module "graphql_switchboard_sentry" {
  source = "git@github.com:theorchard/terraform-sentry//?ref=5.0.0"

  environment        = var.environment
  service_name       = var.graphql_service_name
  platform           = "python"
  application_family = var.application_family
  teams              = [var.environment]
}

# Allow service to be accessed via jenkins
data "aws_security_group" "jenkins_security_group" {
  name = "prod-jenkins-aws-pipeline-agent-local-ssd"
}

# Allow service to assume role for cross-account SecretsManager access
data "aws_iam_policy_document" "graphql_assume_role_policy" {
  statement {
    actions = [
      "sts:AssumeRole",
    ]

    resources = [
      "arn:aws:iam::662302927201:role/qa-orchard-access",
    ]
  }
}

resource "aws_iam_policy" "graphql_assume_role_policy" {
  name   = "${var.environment}-${var.graphql_service_name}-sts-assume-role-policy"
  policy = data.aws_iam_policy_document.graphql_assume_role_policy.json
}

module "graphql_switchboard_environment" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=6.5.0"

  providers = {
    aws.dns = aws.networking
  }

  environment                              = var.environment
  service_name                             = var.graphql_service_name
  aws_region                               = var.aws_region
  application_family                       = var.application_family
  commit_sha                               = "latest"
  container_port                           = "8080"
  task_type                                = "web_service"
  desired_task_count                       = 2
  task_cpu                                 = 512
  task_memory                              = 1024
  maximum_capacity                         = 4
  minimum_capacity                         = 2
  load_balancer_access_logs_s3_bucket_name = "orch-elb-logs"
  vpc_id                                   = data.aws_vpc.vpc.id
  https_listener_certificate_id            = "a76e4883-28aa-4062-a4cc-c06b8012ae28"
  splitio_enabled                          = true
  qa_https_listener_allow_cidr_blocks = [
    "192.168.31.0/24",
    "192.168.32.0/24",
    "192.168.33.0/24",
    "192.168.40.0/22",
    "10.30.0.0/22",
    "10.40.0.0/22",
    "10.12.240.0/24",
    "10.12.250.0/24",
  ]
  https_listener_allow_security_group_ids = [
    data.aws_security_group.jenkins_security_group.id
  ]

  iam_managed_policy_attachments = [
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    aws_iam_policy.graphql_assume_role_policy.arn,
  ]

  fargate_service_subnets = data.aws_subnets.private.ids
  load_balancer_subnets   = data.aws_subnets.private.ids

  environment_variables = [
    {
      Environment = var.environment
    },
    {
      LOGGER_DSN = "https://${var.environment}-fluentd-applications.theorchard.io:8888/application"
    },
    {
      SENTRY_DSN = module.graphql_switchboard_sentry.sentry_key_dsn_public_output
    },
    {
      SWITCHBOARD_ROLE_ARN = "arn:aws:iam::662302927201:role/qa-orchard-access"
    },
    {
      SWITCHBOARD_SECRET_ARN = "arn:aws:secretsmanager:us-east-1:662302927201:secret:qa-system-jwt-secret-FH9GOn"
    },
    {
      GRAPHQL_PRODUCT_HOST = "https://${var.environment}-graphql-product.theorchard.io"
    },
    {
      AUTH0_CREDENTIALS_ARN = module.graphql_switchboard_secrets["AUTH0_CREDENTIALS"].secret_arn
    },
    {
      AUTH0_AUDIENCE = var.auth0_audience
    },
    {
      GRASS_URL = "https://${var.environment}-ows-grass.theorchard.io"
    },
    {
      INTROSPECTION = "1"
    },
  ]

  secrets = [
    {
      SPLIT_API_KEY = "${var.environment}/split/API_KEY"
    },
  ]
}

module "graphql_switchboard_service_dashboard" {
  source                            = "git@github.com:theorchard/terraform-datadog.git//modules/service?ref=6.18.1"
  environment                       = var.environment
  environment_type                  = "fargate"
  service_name                      = var.graphql_service_name
  application_family                = var.application_family
  notification_endpoints            = "@slack-switchboard-eng"
  escalation_notification_endpoints = "@slack-switchboard-eng"
  service_4xx_monitor_enabled       = false
}


# create role for integration tests
data "aws_iam_policy_document" "graphql_integration_test_policy" {
  statement {
    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]

    resources = [
      module.graphql_switchboard_secrets["CONSUMER_SECRET"].secret_arn
    ]
  }

}

resource "aws_iam_policy" "graphql_integration_test_policy" {
  name        = format("SecretsManager-%s-%s-integration-test-role-policy", var.environment, var.graphql_service_name)
  description = "Grants graphql-switchboard integration tests access to CONSUMER_SECRET secrets"
  policy      = data.aws_iam_policy_document.graphql_integration_test_policy.json
}

data "aws_iam_policy_document" "jenkins_assume_role_policy" {
  version = "2012-10-17"
  statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"
    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::437795906767:role/prod-jenkins-aws-pipeline-agent",
      ]
    }
  }
}
resource "aws_iam_role" "graphql_integration_test_role" {
  name               = format("%s-%s-integration-test-role", var.environment, var.graphql_service_name)
  description        = "Role assumed by Jenkins for graphql-switchboard integration tests"
  assume_role_policy = data.aws_iam_policy_document.jenkins_assume_role_policy.json
}

resource "aws_iam_role_policy_attachment" "graphql_integration_test_role_policy_attachment" {
  role       = aws_iam_role.graphql_integration_test_role.name
  policy_arn = aws_iam_policy.graphql_integration_test_policy.arn
}