PAYOUT

module "lambda_abacus_payoneer_payments_payout_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.2"

  environment        = var.environment
  platform           = "python"
  service_name       = "${var.service_name}-payoneer-payments-payout"
  teams              = ["abacus-${var.environment}"]
  application_family = var.application_family
}

module "lambda_abacus_payoneer_payments_payout_owsrequest" {
  source           = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.0.1"
  environment_name = var.environment
  service_name     = "${var.service_name}-payoneer-payments-payout"
}

module "lambda_abacus_payoneer_payments_payout" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=3.1.4"

  environment                                       = var.environment
  lambda_function_timeout                           = 900
  use_container_image                               = true
  lambda_description                                = "Create the payments batches and send it to payoneer"
  lambda_name                                       = "${var.service_name}-payoneer-payments-payout"
  vpc_id                                            = var.vpc_id
  vpc_subnet_ids                                    = var.vpc_subnet_ids
  application_family                                = var.application_family
  lambda_function_provisioned_concurrent_executions = var.lambda_provisioned_concurrent_executions

  lambda_function_reserved_concurrent_executions = 2
  lambda_function_memory_size                    = 1024

  datadog_enabled          = true
  datadog_advanced_enabled = true

  lambda_function_environment_variables = {
    ENVIRONMENT = var.environment
  }

  iam_managed_policy_attachments = [
    module.lambda_abacus_payoneer_payments_payout_owsrequest.policy_arn_output
  ]
}

# END - PAYONEER PAYMENTS PAYOUT


# START - RESERVES TAKE

module "lambda_abacus_reserves_take_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.2"

  environment        = var.environment
  platform           = "python"
  service_name       = "lambda-abacus-reserves-take"
  teams              = ["abacus-${var.environment}"]
  application_family = var.application_family
}

module "lambda_abacus_reserves_take_owsrequest" {
  source           = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.0.1"
  environment_name = var.environment
  service_name     = "lambda-abacus-reserves-take"
}

module "lambda_abacus_reserves_take" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=3.1.4"

  environment                                       = var.environment
  lambda_function_timeout                           = 900
  use_container_image                               = true
  lambda_description                                = "Creates contract reserves entries on accounting run's commit."
  lambda_name                                       = "${var.service_name}-reserves-take"
  vpc_id                                            = var.vpc_id
  vpc_subnet_ids                                    = var.vpc_subnet_ids
  application_family                                = var.application_family
  lambda_function_provisioned_concurrent_executions = var.lambda_provisioned_concurrent_executions

  lambda_function_reserved_concurrent_executions = 2
  lambda_function_memory_size                    = 1024

  datadog_enabled          = true
  datadog_advanced_enabled = true

  lambda_function_environment_variables = {
    ENVIRONMENT         = var.environment
    SNOWFLAKE_ACCOUNT   = var.lambda_snowflake_account
    SNOWFLAKE_DATABASE  = var.lambda_snowflake_database
    SNOWFLAKE_SCHEMA    = var.lambda_snowflake_schema
    SNOWFLAKE_WAREHOUSE = var.lambda_snowflake_warehouse
    SNOWFLAKE_ROLE      = var.lambda_snowflake_role
    SNOWFLAKE_USER      = var.lambda_snowflake_user
  }

  iam_managed_policy_attachments = [
    module.lambda_abacus_reserves_take_owsrequest.policy_arn_output
  ]
}

module "lambda_abacus_reserves_take_secrets" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each  = toset(var.secrets_manager_secret_names)

  application_family = var.application_family
  environment        = var.environment
  service_name       = "${var.service_name}-reserves-take"
  secret_name        = each.value
}

