data "aws_iam_policy_document" "github_deploy_assume" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    principals {
      type        = "Federated"
      identifiers = [data.aws_iam_openid_connect_provider.github.arn]
    }

    condition {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringLike"
      variable = "token.actions.githubusercontent.com:sub"
      values   = ["repo:${var.github_repo}:ref:refs/heads/${var.github_deploy_branch}"]
    }
  }
}

resource "aws_iam_role" "github_deploy" {
  name                 = local.deploy_role
  path                 = "/tf-managed/"
  description          = "GitHub Actions content-deploy role for ${var.github_repo}@${var.github_deploy_branch}"
  assume_role_policy   = data.aws_iam_policy_document.github_deploy_assume.json
  max_session_duration = 3600

  # Not a Lambda execution role. Config omits permissions_boundary so a later
  # apply will not PutRolePermissionsBoundary the Lambda ceiling back. Live still
  # has seahaven-lambda-execution-boundary; omitting without ignore_changes would
  # plan DeleteRolePermissionsBoundary, which hcptf-seahaven-site is denied
  # (DenyBoundaryTampering). Ignore the attribute so this apply does not touch
  # the ceiling. An administrator deletes the live attachment, then a follow-up
  # drops this lifecycle after refresh-only updates state to null.
  lifecycle {
    ignore_changes = [permissions_boundary]
  }
}

data "aws_iam_policy_document" "github_deploy" {
  statement {
    sid    = "OriginBucketObjects"
    effect = "Allow"
    actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject",
      "s3:GetObjectTagging",
      "s3:PutObjectTagging",
    ]
    resources = ["${aws_s3_bucket.origin.arn}/*"]
  }

  statement {
    sid    = "OriginBucketList"
    effect = "Allow"
    actions = [
      "s3:ListBucket",
      "s3:GetBucketLocation",
    ]
    resources = [aws_s3_bucket.origin.arn]
  }

  statement {
    sid    = "InvalidateDistribution"
    effect = "Allow"
    actions = [
      "cloudfront:CreateInvalidation",
      "cloudfront:GetInvalidation",
    ]
    resources = [aws_cloudfront_distribution.site.arn]
  }
}

resource "aws_iam_role_policy" "github_deploy" {
  name   = "seahaven-site-content-deploy"
  role   = aws_iam_role.github_deploy.id
  policy = data.aws_iam_policy_document.github_deploy.json
}