mock_provider "aws" {
  alias = "dns"
}

mock_provider "aws" {}

override_data {
  target = data.aws_vpc.selected
  values = {
    id         = "vpc-12345678"
    cidr_block = "10.0.0.0/16"
  }
}

override_data {
  target = data.aws_ec2_managed_prefix_lists.private_subnets
  values = {
    ids = ["pl-11111111"]
  }
}

override_data {
  target = data.aws_vpc_endpoint.s3_interface
  values = {
    id                      = "vpce-0a1b2c3d4e5f6g7h8"
    network_interface_ids   = ["eni-11111111", "eni-22222222"]
    vpc_id                  = "vpc-12345678"
    service_name            = "com.amazonaws.us-east-1.s3"
    vpc_endpoint_type       = "Interface"
  }
}

override_data {
  target = data.aws_network_interface.s3_endpoint_enis
  values = {
    private_ip = "10.0.1.100"
  }
}

override_data {
  target = data.aws_acm_certificate.load_balancer_tls_certificate
  values = {
    arn    = "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012"
    domain = "*.dev.theorchard.io"
  }
}

override_data {
  target = data.aws_wafv2_web_acl.default_waf
  values = {
    arn  = "arn:aws:wafv2:us-east-1:123456789012:regional/webacl/dev-orcd-waf-block/12345678"
    name = "dev-orcd-waf-block"
  }
}

override_resource {
  target = aws_lb.application_load_balancer
  values = {
    arn     = "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/dev-test-spa/1234567890abcdef"
    id      = "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/dev-test-spa/1234567890abcdef"
    dns_name = "dev-test-spa-1234567890.us-east-1.elb.amazonaws.com"
    zone_id  = "Z35SXDOTRQ7X7K"
  }
}

override_resource {
  target = aws_lb_target_group.s3_endpoint_ip_target_group
  values = {
    arn  = "arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/dev-test-spa-tg/1234567890abcdef"
    id   = "arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/dev-test-spa-tg/1234567890abcdef"
    name = "dev-test-spa-target-group"
  }
}

override_resource {
  target = aws_lb_listener.load_balancer_https_listener
  values = {
    arn = "arn:aws:elasticloadbalancing:us-east-1:123456789012:listener/app/dev-test-spa/1234567890abcdef/1234567890abcdef"
    id  = "arn:aws:elasticloadbalancing:us-east-1:123456789012:listener/app/dev-test-spa/1234567890abcdef/1234567890abcdef"
  }
}

override_module {
  target = module.s3_bucket
  outputs = {
    s3_bucket_id_output          = "test-spa.dev.theorchard.io"
    s3_bucket_arn_output         = "arn:aws:s3:::test-spa.dev.theorchard.io"
    s3_bucket_name_output        = "test-spa.dev.theorchard.io"
    s3_bucket_domain_name_output = "test-spa.dev.theorchard.io.s3.amazonaws.com"
  }
}

run "test_defaults" {
  variables {
    environment                   = "dev"
    service_name                  = "test-spa"
    application_family            = "devops"
    vpc_id                        = "vpc-12345678"
    load_balancer_subnet_ids      = ["subnet-11111111", "subnet-22222222"]
    fully_qualified_domain_name   = "test-spa.dev.theorchard.io"
    certificate_domain            = "*.dev.theorchard.io"
  }

  assert {
    condition     = aws_security_group.load_balancer_security_group.name == "dev-test-spa-load-balancer-security-group"
    error_message = "Load balancer security group name is not as expected"
  }

  assert {
    condition     = aws_lb.application_load_balancer.internal == true
    error_message = "Load balancer should be internal by default"
  }

  assert {
    condition     = aws_lb_listener.load_balancer_https_listener.port == 443
    error_message = "HTTPS listener port should be 443 by default"
  }

  assert {
    condition     = tolist(aws_lb_listener_rule.forward_paths.condition)[0].path_pattern[0].values == toset(["/frontend-test-spa/frontend-test-spa-*", "/frontend-test-spa/prs/*", "/frontend-test-spa/assets/*", "/frontend-test-spa/index.html"])
    error_message = "Default static path patterns should include versioned bundle, prs, assets, and index.html paths"
  }

  assert {
    condition     = var.enable_pull_request_instances == false
    error_message = "enable_pull_request_instances should be false by default"
  }
}

