// Shared KMS key for presave payloads (used by Fargate to encrypt and Lambdas to decrypt)
resource "aws_kms_key" "songwhip_presaves_kms_key" {
  description = "KMS key to encrypt/decrypt sensitive presave fields"
  tags = {
    environment        = var.environment
    service_name       = var.service_name
    application_family = var.application_family
    terraformed        = true
  }

  enable_key_rotation     = true
  deletion_window_in_days = 30
}

// Alias
resource "aws_kms_alias" "songwhip_presaves_kms_alias" {
  name          = "alias/${var.environment}-${var.service_name}"
  target_key_id = aws_kms_key.songwhip_presaves_kms_key.id
}

// Encrypt-only access
data "aws_iam_policy_document" "songwhip_presaves_kms_encrypt_only" {
  statement {
    effect    = "Allow"
    resources = [aws_kms_key.songwhip_presaves_kms_key.arn]
    actions = [
      "kms:Encrypt",
      "kms:GenerateDataKeyWithoutPlaintext",
      "kms:DescribeKey"
    ]
  }
}

resource "aws_iam_policy" "songwhip_presaves_kms_encrypt_only_policy" {
  name   = "${var.environment}-${var.service_name}-kms-encrypt-only"
  policy = data.aws_iam_policy_document.songwhip_presaves_kms_encrypt_only.json
}

// Decrypt-only access
data "aws_iam_policy_document" "songwhip_presaves_kms_decrypt_only" {
  statement {
    effect    = "Allow"
    resources = [aws_kms_key.songwhip_presaves_kms_key.arn]
    actions = [
      "kms:Decrypt",
      "kms:GenerateDataKey",
      "kms:DescribeKey"
    ]
  }
}

resource "aws_iam_policy" "songwhip_presaves_kms_decrypt_only_policy" {
  name   = "${var.environment}-${var.service_name}-kms-decrypt-only"
  policy = data.aws_iam_policy_document.songwhip_presaves_kms_decrypt_only.json
}