"""CDK stack for the Coupa PO email ingestion pipeline."""

import aws_cdk as cdk
from aws_cdk import (
    Duration,
    RemovalPolicy,
    Stack,
    aws_dynamodb as dynamodb,
    aws_lambda as lambda_,
    aws_s3 as s3,
    aws_s3_notifications as s3n,
    aws_ses as ses,
    aws_ses_actions as ses_actions,
    aws_secretsmanager as secretsmanager,
    aws_iam as iam,
)
from constructs import Construct


class PoIngestStack(Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs):
        super().__init__(scope, construct_id, **kwargs)

        # --- S3 bucket for raw emails ---
        email_bucket = s3.Bucket(
            self, "EmailBucket",
            bucket_name=f"po-ingest-emails-{self.account}",
            removal_policy=RemovalPolicy.RETAIN,
            lifecycle_rules=[
                s3.LifecycleRule(expiration=Duration.days(90)),
            ],
        )

        # --- Reference existing purchase-orders DynamoDB table ---
        # This table is shared with LedgerFlow (DynamoDB Streams → po-sync).
        # We write to it; LedgerFlow reads from it.
        po_table = dynamodb.Table.from_table_name(
            self, "PurchaseOrdersTable", "purchase-orders",
        )

        # --- Secrets Manager for Anthropic API key ---
        anthropic_secret = secretsmanager.Secret(
            self, "AnthropicApiKey",
            secret_name="po-ingest/anthropic-api-key",
            description="Anthropic API key for Coupa PO email parsing",
        )

        # --- Lambda function ---
        email_processor = lambda_.Function(
            self, "EmailProcessor",
            function_name="po-email-processor",
            runtime=lambda_.Runtime.PYTHON_3_12,
            handler="handler.handler",
            code=lambda_.Code.from_asset("../lambdas/email_processor/package"),
            timeout=Duration.seconds(60),
            memory_size=256,
            environment={
                "PO_TABLE": "purchase-orders",
                "ANTHROPIC_API_KEY_SECRET_ARN": anthropic_secret.secret_arn,
            },
        )

        # Grant permissions
        email_bucket.grant_read(email_processor)
        po_table.grant_read_write_data(email_processor)
        anthropic_secret.grant_read(email_processor)

        # S3 event notification → Lambda
        email_bucket.add_event_notification(
            s3.EventType.OBJECT_CREATED,
            s3n.LambdaDestination(email_processor),
            s3.NotificationKeyFilter(prefix="inbound/"),
        )

        # --- SES Receipt Rule ---
        # Reuse the existing INBOUND_MAIL rule set (shared with workorder-ingest)
        rule_set = ses.ReceiptRuleSet.from_receipt_rule_set_name(
            self, "ExistingRuleSet", "INBOUND_MAIL",
        )

        rule_set.add_rule(
            "PoEmailRule",
            recipients=["amazon_po@int.seahaven.com"],
            actions=[
                ses_actions.S3(
                    bucket=email_bucket,
                    object_key_prefix="inbound/",
                ),
            ],
        )

        # --- Web UI Lambda ---
        web_ui = lambda_.Function(
            self, "WebUI",
            function_name="po-web-ui",
            runtime=lambda_.Runtime.PYTHON_3_12,
            handler="handler.handler",
            code=lambda_.Code.from_asset("../lambdas/web_ui"),
            timeout=Duration.seconds(60),
            memory_size=256,
            environment={
                "PO_TABLE": "purchase-orders",
            },
        )

        po_table.grant_read_data(web_ui)

        # Function URL for direct access
        web_url = web_ui.add_function_url(
            auth_type=lambda_.FunctionUrlAuthType.NONE,
        )

        cdk.CfnOutput(self, "WebUIUrl", value=web_url.url, description="PO Dashboard URL")