data "aws_iam_policy_document" "s3_mezzanine_dir_readonly_policy" {
  statement {
    effect = "Allow"

    actions = [
      "s3:GetLifecycleConfiguration",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:GetObjectTorrent",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionTorrent",
      "s3:GetReplicationConfiguration",
      "s3:HeadObject",
    ]

    resources = [
      "${module.s3_video_bucket.s3_bucket_arn_output}/mezzanine/*",
    ]
  }
}

data "aws_iam_policy_document" "s3_thumbnails_dir_readonly_policy" {
  statement {
    effect = "Allow"

    actions = [
      "s3:GetLifecycleConfiguration",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:GetObjectTorrent",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionTorrent",
      "s3:GetReplicationConfiguration",
    ]

    resources = [
      "${module.s3_video_bucket.s3_bucket_arn_output}/thumbnails/*",
    ]
  }
}

data "aws_iam_policy_document" "s3_raw_dir_readonly_policy" {
  statement {
    effect = "Allow"

    actions = [
      "s3:GetBucketAcl",
      "s3:GetBucketCORS",
      "s3:GetBucketLocation",
      "s3:GetBucketLogging",
      "s3:GetBucketNotification",
      "s3:GetBucketPolicy",
      "s3:GetBucketRequestPayment",
      "s3:GetBucketTagging",
      "s3:GetBucketVersioning",
      "s3:GetBucketWebsite",
      "s3:GetLifecycleConfiguration",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:GetObjectTorrent",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionTorrent",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:ListBucketVersions",
      "s3:ListMultipartUploadParts",
    ]

    resources = [
      "${module.s3_video_bucket.s3_bucket_arn_output}/raw/*",
    ]
  }
}

data "aws_iam_role" "ows_video_task_role" {
  name = "${var.environment}-${var.service_name}-task-role"
}

data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    effect = "Allow"

    actions = [
      "sts:AssumeRole",
    ]

    principals {
      type = "AWS"
      identifiers = [
        data.aws_iam_role.ows_video_task_role.arn,
        aws_iam_user.ows_video_iam_user.arn,
      ]
    }
  }
}

data "aws_iam_policy_document" "ows_video_browser_upload_assume_role_policy" {
  statement {
    effect = "Allow"

    actions = [
      "sts:AssumeRole",
    ]

    resources = [
      aws_iam_role.ows_video_browser_upload_role.arn,
    ]
  }
}

data "aws_iam_policy_document" "s3_list_bucket_policy" {
  statement {
    effect = "Allow"

    actions = [
      "s3:ListBucket",
    ]

    resources = [
      module.s3_video_bucket.s3_bucket_arn_output,
    ]
  }
}

# Browser upload role setup
resource "aws_iam_role" "ows_video_browser_upload_role" {
  name                 = "${var.environment}-ows-video-browser-upload-role"
  max_session_duration = 43200
  assume_role_policy   = data.aws_iam_policy_document.assume_role_policy.json
}

data "aws_iam_policy" "s3_raw_and_thumbnails_dir_putonly_policy" {
  name = "S3-${module.s3_video_bucket.s3_bucket_name_output}-raw-and-thumbnails-WO"
}

resource "aws_iam_role_policy_attachment" "ows_video_browser_upload_policy_attachment" {
  role       = aws_iam_role.ows_video_browser_upload_role.id
  policy_arn = data.aws_iam_policy.s3_raw_and_thumbnails_dir_putonly_policy.arn
}

resource "aws_iam_policy" "ows_video_browser_upload_assume_role_policy" {
  name   = "${var.environment}-ows-video-browser-upload-assume-role-policy"
  policy = data.aws_iam_policy_document.ows_video_browser_upload_assume_role_policy.json
}

resource "aws_iam_policy" "s3_raw_dir_readonly_policy" {
  name   = "S3-${module.s3_video_bucket.s3_bucket_name_output}-raw-RO"
  policy = data.aws_iam_policy_document.s3_raw_dir_readonly_policy.json
}

resource "aws_iam_policy" "s3_mezzanine_dir_readonly_policy" {
  name   = "S3-${module.s3_video_bucket.s3_bucket_name_output}-mezzanine-RO"
  policy = data.aws_iam_policy_document.s3_mezzanine_dir_readonly_policy.json
}

resource "aws_iam_policy" "s3_thumbnails_dir_readonly_policy" {
  name   = "S3-${module.s3_video_bucket.s3_bucket_name_output}-thumbnails-RO"
  policy = data.aws_iam_policy_document.s3_thumbnails_dir_readonly_policy.json
}

resource "aws_iam_policy" "s3_list_bucket_policy" {
  name   = "S3-${module.s3_video_bucket.s3_bucket_name_output}-list-bucket"
  policy = data.aws_iam_policy_document.s3_list_bucket_policy.json
}

data "aws_cloudfront_origin_access_identity" "cloudfront_origin_access_id" {
  id = "E1SE1EWEBOSJQH"
}

module "s3_video_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.12.1"
  env    = var.environment

  bucket_name        = var.video_assets_bucket_name
  application_family = var.application_family

