# State Function definition for AWAL Plus Account Creation flow.

# Step Function (SFN) root role policy document.
data "aws_iam_policy_document" "sfn_awal_plus_account_creation_assume_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "Service"
      identifiers = [
        "states.amazonaws.com",
        "lambda.amazonaws.com",
        "events.amazonaws.com",
      ]
    }
  }
}
# create iam role
resource "aws_iam_role" "sfn_awal_plus_account_creation_assume_role" {
  name               = "${var.environment}-workflow-${var.service_name}-state-machine-role"
  assume_role_policy = data.aws_iam_policy_document.sfn_awal_plus_account_creation_assume_role.json
}


# Step Function (SFN) - SFN Cloudwatch logs permission policy
data "aws_iam_policy_document" "sfn_awal_plus_account_creation_log_event_policy_document" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:logs:${var.aws_region}:${data.aws_caller_identity.current.account_id}:log-group:${var.environment}-${var.service_name}",
      "arn:aws:logs:${var.aws_region}:${data.aws_caller_identity.current.account_id}:log-group:${var.environment}-${var.service_name}:log-stream:*"
    ]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents"
    ]
  }
}
resource "aws_iam_role_policy" "sfn_awal_plus_account_creation_log_event_policy_attachment" {
  name   = "${var.environment}-${var.service_name}-log-event-policy"
  role   = aws_iam_role.sfn_awal_plus_account_creation_assume_role.id
  policy = data.aws_iam_policy_document.sfn_awal_plus_account_creation_log_event_policy_document.json
}


# State machine lambda policy that gives the state machine role permission to invoke lambdas
data "aws_iam_policy_document" "sfn_awal_plus_account_creation_invoke_lambda_policy_document" {
  statement {
    actions = [
      "lambda:InvokeFunction",
    ]

    resources = [
      data.aws_lambda_function.create_vendor_lambda.arn,
      data.aws_lambda_function.send_failure_lambda.arn,
      data.aws_lambda_function.send_success_lambda.arn,
      data.aws_lambda_function.create_master_contact_lambda.arn,
      data.aws_lambda_function.send_org_invite_email_lambda.arn,
      data.aws_lambda_function.lambda_abacus_sync_account.arn
    ]

  }
}

# attach invoke lambda policy.
resource "aws_iam_role_policy" "sfn_awal_plus_account_creation_invoke_lambda_role_policy" {
  name   = "${var.environment}-${var.service_name}-lambda-role-policy"
  role   = aws_iam_role.sfn_awal_plus_account_creation_assume_role.id
  policy = data.aws_iam_policy_document.sfn_awal_plus_account_creation_invoke_lambda_policy_document.json
}


data "aws_iam_policy_document" "sfn_awal_plus_account_creation_xray_policy_document" {
  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "xray:PutTraceSegments",
      "xray:PutTelemetryRecords",
      "xray:GetSamplingRules",
      "xray:GetSamplingTargets"
    ]
  }
}

# attach invoke xray policy.
resource "aws_iam_role_policy" "sfn_awal_plus_account_creation_xray_role_policy" {
  name   = "${var.environment}-${var.service_name}-xray-role-policy"
  role   = aws_iam_role.sfn_awal_plus_account_creation_assume_role.id
  policy = data.aws_iam_policy_document.sfn_awal_plus_account_creation_xray_policy_document.json
}

data "aws_lambda_function" "create_vendor_lambda" {
  function_name = "${var.environment}-lambda-create-vendor"
}

data "aws_lambda_function" "send_failure_lambda" {
  function_name = "${var.environment}-lambda-send-failure"
}

data "aws_lambda_function" "send_success_lambda" {
  function_name = "${var.environment}-lambda-send-success"
}

data "aws_lambda_function" "create_master_contact_lambda" {
  function_name = "${var.environment}-lambda-create-master-contact"
}

data "aws_lambda_function" "send_org_invite_email_lambda" {
  function_name = "${var.environment}-lambda-send-org-invite-email"
}

data "aws_lambda_function" "lambda_abacus_sync_account" {
  function_name = "${var.environment}-lambda-abacus-sync-account"
  qualifier     = "provisioned"
}

# Template for state machine.
data "template_file" "awal_plus_account_creation_definition" {
  template = file("${path.module}/awal_plus_account_creation.json")
  # all vars that are used in the json file.
  vars = {
    environment                  = var.environment
    lambda_create_vendor         = data.aws_lambda_function.create_vendor_lambda.arn
    lambda_send_failure          = data.aws_lambda_function.send_failure_lambda.arn
    lambda_send_success          = data.aws_lambda_function.send_success_lambda.arn
    lambda_create_master_contact = data.aws_lambda_function.create_master_contact_lambda.arn
    lambda_send_org_invite_email = data.aws_lambda_function.send_org_invite_email_lambda.arn
    lambda_abacus_sync_account   = data.aws_lambda_function.lambda_abacus_sync_account.arn
  }
}


resource "aws_sfn_state_machine" "awal_plus_account_creation" {
  name       = "${var.environment}-workflow-${var.service_name}"
  role_arn   = aws_iam_role.sfn_awal_plus_account_creation_assume_role.arn
  definition = data.template_file.awal_plus_account_creation_definition.rendered
  tags = {
    application_family = var.application_family
    environment        = var.environment
    service_name       = var.service_name
    terraformed        = true
  }
  tracing_configuration {
    enabled = true
  }
}

data "aws_sfn_state_machine" "sfn_awal_plus_account_creation_arn" {
  name = "${var.environment}-workflow-${var.service_name}"
}