data "aws_iam_policy_document" "publishing_compositions_s3_read" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:s3:::${data.aws_s3_bucket.s3_bucket.bucket}/*"
    ]

    actions = [
      "s3:GetObject"
    ]
  }
}

data "aws_iam_policy_document" "publishing_compositions_s3_list" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:s3:::${data.aws_s3_bucket.s3_bucket.bucket}/*",
      "arn:aws:s3:::${data.aws_s3_bucket.s3_bucket.bucket}"
    ]

    actions = [
      "s3:ListBucket",
      "s3:ListObjectsV2"
    ]
  }
}

data "aws_iam_policy_document" "publishing_compositions_s3_write" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:s3:::${data.aws_s3_bucket.s3_bucket.bucket}/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject"
    ]
  }
}

data "aws_iam_policy_document" "publishing_compositions_s3_delete" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:s3:::${data.aws_s3_bucket.s3_bucket.bucket}/changelog-reports/*",
    ]

    actions = [
      "s3:DeleteObject"
    ]
  }
}

data "aws_iam_policy_document" "prod_publishing_compositions_s3_read" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:s3:::${data.aws_s3_bucket.prod_s3_bucket.bucket}/changelog-reports/*"
    ]

    actions = [
      "s3:GetObject"
    ]
  }
}

data "aws_iam_policy_document" "publishing_changelog_secrets_access" {
  statement {
    effect    = "Allow"
    resources = [
      "arn:aws:secretsmanager:${var.region}:*:secret:${var.environment}/graphql-publishing/MYSQL_CHANGELOG_PASSWORD-*",
      "arn:aws:secretsmanager:${var.region}:437795906767:secret:${var.environment}/lambda-jwt-refresh/jwt_token_expiration-*",
      "arn:aws:secretsmanager:${var.region}:437795906767:secret:${var.environment}/lambda-jwt-refresh/jwt_token-*"
    ]
    actions = [
      "secretsmanager:GetSecretValue"
    ]
  }
}
data "aws_iam_policy_document" "publishing_changelog_script_ecr_token_access" {
  statement {
    effect    = "Allow"
    resources = ["*"]
    actions   = [
      "ecr:GetAuthorizationToken"
    ]
  }
}

data "aws_iam_policy_document" "publishing_changelog_script_ecr_access" {
  statement {
    effect    = "Allow"
    resources = [
      "arn:aws:ecr:us-east-1:086679231553:repository/docker-parent-images"
    ]
    actions   = [
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "ecr:BatchCheckLayerAvailability"
    ]
  }
}

resource "aws_iam_policy" "publishing_compositions_s3_read" {
  name        = "lambda-${var.environment}-publishing-changelog-s3-read"
  description = "Permission for the publishing changelog lambdas to read from the publishing-compositions s3"
  policy      = data.aws_iam_policy_document.publishing_compositions_s3_read.json
}

resource "aws_iam_policy" "publishing_compositions_s3_list" {
  name        = "lambda-${var.environment}-publishing-changelog-s3-list"
  description = "Permission for the publishing changelog lambdas to list items in the publishing-compositions s3"
  policy      = data.aws_iam_policy_document.publishing_compositions_s3_list.json
}

resource "aws_iam_policy" "publishing_compositions_s3_write" {
  name        = "lambda-${var.environment}-publishing-changelog-s3-write"
  description = "Permission for the publishing changelog lambdas to write to the publishing-compositions s3"
  policy      = data.aws_iam_policy_document.publishing_compositions_s3_write.json
}

resource "aws_iam_policy" "publishing_compositions_s3_delete" {
  name        = "lambda-${var.environment}-publishing-changelog-s3-delete"
  description = "Permission for the publishing changelog lambdas to delete from the publishing-compositions s3"
  policy      = data.aws_iam_policy_document.publishing_compositions_s3_delete.json
}

resource "aws_iam_policy" "prod_publishing_compositions_s3_read" {
  name        = "cleanup-prod-publishing-changelog-s3-read"
  description = "Permission for the publishing changelog lambdas to read from the prod-publishing-compositions s3"
  policy      = data.aws_iam_policy_document.prod_publishing_compositions_s3_read.json
}
resource "aws_iam_policy" "publishing_script_secret_access" {
  name        = "${var.environment}-publishing-script-secrets-access"
  description = "Permission for the non-utf8 character fixer script to access the publishing secrets"
  policy      = data.aws_iam_policy_document.publishing_changelog_secrets_access.json
}

resource "aws_iam_policy" "publishing_changelog_script_ecr_token_access" {
  name        = "${var.environment}-publishing-changelog-script-ecr-token-access"
  description = "Permission for the non-utf8 character fixer script to access the ECR token"
  policy      = data.aws_iam_policy_document.publishing_changelog_script_ecr_token_access.json
}

resource "aws_iam_policy" "publishing_changelog_script_ecr_access" {
  name        = "${var.environment}-publishing-changelog-script-ecr-access"
  description = "Permission for the non-utf8 character fixer script to access the ECR"
  policy      = data.aws_iam_policy_document.publishing_changelog_script_ecr_access.json
}
  


# used by https://github.com/theorchard/lambda-publishing-changelog jenkins job to clean up s3 qa data
data "aws_iam_policy_document" "jenkins_assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::437795906767:role/prod-jenkins-aws-pipeline-agent",
      ]
    }
  }
}

resource "aws_iam_role" "pub_s3_cleanup_role" {
  name               = "${var.environment}-${var.application_family}-s3-cleanup-role"
  assume_role_policy = data.aws_iam_policy_document.jenkins_assume_role_policy.json
}

resource "aws_iam_role" "pub_fix_non_utf8_characters_script_role" {
  name               = "${var.environment}-${var.application_family}-fix-non-utf8-characters-script-role"
  assume_role_policy = data.aws_iam_policy_document.jenkins_assume_role_policy.json
}

resource "aws_iam_role_policy_attachment" "pub_s3_cleanup_policy_attachments" {
  for_each = toset([
    aws_iam_policy.publishing_compositions_s3_delete.arn,
    aws_iam_policy.publishing_compositions_s3_list.arn,
    aws_iam_policy.publishing_compositions_s3_write.arn,
    aws_iam_policy.prod_publishing_compositions_s3_read.arn,
  ])
  role       = aws_iam_role.pub_s3_cleanup_role.id
  policy_arn = each.key
}

resource "aws_iam_role_policy_attachment" "fix_non_utf8_characters_policy_attach_secrets" {
  role       = aws_iam_role.pub_fix_non_utf8_characters_script_role.id
  policy_arn = aws_iam_policy.publishing_script_secret_access.arn
}

resource "aws_iam_role_policy_attachment" "fix_non_utf8_characters_policy_attach_ecr_token" {
  role       = aws_iam_role.pub_fix_non_utf8_characters_script_role.id
  policy_arn = aws_iam_policy.publishing_changelog_script_ecr_token_access.arn
}

resource "aws_iam_role_policy_attachment" "fix_non_utf8_characters_policy_attach_ecr_access" {
  role       = aws_iam_role.pub_fix_non_utf8_characters_script_role.id
  policy_arn = aws_iam_policy.publishing_changelog_script_ecr_access.arn
}