data "oci_objectstorage_namespace" "relay" {
  compartment_id = local.tenancy_ocid
}

resource "oci_objectstorage_bucket" "address_lists" {
  compartment_id = local.compartment_id
  namespace      = data.oci_objectstorage_namespace.relay.namespace
  name           = "oci-l4-relay-address-lists"
  access_type    = "NoPublicAccess"
  storage_tier   = "Standard"
  versioning     = "Enabled"
  freeform_tags  = var.freeform_tags
}

resource "oci_objectstorage_object_lifecycle_policy" "address_lists" {
  namespace = data.oci_objectstorage_namespace.relay.namespace
  bucket    = oci_objectstorage_bucket.address_lists.name

  depends_on = [oci_identity_policy.address_list_lifecycle_service]

  rules {
    action      = "DELETE"
    is_enabled  = true
    name        = "delete-web-allow-versions-after-30-days"
    target      = "objects"
    time_amount = 30
    time_unit   = "DAYS"

    object_name_filter {
      inclusion_patterns = ["admission/v1/versions/*", "web-allow/v1/versions/*"]
    }
  }

  rules {
    action      = "DELETE"
    is_enabled  = true
    name        = "delete-smtp-deny-versions-after-30-days"
    target      = "objects"
    time_amount = 30
    time_unit   = "DAYS"

    object_name_filter {
      inclusion_patterns = ["smtp-deny/v1/versions/*"]
    }
  }

  rules {
    action      = "DELETE"
    is_enabled  = true
    name        = "delete-previous-smtp-deny-current-versions-after-30-days"
    target      = "previous-object-versions"
    time_amount = 30
    time_unit   = "DAYS"

    object_name_filter {
      inclusion_patterns = ["smtp-deny/v1/current.json.gz"]
    }
  }

  rules {
    action      = "DELETE"
    is_enabled  = true
    name        = "delete-previous-web-allow-current-versions-after-30-days"
    target      = "previous-object-versions"
    time_amount = 30
    time_unit   = "DAYS"

    object_name_filter {
      inclusion_patterns = ["admission/v1/current.json.gz", "web-allow/v1/current.json.gz"]
    }
  }

  rules {
    action      = "ABORT"
    is_enabled  = true
    name        = "abort-incomplete-admission-uploads"
    target      = "multipart-uploads"
    time_amount = 1
    time_unit   = "DAYS"
  }
}

resource "oci_identity_policy" "address_list_lifecycle_service" {
  compartment_id = local.tenancy_ocid
  name           = "oci-l4-relay-address-list-lifecycle"
  description    = "Allow the regional Object Storage service to enforce address-list retention"
  statements = [
    "Allow service objectstorage-${local.region} to manage object-family in compartment id ${local.compartment_id} where all {target.bucket.name = '${oci_objectstorage_bucket.address_lists.name}', any {request.permission = 'BUCKET_INSPECT', request.permission = 'BUCKET_READ', request.permission = 'OBJECT_INSPECT', request.permission = 'OBJECT_DELETE', request.permission = 'OBJECT_VERSION_DELETE'}}"
  ]
}

resource "oci_identity_dynamic_group" "address_list_readers" {
  compartment_id = local.tenancy_ocid
  name           = "oci-l4-relay-address-list-readers"
  description    = "OCI L4 relay instances authorized to read validated address lists"
  matching_rule  = "ALL {instance.compartment.id = '${local.compartment_id}', tag.${oci_identity_tag_namespace.relay.name}.${oci_identity_tag.address_list_reader.name}.value = 'enabled'}"
}

resource "oci_identity_policy" "address_list_readers" {
  compartment_id = local.tenancy_ocid
  name           = "oci-l4-relay-address-list-readers"
  description    = "Allow relay instances to read validated address-list objects"
  statements = [
    "Allow dynamic-group ${oci_identity_dynamic_group.address_list_readers.name} to read objects in compartment id ${local.compartment_id} where target.bucket.name = '${oci_objectstorage_bucket.address_lists.name}'"
  ]
}

resource "oci_identity_user" "admission_publisher" {
  count          = local.publisher_enabled ? 1 : 0
  compartment_id = local.tenancy_ocid
  name           = "oci-l4-relay-admission-publisher"
  description    = "In-cluster Tier R web allow publisher"
  email          = local.publisher_email
}

resource "oci_identity_group" "admission_publishers" {
  count          = local.publisher_enabled ? 1 : 0
  compartment_id = local.tenancy_ocid
  name           = "oci-l4-relay-admission-publishers"
  description    = "Principals allowed to publish Tier R web allow bundles"
}

resource "oci_identity_user_group_membership" "admission_publisher" {
  count    = local.publisher_enabled ? 1 : 0
  group_id = oci_identity_group.admission_publishers[0].id
  user_id  = oci_identity_user.admission_publisher[0].id
}

resource "oci_identity_api_key" "admission_publisher" {
  count     = local.publisher_enabled ? 1 : 0
  user_id   = oci_identity_user.admission_publisher[0].id
  key_value = local.publisher_api_public_key
}