# END - RESERVES TAKE


# START - RESERVES RELEASE

module "lambda_abacus_reserves_release_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.2"

  environment        = var.environment
  platform           = "python"
  service_name       = "${var.service_name}-reserves-release"
  teams              = ["abacus-${var.environment}"]
  application_family = var.application_family
}

module "lambda_abacus_reserves_release_owsrequest" {
  source           = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.0.1"
  environment_name = var.environment
  service_name     = "${var.service_name}-reserves-release"
}

module "lambda_abacus_reserves_release" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=3.1.4"

  environment                                       = var.environment
  lambda_function_timeout                           = 900
  use_container_image                               = true
  lambda_description                                = "Credits back reserve amount to an account's ledger"
  lambda_name                                       = "${var.service_name}-reserves-release"
  vpc_id                                            = var.vpc_id
  vpc_subnet_ids                                    = var.vpc_subnet_ids
  application_family                                = var.application_family
  lambda_function_provisioned_concurrent_executions = var.lambda_provisioned_concurrent_executions

  lambda_function_reserved_concurrent_executions = 16
  lambda_function_memory_size                    = 1024

  datadog_enabled          = true
  datadog_advanced_enabled = true

  lambda_function_environment_variables = {
    ENVIRONMENT = var.environment
  }

  iam_managed_policy_attachments = [
    module.lambda_abacus_reserves_release_owsrequest.policy_arn_output
  ]
}

# END - RESERVES RELEASE


# START - RESERVES SCHEDULE

module "lambda_abacus_reserves_schedule_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.2"

  environment        = var.environment
  platform           = "python"
  service_name       = "lambda-abacus-reserves-schedule"
  teams              = ["abacus-${var.environment}"]
  application_family = var.application_family
}

module "lambda_abacus_reserves_schedule_owsrequest" {
  source           = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.0.1"
  environment_name = var.environment
  service_name     = "lambda-abacus-reserves-schedule"
}

module "lambda_abacus_reserves_schedule" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=3.1.4"

  environment                                       = var.environment
  lambda_function_timeout                           = 900
  use_container_image                               = true
  lambda_description                                = "Divide the taken reserve value across the installment schedule."
  lambda_name                                       = "${var.service_name}-reserves-schedule"
  vpc_id                                            = var.vpc_id
  vpc_subnet_ids                                    = var.vpc_subnet_ids
  application_family                                = var.application_family
  lambda_function_provisioned_concurrent_executions = var.lambda_provisioned_concurrent_executions

  lambda_function_reserved_concurrent_executions = 2
  lambda_function_memory_size                    = 1024

  datadog_enabled          = true
  datadog_advanced_enabled = true

  lambda_function_environment_variables = {
    ENVIRONMENT = var.environment
  }

  iam_managed_policy_attachments = [
    module.lambda_abacus_reserves_schedule_owsrequest.policy_arn_output
  ]
}

# END - RESERVES SCHEDULE


# START - ADJUSTMENTS APPLY

locals {
  lambda_abacus_adjustments_apply_service_name = "${var.service_name}-adjustments-apply"
}

module "lambda_abacus_adjustments_apply_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.2"

  environment        = var.environment
  platform           = "python"
  service_name       = local.lambda_abacus_adjustments_apply_service_name
  teams              = ["abacus-${var.environment}"]
  application_family = var.application_family
}

module "lambda_abacus_adjustments_apply_owsrequest" {
  source           = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.0.1"
  environment_name = var.environment
  service_name     = local.lambda_abacus_adjustments_apply_service_name
}

module "lambda_abacus_adjustments_apply" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=3.1.4"

  environment                                       = var.environment
  lambda_function_timeout                           = 900
  use_container_image                               = true
  lambda_description                                = "Applies adjustments to the Calculation for the current Statement Period."
  lambda_name                                       = local.lambda_abacus_adjustments_apply_service_name
  vpc_id                                            = var.vpc_id
  vpc_subnet_ids                                    = var.vpc_subnet_ids
  application_family                                = var.application_family
  lambda_function_provisioned_concurrent_executions = var.lambda_provisioned_concurrent_executions

  lambda_function_reserved_concurrent_executions = 5
  lambda_function_memory_size                    = 1024

  datadog_enabled          = true
  datadog_advanced_enabled = true

  lambda_function_environment_variables = {
    ENVIRONMENT = var.environment
  }

  iam_managed_policy_attachments = [
    module.lambda_abacus_adjustments_apply_owsrequest.policy_arn_output
  ]
}

module "datadog_lambda_abacus_adjustments_apply" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.10.7"

  environment                         = var.environment
  service_name                        = local.lambda_abacus_adjustments_apply_service_name
  notification_endpoints              = "${var.notification_endpoints} ${var.escalation_notification_endpoints} ${var.on_call_endpoint}"
  escalation_notification_endpoints   = "${var.notification_endpoints} ${var.escalation_notification_endpoints} ${var.on_call_endpoint}"

