data "aws_caller_identity" "current" {
}

data "aws_iam_policy_document" "s3_mezzanine_dir_readonly_policy" {
  statement {
    effect = "Allow"

    actions = [
      "s3:GetLifecycleConfiguration",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:GetObjectTorrent",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionTorrent",
      "s3:GetReplicationConfiguration",
      "s3:HeadObject",
    ]

    resources = [
      "${aws_s3_bucket.video_assets_bucket.arn}/mezzanine/*",
    ]
  }
}

data "aws_iam_policy_document" "s3_mezzanine_dir_putonly_policy" {
  statement {
    effect = "Allow"

    actions = [
      "s3:PutObject",
      "s3:PutObjectAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectVersionTagging",
    ]

    resources = [
      "${aws_s3_bucket.video_assets_bucket.arn}/mezzanine/*",
    ]
  }
}

data "aws_iam_policy_document" "s3_mezzanine_dir_rw_policy" {
  statement {
    effect = "Allow"

    actions = [
      "s3:GetLifecycleConfiguration",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:GetObjectTorrent",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionTorrent",
      "s3:GetReplicationConfiguration",
      "s3:HeadObject",
      "s3:PutObject",
      "s3:PutObjectAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectVersionTagging",
    ]

    resources = [
      "${aws_s3_bucket.video_assets_bucket.arn}/mezzanine/*",
    ]
  }
}

data "aws_iam_policy_document" "s3_streamable_preview_dir_readonly_policy" {
  statement {
    effect = "Allow"

    actions = [
      "s3:GetLifecycleConfiguration",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:GetObjectTorrent",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionTorrent",
      "s3:GetReplicationConfiguration",
    ]

    resources = [
      "${aws_s3_bucket.video_assets_bucket.arn}/streamable-preview/*",
    ]
  }
}

data "aws_iam_policy_document" "s3_streamable_preview_dir_putonly_policy" {
  statement {
    effect = "Allow"

    actions = [
      "s3:PutObject",
      "s3:PutObjectAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectVersionTagging",
    ]

    resources = [
      "${aws_s3_bucket.video_assets_bucket.arn}/streamable-preview/*",
    ]
  }
}

data "aws_iam_policy_document" "s3_thumbnails_dir_readonly_policy" {
  statement {
    effect = "Allow"

    actions = [
      "s3:GetLifecycleConfiguration",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:GetObjectTorrent",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionTorrent",
      "s3:GetReplicationConfiguration",
    ]

    resources = [
      "${aws_s3_bucket.video_assets_bucket.arn}/thumbnails/*",
    ]
  }
}

data "aws_iam_policy_document" "s3_thumbnails_dir_putonly_policy" {
  statement {
    effect = "Allow"

    actions = [
      "s3:PutObject",
      "s3:PutObjectAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectVersionTagging",
    ]

    resources = [
      "${aws_s3_bucket.video_assets_bucket.arn}/thumbnails/*",
    ]
  }
}

data "aws_iam_policy_document" "s3_raw_dir_readonly_policy" {
  statement {
    effect = "Allow"

    actions = [
      "s3:GetBucketAcl",
      "s3:GetBucketCORS",
      "s3:GetBucketLocation",
      "s3:GetBucketLogging",
      "s3:GetBucketNotification",
      "s3:GetBucketPolicy",
      "s3:GetBucketRequestPayment",
      "s3:GetBucketTagging",
      "s3:GetBucketVersioning",
      "s3:GetBucketWebsite",
      "s3:GetLifecycleConfiguration",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:GetObjectTorrent",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionTorrent",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:ListBucketVersions",
      "s3:ListMultipartUploadParts",
    ]

    resources = [
      "${aws_s3_bucket.video_assets_bucket.arn}/raw/*",
    ]
  }
}

data "aws_iam_policy_document" "s3_raw_dir_putonly_policy" {
  statement {
    effect = "Allow"

    actions = [
      "s3:PutObject",
      "s3:PutObjectAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectVersionTagging",
    ]

    resources = [
      "${aws_s3_bucket.video_assets_bucket.arn}/raw/*",
    ]
  }
}

data "aws_iam_policy_document" "s3_raw_dir_rw_policy" {
  statement {
    effect = "Allow"

    actions = [
      "s3:GetBucketAcl",
      "s3:GetBucketCORS",
      "s3:GetBucketLocation",
      "s3:GetBucketLogging",
      "s3:GetBucketNotification",
      "s3:GetBucketPolicy",
      "s3:GetBucketRequestPayment",
      "s3:GetBucketTagging",
      "s3:GetBucketVersioning",
      "s3:GetBucketWebsite",
      "s3:GetLifecycleConfiguration",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:GetObjectTorrent",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionTorrent",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:ListBucketVersions",
      "s3:ListMultipartUploadParts",
      "s3:PutObject",
      "s3:PutObjectAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectVersionTagging",
    ]

