module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = "devops"
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/business-solutions-automations-ses/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data aws_caller_identity current {}

module "accounts" {
  source = "git@github.com:theorchard/terraform-aws-accounts-map.git//modules/read_accounts_map?ref=3.0.2"
}

# SES Email Identity
resource "aws_ses_domain_identity" "theorchard_com" {
  domain = "theorchard.com"
}

data "aws_iam_policy_document" "songwhip_fan_consent_handler_send_policy" {
  statement {
    actions = [
      "ses:SendEmail",
      "ses:SendRawEmail",
    ]
    effect    = "Allow"
    resources = [
      aws_ses_domain_identity.theorchard_com.arn
    ]

    principals {
      type        = "AWS"
      identifiers = [
        module.accounts.gdb_accounts["business-solutions-qa"],
        module.accounts.gdb_accounts["business-solutions-prod"],
      ]
    }

    condition {
      test     = "StringLike"
      variable = "ses:FromAddress"
      values   = ["noreply.business.solutions@theorchard.com"]
    }
  }
}

resource "aws_ses_identity_policy" "songwhip_fan_consent_handler_send_policy" {
  identity    = aws_ses_domain_identity.theorchard_com.arn
  name        = "SES-${var.environment}-noreply-business-sulutions-send-policy"
  policy      = data.aws_iam_policy_document.songwhip_fan_consent_handler_send_policy.json
}



# ── Cross-account policy for ecommerce D2C shopify onboarding ────────────────────

data "aws_iam_policy_document" "ecommerce_d2c_shopify_onboarding_send_policy" {
  statement {
    actions = [
      "ses:SendEmail",
      "ses:SendRawEmail",
    ]
    effect    = "Allow"
    resources = [
      aws_ses_domain_identity.sonymusic_com.arn
    ]

    principals {
      type        = "AWS"
      identifiers = [
        "arn:aws:iam::811473064144:role/lambda-qa-lambda-d2c-onboard-shopify-stores",     # ecommerce-qa Lambda role
        "arn:aws:iam::997286397029:role/lambda-prod-lambda-d2c-onboard-shopify-stores",   # ecommerce-prod Lambda role
      ]
    }

    condition {
      test     = "StringEquals"
      variable = "ses:FromAddress"
      values   = ["noreply-ecommerce@sonymusic.com"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:PrincipalArn"
      values   = [
        "arn:aws:iam::811473064144:role/lambda-qa-lambda-d2c-onboard-shopify-stores",
        "arn:aws:sts::811473064144:assumed-role/lambda-qa-lambda-d2c-onboard-shopify-stores/*",
        "arn:aws:iam::997286397029:role/lambda-prod-lambda-d2c-onboard-shopify-stores",
        "arn:aws:sts::997286397029:assumed-role/lambda-prod-lambda-d2c-onboard-shopify-stores/*",
      ]
    }
  }
}

resource "aws_ses_identity_policy" "ecommerce_d2c_shopify_onboarding_send_policy" {
  identity    = aws_ses_domain_identity.sonymusic_com.arn
  name        = "SES-${var.environment}-d2c-shopify-onboarding-send-policy"
  policy      = data.aws_iam_policy_document.ecommerce_d2c_shopify_onboarding_send_policy.json
}

resource "aws_ses_domain_identity" "sonymusic_com" {
  domain = "sonymusic.com"
}

resource "aws_ses_domain_dkim" "sonymusic_com_dkim" {
  domain = aws_ses_domain_identity.sonymusic_com.domain
}

output "sonymusic_com_verification_token" {
  description = "The TXT record that needs to be added to DNS to verify SES domain identity ownership"
  value = "Name: _amazonses.sonymusic.com, Type: TXT, Value: ${aws_ses_domain_identity.sonymusic_com.verification_token}"
}

output "sonymusic_com_dkim_records" {
  description = "The CNAME records that need to be added to DNS for DKIM authentication"
  value = [for token in aws_ses_domain_dkim.sonymusic_com_dkim.dkim_tokens : "Name: ${token}._domainkey.sonymusic.com, Type: CNAME, Value: ${token}.dkim.amazonses.com"]
}