ephemeral "vault_kv_secret_v2" "project_delivery_cache_reader" {
  mount = "secret"
  name  = var.project_delivery_cache_reader_vault_secret_path
}

ephemeral "vault_kv_secret_v2" "project_delivery_cache_writer" {
  mount = "secret"
  name  = var.project_delivery_cache_writer_vault_secret_path
}

resource "versitygw_user" "project_delivery_cache_reader" {
  access_key_id     = var.project_delivery_cache_reader_principal
  secret_access_key = ephemeral.vault_kv_secret_v2.project_delivery_cache_reader.data["secretAccessKey"]
  role              = "user"
}

resource "versitygw_user" "project_delivery_cache_writer" {
  access_key_id     = var.project_delivery_cache_writer_principal
  secret_access_key = ephemeral.vault_kv_secret_v2.project_delivery_cache_writer.data["secretAccessKey"]
  role              = "user"
}

resource "minio_s3_bucket" "project_delivery" {
  bucket = var.project_delivery_cache_bucket_name
}

resource "minio_s3_bucket_policy" "project_delivery" {
  bucket = minio_s3_bucket.project_delivery.bucket

  depends_on = [
    versitygw_user.project_delivery_cache_reader,
    versitygw_user.project_delivery_cache_writer,
  ]

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "ProjectDeliveryCacheLocation"
        Effect    = "Allow"
        Principal = [var.project_delivery_cache_reader_principal, var.project_delivery_cache_writer_principal]
        Action    = ["s3:GetBucketLocation"]
        Resource  = ["arn:aws:s3:::${var.project_delivery_cache_bucket_name}"]
      },
      {
        Sid       = "ProjectDeliveryCacheList"
        Effect    = "Allow"
        Principal = [var.project_delivery_cache_reader_principal, var.project_delivery_cache_writer_principal]
        Action = [
          "s3:ListBucket",
        ]
        Resource = ["arn:aws:s3:::${var.project_delivery_cache_bucket_name}"]
        Condition = {
          StringLike = {
            "s3:prefix" = ["projects/*"]
          }
        }
      },
      {
        Sid       = "ProjectDeliveryCacheRead"
        Effect    = "Allow"
        Principal = [var.project_delivery_cache_reader_principal, var.project_delivery_cache_writer_principal]
        Action    = ["s3:GetObject"]
        Resource  = ["arn:aws:s3:::${var.project_delivery_cache_bucket_name}/projects/*"]
      },
      {
        Sid       = "ProjectDeliveryCacheWrite"
        Effect    = "Allow"
        Principal = var.project_delivery_cache_writer_principal
        Action    = ["s3:PutObject"]
        Resource  = ["arn:aws:s3:::${var.project_delivery_cache_bucket_name}/projects/*"]
      },
      {
        Sid       = "ProjectDeliveryCachePrune"
        Effect    = "Allow"
        Principal = var.project_delivery_cache_writer_principal
        Action    = ["s3:DeleteObject"]
        Resource  = ["arn:aws:s3:::${var.project_delivery_cache_bucket_name}/projects/*/*/cache/*/objects/*"]
      },
    ]
  })
}