locals {
  project     = "payments-dashboard"
  is_prod     = var.environment == "prod"
  account_id  = local.is_prod ? "011934824531" : "710827005802"
  environment = var.environment

  hcp_project   = "seahaven-${var.environment}"
  hcp_workspace = "${local.project}-${var.environment}"
  deploy_role   = "githubdeploy-payments-dashboard"
  # Owned by org-baseline stack seahaven-hcptf. This configuration only references it.
  lambda_boundary_arn = "arn:aws:iam::${local.account_id}:policy/tf-managed/payments-dashboard-lambda-boundary"

  artifacts_bucket_name = "payments-dashboard-artifacts-${local.account_id}"
  csv_bucket_name       = "seahaven-payments-csv-${local.account_id}"
  boa_raw_bucket_name   = "seahaven-payments-boa-raw-${local.account_id}"
  ssm_prefix            = "/payments-dashboard"
  table_name            = "PaymentsDashboard"
  site_alerts_arn       = "arn:aws:sns:${var.aws_region}:${local.account_id}:site-alerts"
  dynamodb_cmk_ssm      = "/seahaven/dynamodb/cmk-arn"

  github_oidc_provider_arn = "arn:aws:iam::${local.account_id}:oidc-provider/token.actions.githubusercontent.com"
  # Repo OIDC subject customization is the default (use_default=true), so tokens
  # use the classic repo:owner/name:environment:<env> form. Each account's role
  # trusts only its own Environment. The prod role must not trust dev.
  github_oidc_subs_prod = [
    "repo:${var.github_repo}:environment:prod",
  ]
  github_oidc_subs_dev = [
    "repo:${var.github_repo}:environment:dev",
  ]
  github_oidc_subs = local.is_prod ? local.github_oidc_subs_prod : local.github_oidc_subs_dev
  # Matches the SHA pin in .github/workflows/deploy.yaml. A reusable bump
  # updates both together. StringEquals, not @*.
  github_deploy_workflow_ref = "Sea-Haven-Industries/.github/.github/workflows/cd-hcp-lambda.yaml@ee5b843ca105422b679c3fdeb9eaa68c6e500a85"

  dynamodb_cmk_arns = {
    prod = "arn:aws:kms:us-east-1:011934824531:key/be5fa4cb-c546-40fe-a13d-c7bec79f5d12"
    dev  = "arn:aws:kms:us-east-1:710827005802:key/600997e6-418e-4b7f-9d63-cd42a7505a95"
  }
  dynamodb_cmk_arn = local.dynamodb_cmk_arns[var.environment]

  # Exact ARNs (ticket rule). Dev values are shells created for this workspace.
  # They are not prod secrets.
  secret_arns_by_env = {
    prod = {
      "payments-dashboard/slack-bot-token"              = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/slack-bot-token-0pAM3S"
      "payments-dashboard/slack-signing-secret"         = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/slack-signing-secret-u0T6h8"
      "payments-dashboard/boa-check-mgmt"               = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/boa-check-mgmt-LEbC65"
      "payments-dashboard/boa-reporting"                = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/boa-reporting-JoR9lq"
      "payments-dashboard/expense-slack-token"          = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/expense-slack-token-SeMg3s"
      "payments-dashboard/expense-slack-signing-secret" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/expense-slack-signing-secret-lbb78J"
    }
    dev = {
      "payments-dashboard/slack-bot-token"              = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/slack-bot-token-KhPaLp"
      "payments-dashboard/slack-signing-secret"         = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/slack-signing-secret-CDxsUK"
      "payments-dashboard/boa-check-mgmt"               = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/boa-check-mgmt-kkEnCw"
      "payments-dashboard/boa-reporting"                = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/boa-reporting-uMHHVo"
      "payments-dashboard/expense-slack-token"          = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/expense-slack-token-05OZg3"
      "payments-dashboard/expense-slack-signing-secret" = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/expense-slack-signing-secret-DQAoXS"
    }
  }
  secret_arns = local.secret_arns_by_env[var.environment]

  functions = {
    process_csv = {
      function_name = "payments-processPaymentCsv"
      role_name     = "payments-dashboard-process-csv"
      handler       = "src/processPaymentCsv.handler"
      timeout       = 120
      duration_ms   = 96000
      vpc           = true
    }
    slack_app_home = {
      function_name = "payments-slackAppHome"
      role_name     = "payments-dashboard-slack-app-home"
      handler       = "src/slackAppHome.handler"
      timeout       = 30
      duration_ms   = 24000
      vpc           = true
    }
    fetch_boa = {
      function_name = "payments-fetchBoaTransactions"
      role_name     = "payments-dashboard-fetch-boa"
      handler       = "src/fetchBoaTransactions.handler"
      timeout       = 60
      duration_ms   = 48000
      vpc           = true
    }
    expense_receiver = {
      function_name = "payments-expenseReceiver"
      role_name     = "payments-dashboard-expense-receiver"
      handler       = "src/expenseReceiver.handler"
      timeout       = 5
      duration_ms   = 4000
      vpc           = false
    }
    expense_processor = {
      function_name = "payments-expenseProcessor"
      role_name     = "payments-dashboard-expense-processor"
      handler       = "src/expenseProcessor.handler"
      timeout       = 15
      duration_ms   = 12000
      vpc           = false
    }
  }
}