provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "qa-songwhip-terraform-state"
    key     = "qa/ses/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

resource "aws_ses_domain_identity" "songwhip" {
  domain = var.cloudflare_zone
}

# TODO: domain verification via terraform and CloudFlare
# from terraform docs it seems this is only partly implemented

# not sure this is necessary when domain is verified and account is not in sandbox mode
resource "aws_ses_email_identity" "contact" {
  for_each = var.verified_email_identities

  email = each.value
}

resource "aws_iam_user" "songwhip-email" {
  name = "songwhip-email"

  tags = {
    terraformed        = true
    Name               = "songwhip-email"
    human              = false
    application_family = var.application_family
    role = "service-user"
  }
}

data "aws_iam_policy_document" "songwhip-email" {
  statement {
    actions = [
      "ses:SendEmail",
      "ses:SendRawEmail",
    ]

    effect = "Allow"
    resources = [
      "arn:aws:ses:us-east-1:${data.aws_caller_identity.current.account_id}:identity/${var.cloudflare_zone}"
    ]
  }
}

resource "aws_iam_policy" "songwhip-email" {
  name        = "songwhip-email-policy"
  description = "songwhip-email vercel app policy"
  policy      = data.aws_iam_policy_document.songwhip-email.json
}

module "secrets_manager" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git?ref=1.1.0"

  for_each = var.secrets_manager_secret_names

  application_family = var.application_family
  environment        = var.environment
  service_name       = var.service_name
  secret_name        = each.value
}

module "songwhip_email_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=2.0.1"

  environment        = var.environment
  platform           = "javascript"
  service_name       = var.service_name
  application_family = var.application_family
}


# Preference center access to send emails from qa-contact@songwhip.com
data "aws_iam_policy_document" "songwhip_fan_consent_handler_send_policy" {
  statement {
    actions = [
      "ses:SendEmail",
      "ses:SendRawEmail",
    ]
    effect    = "Allow"
    resources = [
        "arn:aws:ses:us-east-1:${data.aws_caller_identity.current.account_id}:identity/${var.cloudflare_zone}"
    ]

    principals {
      type        = "AWS"
      identifiers = ["285943604611"]
    }

    condition {
      test     = "StringLike"
      variable = "ses:FromAddress"
      values   = ["qa-contact@songwhip.com"]
    }
  }
}

resource "aws_ses_identity_policy" "songwhip_fan_consent_handler_send_policy" {
  identity    = aws_ses_domain_identity.songwhip.arn
  name        = "SES-${var.environment}-songwhip-fan-consent-handler-send-policy"
  policy      = data.aws_iam_policy_document.songwhip_fan_consent_handler_send_policy.json
}