"""Canonical frontend Terraform ownership and import-ID maps.

Only ``dev`` has a Terraform root in this repository. The ``staging`` constants
are kept so the checker can prove that a dev plan carrying a staging identifier
is rejected; they do not authorize a staging import.
"""

COMMON_RESOURCES = {
    "module.environment_owned.aws_s3_bucket.site": "aws_s3_bucket",
    "module.environment_owned.aws_s3_bucket_public_access_block.site": (
        "aws_s3_bucket_public_access_block"
    ),
    "module.environment_owned.aws_s3_bucket_ownership_controls.site": (
        "aws_s3_bucket_ownership_controls"
    ),
    "module.environment_owned.aws_s3_bucket_server_side_encryption_configuration.site": (
        "aws_s3_bucket_server_side_encryption_configuration"
    ),
    "module.environment_owned.aws_s3_bucket_versioning.site": "aws_s3_bucket_versioning",
    "module.environment_owned.aws_s3_bucket_policy.site": "aws_s3_bucket_policy",
    "module.environment_owned.aws_cloudfront_distribution.site": (
        "aws_cloudfront_distribution"
    ),
    "module.environment_owned.aws_cloudfront_origin_access_control.site": (
        "aws_cloudfront_origin_access_control"
    ),
    "module.environment_owned.aws_cloudfront_function.spa_rewrite": (
        "aws_cloudfront_function"
    ),
    "module.environment_owned.aws_route53_record.site_a": "aws_route53_record",
    "module.environment_owned.aws_route53_record.site_aaaa": "aws_route53_record",
    "module.environment_owned.aws_iam_role.github_deploy": "aws_iam_role",
    "module.environment_owned.aws_iam_role_policy.github_deploy": "aws_iam_role_policy",
}

REQUIRED_RESOURCES = {
    environment: dict(COMMON_RESOURCES)
    for environment in ("dev", "staging")
}

CONTROLLED_UPDATE_ADDRESSES = frozenset(
    {
        "module.environment_owned.aws_s3_bucket.site",
        "module.environment_owned.aws_s3_bucket_policy.site",
        "module.environment_owned.aws_cloudfront_distribution.site",
        "module.environment_owned.aws_cloudfront_function.spa_rewrite",
        "module.environment_owned.aws_iam_role.github_deploy",
    }
)

ENVIRONMENT_CONFIG = {
    "dev": {
        "bucket_name": "seahaven-shoc-frontend-dev",
        "bucket_auto_delete_helper_role_arn": (
            "arn:aws:iam::396287094661:role/"
            "shoc-frontend-dev-CustomS3AutoDeleteObjectsCustomRe-dmSDIY8EH7KV"
        ),
        "cloudformation_stack_name": "shoc-frontend-dev",
        "distribution_id": "E2CWLM1AFB964P",
        "workspace_name": "shoc-frontend-new-dev",
    },
    "staging": {
        "bucket_name": "seahaven-shoc-frontend-staging",
        "bucket_auto_delete_helper_role_arn": (
            "arn:aws:iam::396287094661:role/"
            "shoc-frontend-staging-CustomS3AutoDeleteObjectsCust-QbMDqZbl7YQ3"
        ),
        "cloudformation_stack_name": "shoc-frontend-staging",
        "distribution_id": "E2JDVEZ6EGD49J",
        "workspace_name": "shoc-frontend-new-staging",
    },
}


def _bucket_imports(bucket_name: str) -> dict[str, str]:
    return {
        address: bucket_name
        for address in COMMON_RESOURCES
        if address.startswith("module.environment_owned.aws_s3_bucket")
    }


REQUIRED_IMPORT_IDS: dict[str, dict[str, str | None]] = {
    "dev": {
        **_bucket_imports("seahaven-shoc-frontend-dev"),
        "module.environment_owned.aws_cloudfront_distribution.site": "E2CWLM1AFB964P",
        "module.environment_owned.aws_cloudfront_origin_access_control.site": (
            "E30VSIK87N8H64"
        ),
        "module.environment_owned.aws_cloudfront_function.spa_rewrite": (
            "us-east-1shocfrontenddevSpaRewrite58674DB8"
        ),
        "module.environment_owned.aws_route53_record.site_a": (
            "Z07671212N75U4YLPWZR8_dev.seahaven.com_A"
        ),
        "module.environment_owned.aws_route53_record.site_aaaa": (
            "Z07671212N75U4YLPWZR8_dev.seahaven.com_AAAA"
        ),
        "module.environment_owned.aws_iam_role.github_deploy": (
            "githubdeploy-shoc-frontend-new-dev"
        ),
        "module.environment_owned.aws_iam_role_policy.github_deploy": (
            "githubdeploy-shoc-frontend-new-dev:"
            "GithubDeployRoleDefaultPolicyE8F540D1"
        ),
    },
    "staging": {
        **_bucket_imports("seahaven-shoc-frontend-staging"),
        "module.environment_owned.aws_cloudfront_distribution.site": "E2JDVEZ6EGD49J",
        "module.environment_owned.aws_cloudfront_origin_access_control.site": (
            "E1PF5R6QQNBZAI"
        ),
        "module.environment_owned.aws_cloudfront_function.spa_rewrite": (
            "us-east-1shocfrontendstagingSpaRewriteE9C0CBDA"
        ),
        "module.environment_owned.aws_route53_record.site_a": (
            "Z02602739VQWBWCAGXP4_staging.seahaven.com_A"
        ),
        "module.environment_owned.aws_route53_record.site_aaaa": (
            "Z02602739VQWBWCAGXP4_staging.seahaven.com_AAAA"
        ),
        "module.environment_owned.aws_iam_role.github_deploy": (
            "githubdeploy-shoc-frontend-new-staging"
        ),
        "module.environment_owned.aws_iam_role_policy.github_deploy": (
            "githubdeploy-shoc-frontend-new-staging:"
            "GithubDeployRoleDefaultPolicyE8F540D1"
        ),
    },
}