data "aws_lb" "ows_dmp_alb" {
  name = "${var.environment}-ows-dmp"
}

# /external root resource
resource "aws_api_gateway_resource" "external_root_resource" {
  rest_api_id = aws_api_gateway_rest_api.fan_response_rest_api.id
  parent_id   = aws_api_gateway_rest_api.fan_response_rest_api.root_resource_id
  path_part   = "external"
}

# /external/roster resource
resource "aws_api_gateway_resource" "roster_resource" {
  rest_api_id = aws_api_gateway_rest_api.fan_response_rest_api.id
  parent_id   = aws_api_gateway_resource.external_root_resource.id
  path_part   = "roster"
}

# GET /external/roster method
resource "aws_api_gateway_method" "roster_get" {
  rest_api_id   = aws_api_gateway_rest_api.fan_response_rest_api.id
  resource_id   = aws_api_gateway_resource.roster_resource.id
  http_method   = "GET"
  authorization = "CUSTOM"
  authorizer_id = aws_api_gateway_authorizer.smf_fan_response_authorizer.id

  request_validator_id = aws_api_gateway_request_validator.fan_response_rest_api_validator.id

  request_parameters = {
    "method.request.querystring.vendorId"     = false
    "method.request.querystring.subaccountId" = false
    "method.request.querystring.search"       = false
    "method.request.querystring.limit"        = false
    "method.request.querystring.offset"       = false
  }
}

resource "aws_api_gateway_integration" "roster_integration" {
  rest_api_id             = aws_api_gateway_rest_api.fan_response_rest_api.id
  resource_id             = aws_api_gateway_resource.roster_resource.id
  http_method             = aws_api_gateway_method.roster_get.http_method
  integration_http_method = "GET"
  type                    = "HTTP_PROXY"

  # Use ALB custom domain for proper TLS SNI (certificate matches *.theorchard.io)
  # VPC Link routes traffic through NLB, but SNI must match ALB certificate
  uri = "https://${var.environment}-ows-dmp.theorchard.io/artists/participants"

  connection_type = "VPC_LINK"
  connection_id   = aws_api_gateway_vpc_link.fan_response_vpc_link.id

  request_parameters = {
    "integration.request.header.Accept"                    = "'application/json'"
    "integration.request.header.X-Forwarded-From"          = "'api-gateway'"
    "integration.request.querystring.vendorId"             = "method.request.querystring.vendorId"
    "integration.request.querystring.subaccountId"         = "method.request.querystring.subaccountId"
    "integration.request.querystring.search"               = "method.request.querystring.search"
    "integration.request.querystring.limit"                = "method.request.querystring.limit"
    "integration.request.querystring.offset"               = "method.request.querystring.offset"
  }

  # Explicit dependencies to ensure proper creation order and avoid race conditions
  depends_on = [
    aws_api_gateway_vpc_link.fan_response_vpc_link,
    aws_lb.ows_dmp_nlb,
    aws_lb_listener.ows_dmp_nlb_listener,
    aws_lb_target_group_attachment.ows_dmp_alb_to_nlb,
  ]
}

# Method response for 200 OK
resource "aws_api_gateway_method_response" "roster_response_200" {
  rest_api_id = aws_api_gateway_rest_api.fan_response_rest_api.id
  resource_id = aws_api_gateway_resource.roster_resource.id
  http_method = aws_api_gateway_method.roster_get.http_method
  status_code = "200"

  response_models = {
    "application/json" = "Empty"
  }

  response_parameters = {
    "method.response.header.Access-Control-Allow-Origin" = true
  }
}

# Integration response for 200 OK
resource "aws_api_gateway_integration_response" "roster_integration_response_200" {
  rest_api_id = aws_api_gateway_rest_api.fan_response_rest_api.id
  resource_id = aws_api_gateway_resource.roster_resource.id
  http_method = aws_api_gateway_method.roster_get.http_method
  status_code = aws_api_gateway_method_response.roster_response_200.status_code

  response_parameters = {
    "method.response.header.Access-Control-Allow-Origin" = "'*'"
  }

  depends_on = [aws_api_gateway_integration.roster_integration]
}

# Method response for 4xx errors
resource "aws_api_gateway_method_response" "roster_response_4xx" {
  rest_api_id = aws_api_gateway_rest_api.fan_response_rest_api.id
  resource_id = aws_api_gateway_resource.roster_resource.id
  http_method = aws_api_gateway_method.roster_get.http_method
  status_code = "400"

  response_models = {
    "application/json" = "Empty"
  }

  response_parameters = {
    "method.response.header.Access-Control-Allow-Origin" = true
  }
}

# Integration response for 4xx errors
resource "aws_api_gateway_integration_response" "roster_integration_response_4xx" {
  rest_api_id       = aws_api_gateway_rest_api.fan_response_rest_api.id
  resource_id       = aws_api_gateway_resource.roster_resource.id
  http_method       = aws_api_gateway_method.roster_get.http_method
  status_code       = "400"
  selection_pattern = "4\\d{2}"

  response_parameters = {
    "method.response.header.Access-Control-Allow-Origin" = "'*'"
  }

  depends_on = [aws_api_gateway_integration.roster_integration]
}

# Method response for 5xx errors
resource "aws_api_gateway_method_response" "roster_response_5xx" {
  rest_api_id = aws_api_gateway_rest_api.fan_response_rest_api.id
  resource_id = aws_api_gateway_resource.roster_resource.id
  http_method = aws_api_gateway_method.roster_get.http_method
  status_code = "500"

  response_models = {
    "application/json" = "Empty"
  }

  response_parameters = {
    "method.response.header.Access-Control-Allow-Origin" = true
  }
}

# Integration response for 5xx errors
resource "aws_api_gateway_integration_response" "roster_integration_response_5xx" {
  rest_api_id       = aws_api_gateway_rest_api.fan_response_rest_api.id
  resource_id       = aws_api_gateway_resource.roster_resource.id
  http_method       = aws_api_gateway_method.roster_get.http_method
  status_code       = "500"
  selection_pattern = "5\\d{2}"

  response_parameters = {
    "method.response.header.Access-Control-Allow-Origin" = "'*'"
  }

  depends_on = [aws_api_gateway_integration.roster_integration]
}