  # Disable the module's error monitor — replaced by a log alert in
  # datadog_monitor.tf that filters out ReadTimeout errors.
  lambda_error_monitor_enabled = false

  lambda_error_critical_number          = 0.2
  lambda_error_critical_recovery_number = 0

  lambda_error_warning_number          = 0.1
  lambda_error_warning_recovery_number = 0
}

module "m2m_secrets_lambda_abacus_adjustments_apply" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//modules/auth0m2m?ref=1.6.1"

  environment                         = var.environment
  service_name                        = "${var.service_name}-adjustments-apply"
  application_family                  = var.application_family
}

# END - ADJUSTMENTS APPLY

# START - SYNC CONTRACT SAP

module "lambda_abacus_sync_contract_sap_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.2"

  environment        = var.environment
  platform           = "python"
  service_name       = "lambda-abacus-sync-contract-sap"
  teams              = ["abacus-${var.environment}"]
  application_family = var.application_family
}

module "lambda_abacus_sync_contract_sap_owsrequest" {
  source           = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.0.1"
  environment_name = var.environment
  service_name     = "lambda-abacus-sync-contract-sap"
}

module "lambda_abacus_sync_contract_sap" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=3.1.4"

  environment                                       = var.environment
  lambda_function_timeout                           = 900
  use_container_image                               = true
  lambda_description                                = "Sends new contract and account records to the SAP system."
  lambda_name                                       = "${var.service_name}-sync-contract-sap"
  vpc_id                                            = var.vpc_id
  vpc_subnet_ids                                    = var.vpc_subnet_ids
  application_family                                = var.application_family
  lambda_function_provisioned_concurrent_executions = var.lambda_provisioned_concurrent_executions

  lambda_function_reserved_concurrent_executions = 2
  lambda_function_memory_size                    = 1024

  datadog_enabled          = true
  datadog_advanced_enabled = true

  lambda_function_environment_variables = {
    ENVIRONMENT = var.environment
    SAP_ENV     = var.sap_env
    SAP_API     = var.sap_api

    MYSQL_DB_HOST = var.lambda_abacus_mysql_host
    MYSQL_DB_NAME = var.lambda_abacus_mysql_database
    MYSQL_DB_USER = var.lambda_abacus_mysql_user
  }

  iam_managed_policy_attachments = [
    module.lambda_abacus_sync_contract_sap_owsrequest.policy_arn_output
  ]
}

module "lambda_abacus_sync_contract_sap_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.sync_contract_sap_secrets_manager_secret_names)

  application_family = var.application_family
  environment        = var.environment
  service_name       = "${var.service_name}-sync-contract-sap"
  secret_name        = each.value
}

# END - SYNC CONTRACT SAP

# START - CORRECTION APPLY

module "lambda_abacus_correction_apply_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.2"

  environment        = var.environment
  platform           = "python"
  service_name       = "${var.service_name}-correction-apply"
  teams              = ["abacus-${var.environment}"]
  application_family = var.application_family
}

module "lambda_abacus_correction_apply_owsrequest" {
  source           = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.0.1"
  environment_name = var.environment
  service_name     = "${var.service_name}-correction-apply"
}

module "lambda_abacus_correction_apply" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=3.1.4"

  environment                                       = var.environment
  lambda_function_timeout                           = 900
  use_container_image                               = true
  lambda_description                                = "Create ledger entries for transaction corrections."
  lambda_name                                       = "${var.service_name}-correction-apply"
  vpc_id                                            = var.vpc_id
  vpc_subnet_ids                                    = var.vpc_subnet_ids
  application_family                                = var.application_family
  lambda_function_provisioned_concurrent_executions = var.lambda_provisioned_concurrent_executions

  lambda_function_reserved_concurrent_executions = 2
  lambda_function_memory_size                    = 1024

  datadog_enabled          = true
  datadog_advanced_enabled = true

  lambda_function_environment_variables = {
    ENVIRONMENT = var.environment
  }

  iam_managed_policy_attachments = [
    module.lambda_abacus_correction_apply_owsrequest.policy_arn_output
  ]
}

