locals {
  backfill_lambda_name = "${var.service_name}-royalty-collection-territory-backfill"
  backfill_lambda_max_duration = 900000
}

module "lambda_abacus_royalty_collection_territory_backfill_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.2"

  environment        = var.environment
  platform           = "python"
  service_name       = "${var.service_name}-royalty-col-territory-backfill"
  teams               = ["abacus-${var.environment}"]
  application_family = var.application_family
  secrets_manager_service_name = local.backfill_lambda_name
}

module "lambda_abacus_royalty_collection_territory_backfill" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=4.2.0"

  environment                                       = var.environment
  lambda_function_timeout                           = 900
  use_container_image                               = true
  lambda_description                                = "Backfill the royalty_collection_territory column of art_relations.vendor_contract table."
  lambda_name                                       = local.backfill_lambda_name
  vpc_id                                            = var.vpc_id
  vpc_subnet_ids                                    = var.vpc_subnet_ids
  application_family                                = var.application_family
  lambda_function_provisioned_concurrent_executions = var.lambda_provisioned_concurrent_executions

  lambda_function_reserved_concurrent_executions   = 2
  lambda_function_memory_size                      = 10240

  datadog_enabled          = true
  datadog_advanced_enabled = true

  lambda_function_environment_variables = {
    ENVIRONMENT            = var.environment

    ART_RELATIONS_MYSQL_DB_NAME                 = var.lambda_abacus_ar_mysql_database
    ART_RELATIONS_MYSQL_DB_HOST                 = var.lambda_abacus_ar_mysql_host
    ART_RELATIONS_MYSQL_DB_USER                 = var.lambda_abacus_ar_mysql_user

    ROYALTY_ACCOUNTING_MYSQL_DB_NAME            = var.lambda_abacus_mysql_database
    ROYALTY_ACCOUNTING_MYSQL_DB_HOST            = var.lambda_abacus_mysql_host
    ROYALTY_ACCOUNTING_MYSQL_DB_USER            = var.lambda_abacus_mysql_user
  }
}

module "lambda_abacus_royalty_collection_territory_backfill_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.territory_backfill_secrets_manager_secret_names)

  application_family = var.application_family
  environment        = var.environment
  service_name       = "${var.service_name}-royalty-collection-territory-backfill"
  secret_name        = each.value
}

module "lambda_abacus_royalty_collection_territory_datadog_monitor" {
  source                                = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.13.7"
  service_name                          = local.backfill_lambda_name
  environment                           = var.environment
  lambda_invocation_monitor_enabled     = false
  lambda_error_monitor_enabled          = true
  lambda_error_critical_number          = 1
  lambda_error_ok_number                = 0
  lambda_error_warning_recovery_number  = null
  lambda_error_critical_recovery_number = null
  lambda_error_warning_number           = null
  notification_endpoints                = var.notification_endpoints
}

resource "datadog_monitor" "lambda_abacus_royalty_collection_territory_duration_datadog_monitor" {
  name = "${var.environment}-${local.backfill_lambda_name}-duration-monitor"
  type = "query alert"
  message = "Monitor triggered. Notify: ${var.notification_endpoints}"

  query = "max(last_15m):max:aws.lambda.duration{environment:${var.environment}, service_name:${local.backfill_lambda_name}} >= ${local.backfill_lambda_max_duration}"

  monitor_thresholds {
    critical = local.backfill_lambda_max_duration
  }

  evaluation_delay = 900
  include_tags = true
  notify_no_data = false
  notify_audit = false
  renotify_interval = 0
  renotify_occurrences = 0
  require_full_window = false
  timeout_h = 0


  tags = [
    "environment:${var.environment}",
    "service_name:${local.backfill_lambda_name}",
    "application_family:${var.application_family}",
    "team:abacus-${var.environment}",
  ]
}

resource "aws_iam_role" "royalty_collection_territory_backfill_scheduler_execution_role" {
  name               = "${var.environment}-${var.service_name}-royalty-backfill-scheduler-role"
  assume_role_policy = data.aws_iam_policy_document.assume_scheduler_role.json
}

