#####################################################
## IAM Roles and Policies for File Upload Workflow ##
#####################################################

########################
## Step Functions IAM ##
########################

# IAM role for Step Functions state machine
resource "aws_iam_role" "abacus_file_upload_workflow_role" {
  name = "${var.environment}-abacus-file-upload-workflow-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "states.amazonaws.com"
        }
        Action = "sts:AssumeRole"
      }
    ]
  })

  tags = {
    application_family = var.application_family
    environment        = var.environment
    service_name       = var.service_name
    terraformed        = true
  }
}

# IAM policy for Step Functions to invoke lambdas
resource "aws_iam_role_policy" "abacus_file_upload_workflow_policy" {
  name = "${var.environment}-abacus-file-upload-workflow-policy"
  role = aws_iam_role.abacus_file_upload_workflow_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "lambda:InvokeFunction"
        ]
        Resource = [
          data.aws_lambda_function.file_upload_initialize.arn,
          "${data.aws_lambda_function.file_upload_initialize.arn}:*",
          data.aws_lambda_function.av_scan.arn,
          "${data.aws_lambda_function.av_scan.arn}:*",
          data.aws_lambda_function.file_upload_complete.arn,
          "${data.aws_lambda_function.file_upload_complete.arn}:*"
        ]
      },
      {
        Effect = "Allow"
        Action = [
          "logs:CreateLogDelivery",
          "logs:GetLogDelivery",
          "logs:UpdateLogDelivery",
          "logs:DeleteLogDelivery",
          "logs:ListLogDeliveries",
          "logs:PutResourcePolicy",
          "logs:DescribeResourcePolicies",
          "logs:DescribeLogGroups"
        ]
        Resource = "*"
      },
      {
        Effect = "Allow"
        Action = [
          "xray:PutTraceSegments",
          "xray:PutTelemetryRecords"
        ]
        Resource = "*"
      }
    ]
  })
}

########################
## Lambda Permissions ##
########################

# Allow Step Functions to invoke AV Scan Lambda
resource "aws_lambda_permission" "abacus_allow_sfn_invoke_av_scan" {
  statement_id  = "AllowExecutionFromStepFunctions"
  action        = "lambda:InvokeFunction"
  function_name = data.aws_lambda_function.av_scan.function_name
  principal     = "states.amazonaws.com"
  source_arn    = aws_sfn_state_machine.abacus_file_upload_workflow.arn
}

# Allow Step Functions to invoke File Upload Complete Lambda
resource "aws_lambda_permission" "abacus_allow_sfn_invoke_file_upload_complete" {
  statement_id  = "AllowExecutionFromStepFunctions"
  action        = "lambda:InvokeFunction"
  function_name = data.aws_lambda_function.file_upload_complete.function_name
  principal     = "states.amazonaws.com"
  source_arn    = aws_sfn_state_machine.abacus_file_upload_workflow.arn
}

######################
## EventBridge IAM  ##
######################

# IAM role for EventBridge to invoke Step Functions
resource "aws_iam_role" "abacus_eventbridge_sfn_role" {
  name        = "${var.environment}-abacus-eventbridge-sfn-role"
  description = "Allows EventBridge to invoke Step Functions workflow for file uploads"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "events.amazonaws.com"
        }
        Action = "sts:AssumeRole"
      }
    ]
  })

  tags = {
    application_family = var.application_family
    environment        = var.environment
    service_name       = var.service_name
    terraformed        = true
  }
}

resource "aws_iam_role_policy" "abacus_eventbridge_sfn_policy" {
  name = "${var.environment}-abacus-eventbridge-sfn-policy"
  role = aws_iam_role.abacus_eventbridge_sfn_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "states:StartExecution"
        ]
        Resource = [
          aws_sfn_state_machine.abacus_file_upload_workflow.arn,
          aws_sfn_state_machine.adjustment_file_ingest_workflow.arn,
        ]
      }
    ]
  })
}