resource "aws_iam_user" "temp_download_user" {
  for_each = {
    for user in var.user_access_prefixes : user["username"] => user if user.create_aws_user
  }
  name = each.key
  tags = {
    "role" = "service-user"
  }
}

data "aws_iam_policy_document" "bucket_access_policy_document" {
  for_each = {
    for user in var.user_access_prefixes : user["username"] => user
  }
  statement {
    effect    = "Allow"
    actions = [
      "s3:GetObject",
      "s3:GetObjectAcl",
    ]
    resources = [
      for prefix in each.value["prefixes"] :
        format("%s/%s/*", module.bulk_asset_download_output_bucket.s3_bucket_arn_output, prefix)
    ]
    condition {
      test     = "DateLessThan"
      variable = "aws:CurrentTime"
      values   = [format("%sT23:59:59Z", each.value["access_expiry_date"])]
    }
  }

  statement {
    effect    = "Allow"
    actions   = [
      "s3:GetBucketLocation",
    ]
    resources = [
      module.bulk_asset_download_output_bucket.s3_bucket_arn_output
    ]
    condition {
      test     = "DateLessThan"
      variable = "aws:CurrentTime"
      values   = [format("%sT23:59:59Z", each.value["access_expiry_date"])]
    }
  }

  statement {
    effect    = "Allow"
    actions   = ["s3:ListBucket"]
    resources = [
      module.bulk_asset_download_output_bucket.s3_bucket_arn_output
    ]
    condition {
      test     = "StringLike"
      variable = "s3:prefix"
      values = concat(
        [""],  # Allow listing the bucket root
        flatten([
          for prefix in each.value["prefixes"] : [
            format("%s", prefix),
            format("%s/*", prefix)
          ]
        ])
      )
    }
    condition {
      test     = "DateLessThan"
      variable = "aws:CurrentTime"
      values   = [format("%sT23:59:59Z", each.value["access_expiry_date"])]
    }
  }
}

# Create policy for read-write access to the S3 bucket
resource "aws_iam_user_policy" "bucket_access_policy_document" {
  for_each = {
    for user in var.user_access_prefixes : user["username"] => user
  }
  user     = each.key
  name     = "S3-${module.bulk_asset_download_output_bucket.s3_bucket_name_output}-${each.value["username"]}-RO"
  policy   = data.aws_iam_policy_document.bucket_access_policy_document[each.key].json
}

# Grant Ops output bucket access
data "aws_iam_policy_document" "output-bucket-ops-access" {
  statement {
    effect = "Allow"

    actions = [
      "s3:GetObject",
      "s3:GetObject*",
      "s3:ListBucket",
      "s3:PutObject",
      "s3:PutObject*",
      "s3:DeleteObject",
      "s3:DeleteObject*",
    ]

    resources = [
      format("%s/*", module.bulk_asset_download_output_bucket.s3_bucket_arn_output),
    ]
  }

  statement {
    effect = "Allow"

    actions = [
      "s3:ListBucket",
    ]

    resources = [
      module.bulk_asset_download_output_bucket.s3_bucket_arn_output,
    ]
  }
}

resource "aws_iam_policy" "output-bucket-ops-access" {
  name = "S3-${var.environment}-bulk-asset-download-output-bucket-Ops-RW"
  policy = data.aws_iam_policy_document.output-bucket-ops-access.json
}

resource "aws_iam_group_policy_attachment" "output-bucket-ops-rw-policy" {
  group = "label-export-operations-group"
  policy_arn = aws_iam_policy.output-bucket-ops-access.arn
}