run "test_custom_tags" {
  variables {
    environment                 = "dev"
    service_name                = "test-spa"
    application_family          = "web"
    vpc_id                      = "vpc-12345678"
    load_balancer_subnet_ids    = ["subnet-11111111", "subnet-22222222"]
    fully_qualified_domain_name = "test-spa.dev.theorchard.io"
    certificate_domain          = "*.dev.theorchard.io"
    additional_tags = {
      team  = "platform"
      owner = "devops"
    }
  }

  assert {
    condition     = local.combined_resource_tags.team == "platform"
    error_message = "Additional tags should be merged into combined tags"
  }

  assert {
    condition     = local.combined_resource_tags.terraformed == true
    error_message = "Terraformed tag should be set to true"
  }
}

run "test_static_path_patterns" {
  variables {
    environment                 = "dev"
    service_name                = "test-spa"
    application_family          = "web"
    vpc_id                      = "vpc-12345678"
    certificate_domain          = "*.dev.theorchard.io"
    load_balancer_subnet_ids    = ["subnet-11111111", "subnet-22222222"]
    fully_qualified_domain_name = "test-spa.dev.theorchard.io"
    custom_static_path_patterns = ["/assets/*", "/favicon.ico"]
  }

  assert {
    condition     = alltrue([for pattern in ["/assets/*", "/favicon.ico"] : contains(tolist(aws_lb_listener_rule.forward_paths.condition)[0].path_pattern[0].values, pattern)])
    error_message = "Static path patterns should include all custom patterns"
  }
}

run "test_spa_rewrite_config" {
  variables {
    environment                 = "dev"
    service_name                = "test-spa"
    application_family          = "web"
    vpc_id                      = "vpc-12345678"
    load_balancer_subnet_ids    = ["subnet-11111111", "subnet-22222222"]
    fully_qualified_domain_name = "test-spa.dev.theorchard.io"
    certificate_domain          = "*.dev.theorchard.io"
    spa_rewrite_regex           = "^/app/.*$"
    spa_rewrite_target          = "app.html"
    spa_rewrite_path_patterns   = ["/app/*"]
  }

  assert {
    condition     = tolist(aws_lb_listener_rule.rewrite_to_index.transform)[0].url_rewrite_config[0].rewrite[0].regex == "^/app/.*$"
    error_message = "SPA rewrite regex should match custom regex"
  }

  assert {
    condition     = tolist(aws_lb_listener_rule.rewrite_to_index.transform)[0].url_rewrite_config[0].rewrite[0].replace == "/frontend-test-spa/app.html"
    error_message = "SPA rewrite target should match custom target"
  }
}

run "test_cors_headers_enabled_in_qa" {
  variables {
    environment                    = "qa"
    service_name                   = "test-spa"
    application_family             = "web"
    vpc_id                         = "vpc-12345678"
    load_balancer_subnet_ids       = ["subnet-11111111", "subnet-22222222"]
    fully_qualified_domain_name    = "test-spa.qa.theorchard.io"
    certificate_domain             = "*.qa.theorchard.io"
    enable_pull_request_instances  = true
  }

  assert {
    condition     = aws_lb_listener.load_balancer_https_listener.routing_http_response_access_control_allow_origin_header_value == "*"
    error_message = "CORS Access-Control-Allow-Origin header should be '*' when enable_pull_request_instances is true"
  }

  assert {
    condition     = aws_lb_listener.load_balancer_https_listener.routing_http_response_access_control_allow_methods_header_value == "GET, HEAD"
    error_message = "CORS Access-Control-Allow-Methods header should be 'GET, HEAD' when enable_pull_request_instances is true"
  }
}

run "test_cors_validation_fails_in_prod" {
  command = plan

  variables {
    environment                    = "prod"
    service_name                   = "test-spa"
    application_family             = "web"
    vpc_id                         = "vpc-12345678"
    load_balancer_subnet_ids       = ["subnet-11111111", "subnet-22222222"]
    fully_qualified_domain_name    = "test-spa.prod.theorchard.io"
    certificate_domain             = "*.prod.theorchard.io"
    enable_pull_request_instances  = true
  }

  expect_failures = [
    var.enable_pull_request_instances
  ]
}