resource "oci_identity_user_capabilities_management" "admission_publisher" {
  count                        = local.publisher_enabled ? 1 : 0
  user_id                      = oci_identity_user.admission_publisher[0].id
  can_use_api_keys             = true
  can_use_auth_tokens          = false
  can_use_console_password     = false
  can_use_customer_secret_keys = false
  can_use_smtp_credentials     = false
}

resource "oci_identity_policy" "admission_publisher" {
  count          = local.publisher_enabled ? 1 : 0
  compartment_id = local.tenancy_ocid
  name           = "oci-l4-relay-admission-publisher"
  description    = "Allow dual publication during the web allow prefix migration"
  statements = [
    "Allow group ${oci_identity_group.admission_publishers[0].name} to manage objects in compartment id ${local.compartment_id} where all {target.bucket.name = '${oci_objectstorage_bucket.address_lists.name}', target.object.name = 'admission/v1/versions/*', any {request.permission = 'OBJECT_CREATE', request.permission = 'OBJECT_INSPECT', request.permission = 'OBJECT_READ'}}",
    "Allow group ${oci_identity_group.admission_publishers[0].name} to manage objects in compartment id ${local.compartment_id} where all {target.bucket.name = '${oci_objectstorage_bucket.address_lists.name}', target.object.name = 'admission/v1/current.json.gz', any {request.permission = 'OBJECT_CREATE', request.permission = 'OBJECT_OVERWRITE', request.permission = 'OBJECT_INSPECT', request.permission = 'OBJECT_READ'}}",
    "Allow group ${oci_identity_group.admission_publishers[0].name} to manage objects in compartment id ${local.compartment_id} where all {target.bucket.name = '${oci_objectstorage_bucket.address_lists.name}', target.object.name = 'web-allow/v1/versions/*', any {request.permission = 'OBJECT_CREATE', request.permission = 'OBJECT_INSPECT', request.permission = 'OBJECT_READ'}}",
    "Allow group ${oci_identity_group.admission_publishers[0].name} to manage objects in compartment id ${local.compartment_id} where all {target.bucket.name = '${oci_objectstorage_bucket.address_lists.name}', target.object.name = 'web-allow/v1/current.json.gz', any {request.permission = 'OBJECT_CREATE', request.permission = 'OBJECT_OVERWRITE', request.permission = 'OBJECT_INSPECT', request.permission = 'OBJECT_READ'}}"
  ]
}

resource "oci_identity_user" "smtp_deny_publisher" {
  count          = local.smtp_deny_publisher_enabled ? 1 : 0
  compartment_id = local.tenancy_ocid
  name           = "oci-l4-relay-smtp-deny-publisher"
  description    = "In-cluster transport-evidence SMTP deny publisher"
  email          = local.smtp_deny_publisher_email
}

resource "oci_identity_group" "smtp_deny_publishers" {
  count          = local.smtp_deny_publisher_enabled ? 1 : 0
  compartment_id = local.tenancy_ocid
  name           = "oci-l4-relay-smtp-deny-publishers"
  description    = "Principals allowed to publish SMTP deny bundles"
}

resource "oci_identity_user_group_membership" "smtp_deny_publisher" {
  count    = local.smtp_deny_publisher_enabled ? 1 : 0
  group_id = oci_identity_group.smtp_deny_publishers[0].id
  user_id  = oci_identity_user.smtp_deny_publisher[0].id
}

resource "oci_identity_api_key" "smtp_deny_publisher" {
  count     = local.smtp_deny_publisher_enabled ? 1 : 0
  user_id   = oci_identity_user.smtp_deny_publisher[0].id
  key_value = local.smtp_deny_publisher_api_public_key
}

resource "oci_identity_user_capabilities_management" "smtp_deny_publisher" {
  count                        = local.smtp_deny_publisher_enabled ? 1 : 0
  user_id                      = oci_identity_user.smtp_deny_publisher[0].id
  can_use_api_keys             = true
  can_use_auth_tokens          = false
  can_use_console_password     = false
  can_use_customer_secret_keys = false
  can_use_smtp_credentials     = false
}

resource "oci_identity_policy" "smtp_deny_publisher" {
  count          = local.smtp_deny_publisher_enabled ? 1 : 0
  compartment_id = local.tenancy_ocid
  name           = "oci-l4-relay-smtp-deny-publisher"
  description    = "Allow immutable SMTP deny versions and current-bundle promotion"
  statements = [
    "Allow group ${oci_identity_group.smtp_deny_publishers[0].name} to manage objects in compartment id ${local.compartment_id} where all {target.bucket.name = '${oci_objectstorage_bucket.address_lists.name}', target.object.name = 'smtp-deny/v1/versions/*', any {request.permission = 'OBJECT_CREATE', request.permission = 'OBJECT_INSPECT', request.permission = 'OBJECT_READ'}}",
    "Allow group ${oci_identity_group.smtp_deny_publishers[0].name} to manage objects in compartment id ${local.compartment_id} where all {target.bucket.name = '${oci_objectstorage_bucket.address_lists.name}', target.object.name = '${var.smtp_deny_bundle_object}', any {request.permission = 'OBJECT_CREATE', request.permission = 'OBJECT_OVERWRITE', request.permission = 'OBJECT_INSPECT', request.permission = 'OBJECT_READ'}}"
  ]
}