# Cron Lambda that calls the internal Fargate ALB endpoint /v1/execution/sync every 5 minutes.
# EventBridge API Destinations cannot reach private ALBs, so we use a Lambda inside the VPC instead.

module "songwhip_presaves_cron_sentry" {
  source = "git@github.com:theorchard/terraform-sentry//?ref=5.0.0"

  environment        = var.environment
  teams              = [var.environment]
  service_name       = "lambda-${var.service_name}-execution-sync"
  application_family = var.application_family
  platform           = "node"
}

module "songwhip_presaves_execution_sync_cron" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=5.3.0"

  environment        = var.environment
  lambda_name        = "lambda-${var.service_name}-execution-sync"
  lambda_description = "Calls /v1/execution/sync on the presaves Fargate service"
  application_family = var.application_family

  # VPC configuration to reach the internal ALB
  vpc_enabled    = true
  vpc_id         = module.vpc_info.vpc_id
  vpc_subnet_ids = module.vpc_info.default_private_subnet_ids

  # Container image for Lambda
  use_container_image = true

  # No SQS event source — triggered by EventBridge schedule
  sqs_event_enabled = false

  # Function configuration
  lambda_function_timeout                        = 120
  lambda_function_memory_size                    = 256
  lambda_function_reserved_concurrent_executions = 1

  # Error handling
  dlq_enabled = false

  # Monitoring
  datadog_enabled = true

  lambda_function_environment_variables = {
    ENV                          = var.environment
    NODE_ENV                     = "production"
    SONGWHIP_ENV                 = "staging"
    PRESAVES_API_URL             = "https://presaves.aws-staging.songwhip.com"
    PRESAVES_EXECUTION_SYNC_PATH = "/v1/execution/sync"
    WEBHOOK_TOKEN_SECRET_NAME    = "${var.environment}/${var.service_name}/WEBHOOK_TOKEN"
    SENTRY_DSN                   = module.songwhip_presaves_cron_sentry.sentry_key_dsn_public_output
  }
}

# EventBridge schedule rule: run every 5 minutes
resource "aws_cloudwatch_event_rule" "execution_sync_schedule" {
  name                = "${var.environment}-${var.service_name}-execution-sync"
  description         = "Triggers the execution sync Lambda every 5 minutes"
  schedule_expression = "rate(5 minutes)"
  tags                = module.default_tags.tags
}

# Connect the schedule rule to the Lambda
resource "aws_cloudwatch_event_target" "execution_sync" {
  rule = aws_cloudwatch_event_rule.execution_sync_schedule.name
  arn  = module.songwhip_presaves_execution_sync_cron.lambda_arn
}

# Grant EventBridge permission to invoke the Lambda
resource "aws_lambda_permission" "execution_sync_eventbridge" {
  statement_id  = "AllowEventBridgeInvoke"
  action        = "lambda:InvokeFunction"
  function_name = module.songwhip_presaves_execution_sync_cron.lambda_name
  principal     = "events.amazonaws.com"
  source_arn    = aws_cloudwatch_event_rule.execution_sync_schedule.arn
}

# Grant the cron Lambda permission to read the webhook token from Secrets Manager
data "aws_iam_policy_document" "execution_sync_secrets_policy_document" {
  statement {
    actions = [
      "secretsmanager:GetSecretValue"
    ]
    resources = [
      module.songwhip_presaves_secrets["WEBHOOK_TOKEN"].secret_arn
    ]
  }
}

resource "aws_iam_policy" "execution_sync_secrets_policy" {
  name   = "${var.environment}-${var.service_name}-execution-sync-secrets"
  policy = data.aws_iam_policy_document.execution_sync_secrets_policy_document.json
  tags   = module.default_tags.tags
}

resource "aws_iam_role_policy_attachment" "execution_sync_secrets_attachment" {
  role       = module.songwhip_presaves_execution_sync_cron.lambda_role_id
  policy_arn = aws_iam_policy.execution_sync_secrets_policy.arn

}