# END - CORRECTION APPLY

# START - AUTO ADD CONTRIBUTIONS

module "lambda_abacus_schedule_auto_add_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.2"

  environment        = var.environment
  platform           = "python"
  service_name       = "${var.service_name}-schedule-auto-add"
  teams              = ["abacus-${var.environment}"]
  application_family = var.application_family
}

module "lambda_abacus_schedule_auto_add" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=3.1.4"

  environment                                       = var.environment
  lambda_function_timeout                           = 900
  use_container_image                               = true
  lambda_description                                = "Add contributions to auto_add schedules."
  lambda_name                                       = "${var.service_name}-schedule-auto-add"
  vpc_id                                            = var.vpc_id
  vpc_subnet_ids                                    = var.vpc_subnet_ids
  application_family                                = var.application_family
  lambda_function_provisioned_concurrent_executions = var.lambda_provisioned_concurrent_executions

  lambda_function_reserved_concurrent_executions = 100
  lambda_function_memory_size                    = 1024

  lambda_function_environment_variables = {
    ENVIRONMENT         = var.environment
    GRAPHQL_GATEWAY_URL = var.graphql_url
  }

  msk_event_enabled                          = true
  event_source_mapping_msk_cluster_name      = var.trigger_msk_cluster_name
  event_source_mapping_msk_cluster_uuid      = var.trigger_msk_cluster_uuid
  event_source_mapping_batch_size            = 1
  msk_topics                                 = [var.contribution_metadata_topic]
  event_source_mapping_starting_position     = "LATEST"
  datadog_advanced_merge_xray_traces_enabled = false
}

module "lambda_abacus_schedule_auto_add_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.schedule_auto_add_secrets_manager_secret_names)

  application_family = var.application_family
  environment        = var.environment
  service_name       = "${var.service_name}-schedule-auto-add"
  secret_name        = each.value
}