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  acceleration_status = "Enabled"

  bucket_cors_rule = [
    {
      allowed_headers = ["*"]
      allowed_methods = ["PUT", "POST"]
      allowed_origins = ["https://workstation.theorchard.com"]
      expose_headers  = ["ETag"]
      max_age_seconds = 3000
    },
    {
      allowed_headers = ["*"]
      allowed_methods = ["PUT", "POST"]
      allowed_origins = ["https://workstation-cf.theorchard.com"]
      expose_headers  = ["ETag"]
      max_age_seconds = 3000
    },
    {
      allowed_headers = ["*"]
      allowed_methods = ["PUT", "POST"]
      allowed_origins = ["https://oa.theorchard.com"]
      expose_headers  = ["ETag"]
      max_age_seconds = 3000
    },
    {
      allowed_headers = ["*"]
      allowed_methods = ["PUT", "POST"]
      allowed_origins = ["https://workstation.prodawal.com"]
      expose_headers  = ["ETag"]
      max_age_seconds = 3000
    },
    {
      allowed_headers = ["*"]
      allowed_methods = ["PUT", "POST"]
      allowed_origins = ["https://workstation.awal.com"]
      expose_headers  = ["ETag"]
      max_age_seconds = 3000
    },
  ]
  bucket_policy_overrides = [
    data.aws_iam_policy_document.thumbnails_s3_policy_document.json,
  ]

  lifecycle_rules_options_noncurrent_version_transition = [
    {
      prefix        = ""
      enabled       = true
      days          = 30
      storage_class = "GLACIER"
    }
  ]

  lifecycle_rules_options_current_version_transition = [
    {
      prefix        = ""
      enabled       = true
      days          = 0
      storage_class = "INTELLIGENT_TIERING"
    }
  ]

  lifecycle_rules_abort_incomplete_multipart_upload_days = [
    {
      prefix  = ""
      enabled = true
      days    = 7
    }
  ]

  apply_replication_configuration = [{
    prefix                            = ""
    destination_bucket                = "${var.environment}-${var.video_assets_bucket_name}-replica"
    storage_class                     = "GLACIER_IR"
    enabled                           = true
    delete_marker_replication_enabled = false
    replication_time_control_enabled  = true
  }]

  storage_lens_configuration = {
    enabled = true

    advanced_cost_optimization_metrics_enabled = true
    advanced_data_protection_metrics_enabled   = true
  }
}

data "aws_lambda_function" "datadog_s3_event_forwarder" {
  function_name = "${var.environment}-lambda-datadog-s3-event-forwarder"
}

resource "aws_s3_bucket_notification" "event_notification_configuration" {
  bucket = module.s3_video_bucket.s3_bucket_name_output

  lambda_function {
    lambda_function_arn = data.aws_lambda_function.datadog_s3_event_forwarder.arn
    events              = ["s3:Replication:OperationFailedReplication"]
  }
}

data "aws_iam_policy_document" "thumbnails_s3_policy_document" {
  statement {
    actions   = ["s3:GetObject"]
    resources = ["${module.s3_video_bucket.s3_bucket_arn_output}/thumbnails/*"]

    principals {
      type        = "AWS"
      identifiers = [data.aws_cloudfront_origin_access_identity.cloudfront_origin_access_id.iam_arn]
    }
  }
}

resource "aws_s3_bucket_inventory" "s3_video_bucket_inventory" {
  bucket = module.s3_video_bucket.s3_bucket_name_output
  name   = "${var.video_assets_bucket_name}-inventory"

  included_object_versions = "All"

  optional_fields = ["ETag", "Size", "StorageClass", "EncryptionStatus", "ObjectLockRetainUntilDate", "ObjectLockMode", "ObjectLockLegalHoldStatus", "ReplicationStatus", "IsMultipartUploaded", "LastModifiedDate", "IntelligentTieringAccessTier", "BucketKeyStatus", "ChecksumAlgorithm"]

  schedule {
    frequency = "Weekly"
  }

  destination {
    bucket {
      format     = "CSV"
      bucket_arn = "arn:aws:s3:::prod-inventory-us-east-1-bucket"
      account_id = "086679231553"
      prefix     = "${module.s3_video_bucket.s3_bucket_name_output}/inventory"
      encryption {
        sse_s3 {}
      }
    }
  }
}