# The targeted lambda function that the scheduler will invoke
data "aws_lambda_function" "royalty_collection_territory_backfill_lambda" {
  function_name = "${var.environment}-${local.backfill_lambda_name}"
}

# Policy document to allow Lambda invocation
data "aws_iam_policy_document" "invoke_territory_backfill_lambda_policy" {
  statement {
    effect = "Allow"
    actions = ["lambda:InvokeFunction"]

    resources = [
        data.aws_lambda_function.royalty_collection_territory_backfill_lambda.arn]

  }
}

# Invoke Lambda role policy for the royalty_collection_territory_backfill_scheduler_execution_role
resource "aws_iam_role_policy" "territory_backfill_scheduler_invoke_lambda_policy" {
  name   = "${var.environment}-${local.backfill_lambda_name}-scheduler-role-policy"
  role   = aws_iam_role.royalty_collection_territory_backfill_scheduler_execution_role.name
  policy = data.aws_iam_policy_document.invoke_territory_backfill_lambda_policy.json
}

resource "aws_kms_alias" "royalty_collection_territory_backfill_scheduler_kms_alias" {
  name          = "alias/${var.environment}/${var.service_name}/royalty-backfill-scheduler"
  target_key_id = aws_kms_key.royalty_collection_territory_backfill_scheduler_kms_key.key_id
}

resource "aws_kms_key" "royalty_collection_territory_backfill_scheduler_kms_key" {
  description             = "${var.environment}-${var.service_name}-royalty-collection-territory-backfill-scheduler-kms-key"
  enable_key_rotation     = true
  deletion_window_in_days = 30
  tags = {
    environment      = var.environment
    service_name     = var.service_name
    application_family = var.application_family
    terraformed      = true
  }
}

data "aws_iam_policy_document" "kms_decryption_policy_royalty_backfill" {
  statement {
    effect    = "Allow"
    actions   = ["kms:Decrypt", "kms:GenerateDataKey"]
    resources = [aws_kms_key.royalty_collection_territory_backfill_scheduler_kms_key.arn]
  }
}

resource "aws_iam_role_policy" "royalty_collection_territory_backfill_scheduler_kms_policy" {
  name   = "${var.service_name}-scheduler-kms-policy"
  role   = aws_iam_role.royalty_collection_territory_backfill_scheduler_execution_role.id
  policy = data.aws_iam_policy_document.kms_decryption_policy_royalty_backfill.json
}

resource "aws_scheduler_schedule_group" "royalty_collection_territory_backfill_schedule_group" {
  name = "${var.environment}-${var.service_name}-royalty-backfill-schedule-group"
}

resource "aws_scheduler_schedule" "royalty_collection_territory_backfill_schedule_daily" {
  description              = "Monthly royalty collection territory backfill for mid-month processing"
  name                     = "${var.environment}-${var.service_name}-royalty-collection-territory-schedule-daily"
  group_name               = aws_scheduler_schedule_group.royalty_collection_territory_backfill_schedule_group.name
  state                    = "ENABLED"
  kms_key_arn              = aws_kms_key.royalty_collection_territory_backfill_scheduler_kms_key.arn
  schedule_expression          = "cron(0 0 * * ? *)"
  schedule_expression_timezone = "UTC"
  flexible_time_window {
    mode                      = "FLEXIBLE"
    maximum_window_in_minutes = 5
  }
  target {
    arn      = module.lambda_abacus_royalty_collection_territory_backfill.lambda_arn
    role_arn = aws_iam_role.royalty_collection_territory_backfill_scheduler_execution_role.arn
    retry_policy {
      maximum_event_age_in_seconds = 300
      maximum_retry_attempts       = 1
    }
  }
}

resource "aws_lambda_permission" "allow_scheduler_invoke_royalty_backfill" {

  statement_id  = "AllowSchedulerInvoke-daily"
  action        = "lambda:InvokeFunction"
  function_name = module.lambda_abacus_royalty_collection_territory_backfill.lambda_arn
  principal     = "scheduler.amazonaws.com"
  source_arn    = aws_scheduler_schedule.royalty_collection_territory_backfill_schedule_daily.arn
}