    resources = [
      "${aws_s3_bucket.video_assets_bucket.arn}/raw/*",
    ]
  }
}

data "aws_iam_policy_document" "s3_blank_dir_readonly_policy" {
  statement {
    effect = "Allow"

    actions = [
      "s3:GetLifecycleConfiguration",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:GetObjectTorrent",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionTorrent",
      "s3:GetReplicationConfiguration",
    ]

    resources = [
      "${aws_s3_bucket.video_assets_bucket.arn}/blank/*",
    ]
  }
}

data "aws_iam_policy_document" "s3_blank_dir_putonly_policy" {
  statement {
    effect = "Allow"

    actions = [
      "s3:PutObject",
      "s3:PutObjectAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectVersionTagging",
    ]

    resources = [
      "${aws_s3_bucket.video_assets_bucket.arn}/blank/*",
    ]
  }
}

data "aws_iam_policy_document" "s3_ingest_dir_rwd_policy" {
  statement {
    effect = "Allow"

    actions = [
      "s3:DeleteObject",
      "s3:DeleteObjectTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectVersionTagging",
      "s3:GetBucketAcl",
      "s3:GetBucketCORS",
      "s3:GetBucketLocation",
      "s3:GetBucketLogging",
      "s3:GetBucketNotification",
      "s3:GetBucketPolicy",
      "s3:GetBucketRequestPayment",
      "s3:GetBucketTagging",
      "s3:GetBucketVersioning",
      "s3:GetBucketWebsite",
      "s3:GetLifecycleConfiguration",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:GetObjectTorrent",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionTorrent",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:ListBucketVersions",
      "s3:ListMultipartUploadParts",
      "s3:PutObject",
      "s3:PutObjectAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectVersionTagging",
    ]

    resources = [
      "${aws_s3_bucket.video_assets_bucket.arn}/ingest/*",
    ]
  }
}

data "aws_iam_policy_document" "s3_raw_and_thumbnails_dir_putonly_policy" {
  statement {
    effect = "Allow"

    actions = [
      "s3:PutObject",
      "s3:PutObjectAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectVersionTagging",
    ]

    resources = [
      "${aws_s3_bucket.video_assets_bucket.arn}/raw/*",
      "${aws_s3_bucket.video_assets_bucket.arn}/thumbnails/*",
    ]
  }
}

data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    effect = "Allow"

    actions = [
      "sts:AssumeRole",
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${var.environment}-${var.service_name}-service-role",
        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${var.environment}-${var.service_name}-task-role",
        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/${var.environment}-${var.service_name}-user",
      ]
    }
  }
}

data "aws_iam_policy_document" "ows_video_browser_upload_assume_role_policy_document" {
  statement {
    effect = "Allow"

    actions = [
      "sts:AssumeRole",
    ]

    resources = [
      aws_iam_role.ows_video_browser_upload_role.arn,
    ]
  }
}

data "aws_iam_policy_document" "s3_video_dashboard_item_policy_document" {
  statement {
    effect = "Allow"

    actions = [
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:PutObject",
    ]

    resources = [
      "${aws_s3_bucket.video_assets_bucket.arn}/video_dashboard_item/*",
    ]
  }
}

data "aws_iam_policy_document" "s3_list_bucket_policy" {
  statement {
    effect = "Allow"

    actions = [
      "s3:ListBucket",
    ]

    resources = [
      aws_s3_bucket.video_assets_bucket.arn,
    ]
  }
}

# S3 bucket setup.

# Browser upload role setup
resource "aws_iam_role" "ows_video_browser_upload_role" {
  name                 = "${var.environment}-ows-video-browser-upload-role"
  max_session_duration = 43200
  assume_role_policy   = data.aws_iam_policy_document.assume_role_policy.json
}

resource "aws_iam_role_policy_attachment" "ows_video_browser_upload_policy_attachment" {
  role       = aws_iam_role.ows_video_browser_upload_role.id
  policy_arn = aws_iam_policy.s3_raw_and_thumbnails_dir_putonly_policy.arn
}

resource "aws_iam_policy" "ows_video_browser_upload_assume_role_policy" {
  name   = "${var.environment}-ows-video-browser-upload-assume-role-policy"
  policy = data.aws_iam_policy_document.ows_video_browser_upload_assume_role_policy_document.json
}

resource "aws_iam_policy" "s3_raw_dir_readonly_policy" {
  name   = "S3-${aws_s3_bucket.video_assets_bucket.id}-raw-RO"
  policy = data.aws_iam_policy_document.s3_raw_dir_readonly_policy.json
}

resource "aws_iam_policy" "s3_raw_dir_putonly_policy" {
  name   = "S3-${aws_s3_bucket.video_assets_bucket.id}-raw-WO"
  policy = data.aws_iam_policy_document.s3_raw_dir_putonly_policy.json
}

