# START - SYNC CONTRACT SAP DAILY SCHEDULE

# IAM role for the sync_contract_sap_daily_schedule to assume
resource "aws_iam_role" "sync_contract_sap_scheduler_execution_role" {
  name               = "${var.environment}-${var.service_name}-sync-contract-sap-scheduler-role"
  assume_role_policy = data.aws_iam_policy_document.assume_scheduler_role.json
}

# Policy document to allow Lambda invocation
data "aws_iam_policy_document" "invoke_sync_contract_sap_lambda_policy" {
  statement {
    effect  = "Allow"
    actions = ["lambda:InvokeFunction"]

    resources = [module.lambda_abacus_sync_contract_sap.lambda_arn]
  }
}

# Invoke Lambda role policy for the sync_contract_sap_scheduler_execution_role
resource "aws_iam_role_policy" "sync_contract_sap_scheduler_invoke_lambda_policy" {
  name   = "${var.environment}-${var.service_name}-sync-contract-sap-scheduler-role-policy"
  role   = aws_iam_role.sync_contract_sap_scheduler_execution_role.name
  policy = data.aws_iam_policy_document.invoke_sync_contract_sap_lambda_policy.json
}

# KMS key required by EventBridge Scheduler
resource "aws_kms_key" "sync_contract_sap_scheduler_kms_key" {
  description             = "${var.environment}-${var.service_name}-sync-contract-sap-scheduler-kms-key"
  enable_key_rotation     = true
  deletion_window_in_days = 30

  tags = {
    environment        = var.environment
    service_name       = var.service_name
    application_family = var.application_family
    terraformed        = true
  }
}

# Alias for the KMS key
resource "aws_kms_alias" "sync_contract_sap_scheduler_kms_alias" {
  name          = "alias/${var.environment}-${var.service_name}-sync-contract-sap-scheduler"
  target_key_id = aws_kms_key.sync_contract_sap_scheduler_kms_key.key_id
}

# Policy document for the KMS role policy
data "aws_iam_policy_document" "sync_contract_sap_kms_decryption_policy" {
  statement {
    actions = [
      "kms:Encrypt",
      "kms:Decrypt",
      "kms:DescribeKey",
    ]

    resources = [aws_kms_key.sync_contract_sap_scheduler_kms_key.arn]
  }
}

# KMS role policy for the sync_contract_sap_scheduler_execution_role
resource "aws_iam_role_policy" "sync_contract_sap_scheduler_kms_policy" {
  name   = "${var.environment}-${var.service_name}-sync-contract-sap-scheduler-kms-policy"
  role   = aws_iam_role.sync_contract_sap_scheduler_execution_role.name
  policy = data.aws_iam_policy_document.sync_contract_sap_kms_decryption_policy.json
}

# EventBridge Scheduler Schedule to trigger the Lambda function daily at
# 11pm Eastern. The empty input selects the lambda's batch mode; engineers
# can still trigger ad-hoc runs by invoking the lambda manually with {}.
resource "aws_scheduler_schedule" "sync_contract_sap_daily_schedule" {
  name        = "${var.environment}-${var.service_name}-sync-contract-sap-daily-schedule"
  group_name  = "${var.service_name}-schedule-group"
  state       = "ENABLED"
  kms_key_arn = aws_kms_key.sync_contract_sap_scheduler_kms_key.arn

  flexible_time_window {
    mode                      = "FLEXIBLE"
    maximum_window_in_minutes = 5
  }

  schedule_expression          = "cron(0 23 * * ? *)"
  schedule_expression_timezone = "America/New_York"

  target {
    arn      = module.lambda_abacus_sync_contract_sap.lambda_arn
    role_arn = aws_iam_role.sync_contract_sap_scheduler_execution_role.arn
    input    = jsonencode({})

    retry_policy {
      maximum_event_age_in_seconds = 300
      maximum_retry_attempts       = 1
    }
  }
}

# Allow the scheduler to invoke the Lambda function
resource "aws_lambda_permission" "allow_scheduler_invoke_sync_contract_sap" {
  statement_id  = "AllowSchedulerInvoke"
  action        = "lambda:InvokeFunction"
  function_name = module.lambda_abacus_sync_contract_sap.lambda_arn
  principal     = "scheduler.amazonaws.com"
  source_arn    = aws_scheduler_schedule.sync_contract_sap_daily_schedule.arn
}

# END - SYNC CONTRACT SAP DAILY SCHEDULE