provider "snowflake" {
  account_name = "delphi"
  preview_features_enabled = [
    "snowflake_api_integration_resource",
    "snowflake_external_function_resource",
  ]
}

# Reference existing WAF
data "aws_wafv2_web_acl" "waf" {
  name  = "${var.environment}-orcd-waf-block"
  scope = "REGIONAL"
}

resource "aws_api_gateway_rest_api" "snowflake_proxy_rest_api" {
  name        = "${module.lambda_content_delete_product.lambda_name}-snowflake-proxy"
  description = "Snowflake Proxy REST API Gateway"
  endpoint_configuration {
    types = ["REGIONAL"]
  }
  lifecycle {
    create_before_destroy = true
  }
  tags = {
    application_family = var.application_family
    environment        = var.environment
    service_name       = var.service_name
    terraformed        = true
  }
}

data "aws_iam_policy_document" "rest_api_invoke_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "execute-api:Invoke",
    ]
    resources = [
      "${aws_api_gateway_rest_api.snowflake_proxy_rest_api.execution_arn}/*/POST/${aws_api_gateway_resource.snowflake_proxy_rest_api_resource.path_part}"
    ]
  }
}



resource "aws_api_gateway_resource" "snowflake_proxy_rest_api_resource" {
  rest_api_id = aws_api_gateway_rest_api.snowflake_proxy_rest_api.id
  parent_id   = aws_api_gateway_rest_api.snowflake_proxy_rest_api.root_resource_id
  path_part   = local.delete_product_lambda_name
}

resource "aws_api_gateway_request_validator" "validate_upc" {
  rest_api_id                 = aws_api_gateway_rest_api.snowflake_proxy_rest_api.id
  name                        = "${module.lambda_content_delete_product.lambda_name}-validate-upc"
  validate_request_body       = false
  validate_request_parameters = false
}

resource "aws_api_gateway_method" "snowflake_proxy_rest_api_method" {
  rest_api_id          = aws_api_gateway_rest_api.snowflake_proxy_rest_api.id
  resource_id          = aws_api_gateway_resource.snowflake_proxy_rest_api_resource.id
  request_validator_id = aws_api_gateway_request_validator.validate_upc.id
  http_method          = "POST"
  authorization        = "CUSTOM"
  authorizer_id        = aws_api_gateway_authorizer.snowflake_proxy_rest_api_authorizer.id
}

resource "aws_api_gateway_method_settings" "snowflake_proxy_api_gateway_method_settings" {
  rest_api_id = aws_api_gateway_rest_api.snowflake_proxy_rest_api.id
  stage_name  = aws_api_gateway_stage.snowflake_proxy_rest_api_stage.stage_name
  method_path = "*/*"

  settings {
    metrics_enabled = true
    logging_level   = "INFO"
  }
}

data "aws_lambda_function" "lambda_data_apps_authorizer" {
  function_name = "${var.environment}-lambda-data-apps-authorizer"
}

resource "aws_api_gateway_authorizer" "snowflake_proxy_rest_api_authorizer" {
  name            = "${var.environment}-snowflake-delete-product-authorizer"
  rest_api_id     = aws_api_gateway_rest_api.snowflake_proxy_rest_api.id
  authorizer_uri  = data.aws_lambda_function.lambda_data_apps_authorizer.invoke_arn
  identity_source = "method.request.header.Authorization"
  type            = "TOKEN"
}

resource "aws_lambda_permission" "snowflake_proxy_rest_api_authorizer_lambda_gateway_permission" {
  statement_id  = "AllowAPIGatewayInvoke"
  action        = "lambda:InvokeFunction"
  function_name = data.aws_lambda_function.lambda_data_apps_authorizer.function_name
  principal     = "apigateway.amazonaws.com"
  source_arn    = "${aws_api_gateway_rest_api.snowflake_proxy_rest_api.execution_arn}/*"
}

resource "aws_api_gateway_integration" "snowflake_proxy_rest_api_integration" {
  rest_api_id             = aws_api_gateway_rest_api.snowflake_proxy_rest_api.id
  resource_id             = aws_api_gateway_resource.snowflake_proxy_rest_api_resource.id
  http_method             = aws_api_gateway_method.snowflake_proxy_rest_api_method.http_method
  integration_http_method = "POST"
  type                    = "AWS_PROXY"
  uri                     = module.lambda_content_delete_product.lambda_invoke_arn
}

resource "aws_api_gateway_method_response" "response_200" {
  rest_api_id = aws_api_gateway_rest_api.snowflake_proxy_rest_api.id
  resource_id = aws_api_gateway_resource.snowflake_proxy_rest_api_resource.id
  http_method = aws_api_gateway_method.snowflake_proxy_rest_api_method.http_method
  status_code = "200"
}

resource "aws_api_gateway_stage" "snowflake_proxy_rest_api_stage" {
  # checkov:skip=CKV2_AWS_51 Snowflake does not support client certificate authentication
  deployment_id = aws_api_gateway_deployment.snowflake_proxy_rest_api_deployment.id
  rest_api_id   = aws_api_gateway_rest_api.snowflake_proxy_rest_api.id
  stage_name    = var.environment

  access_log_settings {
    destination_arn = aws_cloudwatch_log_group.snowflake_proxy_rest_api_log_group.arn
    format = jsonencode({
      "requestId" : "$context.requestId",
      "ip" : "$context.identity.sourceIp",
      "caller" : "$context.identity.caller",
      "user" : "$context.identity.user",
      "requestTime" : "$context.requestTime",
      "httpMethod" : "$context.httpMethod",
      "resourcePath" : "$context.resourcePath",
      "status" : "$context.status",
      "protocol" : "$context.protocol",
      "responseLength" : "$context.responseLength",
      "integrationErrorMessage" : "$context.integrationErrorMessage"
    })
  }
}

resource "aws_wafv2_web_acl_association" "web_acl_association" {
  resource_arn = aws_api_gateway_stage.snowflake_proxy_rest_api_stage.arn
  web_acl_arn  = data.aws_wafv2_web_acl.waf.arn
}


resource "aws_api_gateway_deployment" "snowflake_proxy_rest_api_deployment" {
  rest_api_id = aws_api_gateway_rest_api.snowflake_proxy_rest_api.id
  description = "Deployment for Snowflake Proxy API Gateway"

  triggers = {
    redeployment = sha1(jsonencode([
      "deploy-triggered-send-definitions-09-18-2025"
    ]))
  }

  lifecycle {
    create_before_destroy = true
  }
}


resource "aws_cloudwatch_log_group" "snowflake_proxy_rest_api_log_group" {
  name              = "/aws/apigateway/${module.lambda_content_delete_product.lambda_name}"
  retention_in_days = 365
  tags = {
    application_family = var.application_family
    environment        = var.environment
    service_name       = var.service_name
    terraformed        = true
  }
}

resource "aws_lambda_permission" "snowflake_proxy_rest_api_integration_lambda_gateway_permission" {
  statement_id  = "AllowAPIGatewayIntegrationInvoke"
  action        = "lambda:InvokeFunction"
  function_name = module.lambda_content_delete_product.lambda_arn
  principal     = "apigateway.amazonaws.com"
  source_arn    = "${aws_api_gateway_rest_api.snowflake_proxy_rest_api.execution_arn}/*"
}