# END - AUTO ADD CONTRIBUTIONS


# START - INVOKE POLICY
# Note the statement for lambda:InvokeFunction allows both unqualified and and qualified (:*) access
data "aws_iam_policy_document" "abacus_prod_lambdas_invoke" {
  statement {
    effect = "Allow"
    resources = [
      module.lambda_abacus_adjustment_file_import.lambda_arn,
      module.lambda_abacus_adjustment_file_validation.lambda_arn,
      module.lambda_abacus_adjustments_apply.lambda_arn,
      module.lambda_abacus_adjustments_json_import.lambda_arn,
      module.lambda_abacus_snapshot_contracts.lambda_arn,
      module.lambda_abacus_contract_lifecycle_automation.lambda_arn,
      module.lambda_abacus_schedule_auto_add.lambda_arn,
      module.lambda_abacus_sync_account.lambda_arn,
      module.lambda_abacus_commit_ledger_account_contract.lambda_arn,
      module.lambda_abacus_commit_royalties.lambda_arn,
      module.lambda_abacus_commit_mechanicals.lambda_arn,
      module.lambda_abacus_correction_apply.lambda_arn,
      module.lambda_abacus_correction_stage.lambda_arn,
      module.lambda_abacus_ledger_accounting_run_balance.lambda_arn,
      module.lambda_abacus_generate_flowthrough_adjustments.lambda_arn,
      module.lambda_abacus_payoneer_payments_payout.lambda_arn,
      module.lambda_abacus_payments_generate.lambda_arn,
      module.lambda_abacus_reserves_release.lambda_arn,
      module.lambda_abacus_reserves_schedule.lambda_arn,
      module.lambda_abacus_reserves_take.lambda_arn,
      module.lambda_abacus_royalty_collection_territory_backfill.lambda_arn,
      module.lambda_abacus_sync_contract.lambda_arn,
      module.lambda_abacus_sync_contract_sap.lambda_arn,
      module.lambda_abacus_adjustment_file_initialize.lambda_arn,
      module.lambda_abacus_outbox_process.lambda_arn,
      module.lambda_abacus_payment_allocation.lambda_arn,
      data.aws_lambda_function.av_scan_lambda.arn,
      "${module.lambda_abacus_adjustment_file_import.lambda_arn}:*",
      "${module.lambda_abacus_adjustment_file_validation.lambda_arn}:*",
      "${module.lambda_abacus_adjustments_json_import.lambda_arn}:*",
      "${module.lambda_abacus_generate_flowthrough_adjustments.lambda_arn}:*",
      "${module.lambda_abacus_adjustments_apply.lambda_arn}:*",
      "${module.lambda_abacus_snapshot_contracts.lambda_arn}:*",
      "${module.lambda_abacus_contract_lifecycle_automation.lambda_arn}:*",
      "${module.lambda_abacus_schedule_auto_add.lambda_arn}:*",
      "${module.lambda_abacus_sync_account.lambda_arn}:*",
      "${module.lambda_abacus_commit_ledger_account_contract.lambda_arn}:*",
      "${module.lambda_abacus_commit_royalties.lambda_arn}:*",
      "${module.lambda_abacus_commit_mechanicals.lambda_arn}:*",
      "${module.lambda_abacus_correction_apply.lambda_arn}:*",
      "${module.lambda_abacus_correction_stage.lambda_arn}:*",
      "${module.lambda_abacus_ledger_accounting_run_balance.lambda_arn}:*",
      "${module.lambda_abacus_payoneer_payments_payout.lambda_arn}:*",
      "${module.lambda_abacus_payments_generate.lambda_arn}:*",
      "${module.lambda_abacus_reserves_release.lambda_arn}:*",
      "${module.lambda_abacus_reserves_schedule.lambda_arn}:*",
      "${module.lambda_abacus_reserves_take.lambda_arn}:*",
      "${module.lambda_abacus_royalty_collection_territory_backfill.lambda_arn}:*",
      "${module.lambda_abacus_sync_contract.lambda_arn}:*",
      "${module.lambda_abacus_sync_contract_sap.lambda_arn}:*",
      "${module.lambda_abacus_adjustment_file_initialize.lambda_arn}:*",
      "${module.lambda_abacus_outbox_process.lambda_arn}:*",
      "${module.lambda_abacus_payment_allocation.lambda_arn}:*",
      "${data.aws_lambda_function.av_scan_lambda.arn}:*",
    ]
    actions = [
      "lambda:InvokeFunction"
    ]
  }
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:s3:::${var.environment}-lambda-abacus-ci-cd",
      "arn:aws:s3:::${var.environment}-lambda-abacus-ci-cd/*"
    ]
    actions = [
      "s3:AbortMultipartUpload",
      "s3:DeleteObject",
      "s3:DeleteObjectVersion",
      "s3:GetBucketLocation",
      "s3:GetBucketVersioning",
      "s3:GetLifecycleConfiguration",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:GetObjectTorrent",
      "s3:GetObjectVersion",
      "s3:CopyObject",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionTorrent",
      "s3:GetReplicationConfiguration",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:ListBucketVersions",
      "s3:ListMultipartUploadParts",
      "s3:PutObject",
      "s3:PutObjectAcl",
      "s3:PutObjectVersionAcl",
      "s3:ReplicateDelete",
      "s3:ReplicateObject",
      "s3:RestoreObject",
      "s3:ListAllMyBuckets"
    ]
  }
}

resource "aws_iam_policy" "abacus_prod_lambdas_invoke_policy" {
  name        = "${var.environment}-lambda-abacus-generic-invoke-policy"
  description = "Policy for invoking abacus lambdas"
  policy      = data.aws_iam_policy_document.abacus_prod_lambdas_invoke.json
}

# END - INVOKE POLICY

# START - CI/CD RESOURCES

module "ci_cd_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.11.0"

  env                = var.environment
  bucket_name        = "lambda-abacus-ci-cd"
  application_family = var.application_family

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }
}

# END - CI/CD RESOURCES