resource "aws_iam_policy" "s3_raw_dir_rw_policy" {
  name   = "S3-${aws_s3_bucket.video_assets_bucket.id}-raw-RW"
  policy = data.aws_iam_policy_document.s3_raw_dir_rw_policy.json
}

resource "aws_iam_policy" "s3_mezzanine_dir_readonly_policy" {
  name   = "S3-${aws_s3_bucket.video_assets_bucket.id}-mezzanine-RO"
  policy = data.aws_iam_policy_document.s3_mezzanine_dir_readonly_policy.json
}

resource "aws_iam_policy" "s3_mezzanine_dir_putonly_policy" {
  name   = "S3-${aws_s3_bucket.video_assets_bucket.id}-mezzanine-WO"
  policy = data.aws_iam_policy_document.s3_mezzanine_dir_putonly_policy.json
}

resource "aws_iam_policy" "s3_mezzanine_dir_rw_policy" {
  name   = "S3-${aws_s3_bucket.video_assets_bucket.id}-mezzanine-RW"
  policy = data.aws_iam_policy_document.s3_mezzanine_dir_rw_policy.json
}

resource "aws_iam_policy" "s3_thumbnails_dir_readonly_policy" {
  name   = "S3-${aws_s3_bucket.video_assets_bucket.id}-thumbnails-RO"
  policy = data.aws_iam_policy_document.s3_thumbnails_dir_readonly_policy.json
}

resource "aws_iam_policy" "s3_thumbnails_dir_putonly_policy" {
  name   = "S3-${aws_s3_bucket.video_assets_bucket.id}-thumbnails-WO"
  policy = data.aws_iam_policy_document.s3_thumbnails_dir_putonly_policy.json
}

resource "aws_iam_policy" "s3_streamable_preview_dir_readonly_policy" {
  name   = "S3-${aws_s3_bucket.video_assets_bucket.id}-streamable-preview-RO"
  policy = data.aws_iam_policy_document.s3_streamable_preview_dir_readonly_policy.json
}

resource "aws_iam_policy" "s3_streamable_preview_dir_putonly_policy" {
  name   = "S3-${aws_s3_bucket.video_assets_bucket.id}-streamable-preview-WO"
  policy = data.aws_iam_policy_document.s3_streamable_preview_dir_putonly_policy.json
}

resource "aws_iam_policy" "s3_blank_dir_readonly_policy" {
  name   = "S3-${aws_s3_bucket.video_assets_bucket.id}-blank-RO"
  policy = data.aws_iam_policy_document.s3_blank_dir_readonly_policy.json
}

resource "aws_iam_policy" "s3_blank_dir_putonly_policy" {
  name   = "S3-${aws_s3_bucket.video_assets_bucket.id}-blank-WO"
  policy = data.aws_iam_policy_document.s3_blank_dir_putonly_policy.json
}

resource "aws_iam_policy" "s3_ingest_dir_rwd_policy" {
  name   = "S3-${aws_s3_bucket.video_assets_bucket.id}-ingest-RWD"
  policy = data.aws_iam_policy_document.s3_ingest_dir_rwd_policy.json
}

resource "aws_iam_policy" "s3_raw_and_thumbnails_dir_putonly_policy" {
  name   = "S3-${aws_s3_bucket.video_assets_bucket.id}-raw-and-thumbnails-WO"
  policy = data.aws_iam_policy_document.s3_raw_and_thumbnails_dir_putonly_policy.json
}

resource "aws_s3_bucket" "video_assets_bucket" {
  bucket = "${var.environment}-${var.video_assets_bucket_name}"
  acl    = "private"
  dynamic "cors_rule" {
    for_each = var.video_assets_bucket_cors
    content {
      # TF-UPGRADE-TODO: The automatic upgrade tool can't predict
      # which keys might be set in maps assigned here, so it has
      # produced a comprehensive set here. Consider simplifying
      # this after confirming which keys can be set in practice.

      allowed_headers = lookup(cors_rule.value, "allowed_headers", null)
      allowed_methods = cors_rule.value.allowed_methods
      allowed_origins = cors_rule.value.allowed_origins
      expose_headers  = lookup(cors_rule.value, "expose_headers", null)
      max_age_seconds = lookup(cors_rule.value, "max_age_seconds", null)
    }
  }
  acceleration_status = "Enabled"

  logging {
    target_bucket = var.logging_bucket
    target_prefix = "${var.environment}-${var.video_assets_bucket_name}"
  }
}

resource "aws_iam_policy" "s3_video_dashboard_item_policy" {
  name   = "S3-${aws_s3_bucket.video_assets_bucket.id}-video-dashboard-item"
  policy = data.aws_iam_policy_document.s3_video_dashboard_item_policy_document.json
}

resource "aws_iam_policy" "s3_list_bucket_policy" {
  name   = "S3-${aws_s3_bucket.video_assets_bucket.id}-list-bucket"
  policy = data.aws_iam_policy_document.s3_list_bucket_policy.json
}