locals {
  outbox_process_lambda_name                     = "${var.service_name}-outbox-process"
  outbox_process_lambda_datadog_monitor_critical = 108000
  outbox_process_lambda_datadog_monitor_warning  = 96000
}

# Sentry Project for Error Tracking
module "lambda_abacus_outbox_process_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git//?ref=4.1.2"

  environment                  = var.environment
  platform                     = "python"
  service_name                 = local.outbox_process_lambda_name
  teams                        = ["abacus-${var.environment}"]
  application_family           = var.application_family
  secrets_manager_service_name = local.outbox_process_lambda_name
}

# OWSRequest Module for API Access
module "lambda_abacus_outbox_process_owsrequest" {
  source           = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.1.0"
  environment_name = var.environment
  service_name     = local.outbox_process_lambda_name
}

# Lambda Function with Kafka/MSK CDC Trigger (Primary Path)
module "lambda_abacus_outbox_process" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=5.2.1"

  environment               = var.environment
  lambda_function_timeout   = 120 # 2 minutes
  use_container_image       = true
  lambda_description        = "Process abacus_outbox events via CDC"
  lambda_name               = local.outbox_process_lambda_name
  vpc_id                    = var.vpc_id
  vpc_subnet_ids            = var.vpc_subnet_ids
  vpc_create_security_group = true
  application_family        = var.application_family

  lambda_function_reserved_concurrent_executions = 2
  lambda_function_memory_size                    = 1024

  datadog_enabled          = true
  datadog_advanced_enabled = true

  lambda_function_environment_variables = {
    ENVIRONMENT   = var.environment
    MYSQL_DB_NAME = var.lambda_abacus_mysql_database
    MYSQL_DB_HOST = var.lambda_abacus_mysql_host
    MYSQL_DB_USER = var.lambda_abacus_mysql_user
  }

  iam_managed_policy_attachments = [
    module.lambda_abacus_outbox_process_owsrequest.policy_arn_output
  ]

  msk_event_enabled                          = true
  event_source_mapping_msk_cluster_name      = var.trigger_msk_cluster_name
  event_source_mapping_msk_cluster_uuid      = var.trigger_msk_cluster_uuid
  event_source_mapping_batch_size            = 10
  kafka_topics                                 = ["cdc.royaltyAccounting.abacusOutbox"]
  event_source_mapping_starting_position     = "LATEST"

  # Fix datadog logging until ddtrace version can be upgraded
  datadog_advanced_merge_xray_traces_enabled = false
  datadog_advanced_trace_enabled             = true
}

##################################
## EventBridge Schedule Trigger ##
##################################

# IAM policy for EventBridge PutEvents permission
resource "aws_iam_role_policy" "outbox_process_eventbridge" {
  name = "${var.environment}-${local.outbox_process_lambda_name}-eventbridge"
  role = module.lambda_abacus_outbox_process.lambda_role_id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "events:PutEvents"
        ]
        Resource = [
          "arn:aws:events:${var.aws_region}:${data.aws_caller_identity.current.account_id}:event-bus/default"
        ]
      }
    ]
  })
}

# EventBridge rule to trigger outbox processor on a schedule
resource "aws_cloudwatch_event_rule" "outbox_process_schedule" {
  name                = "${var.environment}-${local.outbox_process_lambda_name}-schedule"
  description         = "Trigger outbox processor every minute for scheduled polling (safety net for CDC)"
  schedule_expression = var.outbox_process_schedule_expression

  tags = {
    application_family = var.application_family
    environment        = var.environment
    service_name       = var.service_name
    teams              = "abacus-${var.environment}"
    terraformed        = true
  }
}

# EventBridge target to invoke Lambda
resource "aws_cloudwatch_event_target" "outbox_process_target" {
  rule      = aws_cloudwatch_event_rule.outbox_process_schedule.name
  target_id = "OutboxProcessorLambda"
  arn       = module.lambda_abacus_outbox_process.lambda_arn
  input     = "{}"
}

# Permission for EventBridge to invoke Lambda
resource "aws_lambda_permission" "allow_eventbridge_outbox_process" {
  statement_id  = "AllowExecutionFromEventBridge"
  action        = "lambda:InvokeFunction"
  function_name = module.lambda_abacus_outbox_process.lambda_name
  principal     = "events.amazonaws.com"
  source_arn    = aws_cloudwatch_event_rule.outbox_process_schedule.arn
}

########################
## Secrets Management ##
########################

module "lambda_abacus_outbox_process_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.outbox_process_secrets_manager_secret_names)

  application_family = var.application_family
  environment        = var.environment
  service_name       = local.outbox_process_lambda_name
  secret_name        = each.value
}

################################
## Monitoring & Observability ##
################################

# Datadog Lambda Monitor for Errors and Invocations
module "lambda_abacus_outbox_process_datadog_monitor" {
  source                                = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.16.0"
  service_name                          = local.outbox_process_lambda_name
  environment                           = var.environment
  lambda_invocation_monitor_enabled     = false
  lambda_error_monitor_enabled          = true
  lambda_error_critical_number          = 1
  lambda_error_ok_number                = 0
  lambda_error_warning_recovery_number  = null
  lambda_error_critical_recovery_number = null
  lambda_error_warning_number           = null
  notification_endpoints                = var.notification_endpoints
}

# Custom Datadog Monitor for Lambda Duration
resource "datadog_monitor" "lambda_abacus_outbox_process_duration_datadog_monitor" {
  name    = "${var.environment}-${local.outbox_process_lambda_name}-duration-monitor"
  type    = "query alert"
  message = "Monitor triggered. Notify: ${var.notification_endpoints}"

  query = "max(last_15m):max:aws.lambda.duration{environment:${var.environment}, service_name:${local.outbox_process_lambda_name}} >= ${local.outbox_process_lambda_datadog_monitor_critical}"

  monitor_thresholds {
    critical = local.outbox_process_lambda_datadog_monitor_critical
    warning  = local.outbox_process_lambda_datadog_monitor_warning
  }

  evaluation_delay     = 900
  include_tags         = true
  notify_no_data       = false
  notify_audit         = false
  renotify_interval    = 0
  renotify_occurrences = 0
  require_full_window  = false
  timeout_h            = 0

  tags = [
    "environment:${var.environment}",
    "service_name:${local.outbox_process_lambda_name}",
    "application_family:${var.application_family}",
    "team:abacus-${var.environment}",
  ]
}