# ---------------------------------------------------------------------------
# Custom domain for the Fusion-facing API. Fusion couldn't resolve the default
# *.execute-api.amazonaws.com hostname, so we front the same HTTP API with a
# stable name in a zone we control and point it with a Route53 ALIAS (A record).
# Callers resolve hncb-deid.apim-apac-demo.com -> IPs directly; they never have to
# resolve an execute-api / amazonaws.com name. Also survives API-id churn.
# ---------------------------------------------------------------------------

locals {
  api_fqdn = "hncb-deid.apim-apac-demo.com"
}

data "aws_route53_zone" "api" {
  name         = "apim-apac-demo.com"
  private_zone = false
}

# Regional API Gateway custom domains need the ACM cert in the SAME region.
resource "aws_acm_certificate" "api" {
  domain_name       = local.api_fqdn
  validation_method = "DNS"
  tags              = local.onprem_tag
  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_route53_record" "api_cert_validation" {
  for_each = {
    for dvo in aws_acm_certificate.api.domain_validation_options : dvo.domain_name => {
      name   = dvo.resource_record_name
      type   = dvo.resource_record_type
      record = dvo.resource_record_value
    }
  }
  zone_id         = data.aws_route53_zone.api.zone_id
  name            = each.value.name
  type            = each.value.type
  records         = [each.value.record]
  ttl             = 60
  allow_overwrite = true
}

resource "aws_acm_certificate_validation" "api" {
  certificate_arn         = aws_acm_certificate.api.arn
  validation_record_fqdns = [for r in aws_route53_record.api_cert_validation : r.fqdn]
}

resource "aws_apigatewayv2_domain_name" "api" {
  domain_name = local.api_fqdn
  domain_name_configuration {
    certificate_arn = aws_acm_certificate_validation.api.certificate_arn
    endpoint_type   = "REGIONAL"
    security_policy = "TLS_1_2"
  }
  tags = local.onprem_tag
}

# Map the custom domain at the root to the $default stage (routes: /tokenize, etc.)
resource "aws_apigatewayv2_api_mapping" "api" {
  api_id      = aws_apigatewayv2_api.gateway.id
  domain_name = aws_apigatewayv2_domain_name.api.id
  stage       = aws_apigatewayv2_stage.default.id
}

# ALIAS (IPv4) -> returns IPs directly, so Fusion never resolves an AWS hostname.
resource "aws_route53_record" "api_alias" {
  zone_id = data.aws_route53_zone.api.zone_id
  name    = local.api_fqdn
  type    = "A"
  alias {
    name                   = aws_apigatewayv2_domain_name.api.domain_name_configuration[0].target_domain_name
    zone_id                = aws_apigatewayv2_domain_name.api.domain_name_configuration[0].hosted_zone_id
    evaluate_target_health = false
  }
}

output "tokenize_url_custom" { value = "https://${local.api_fqdn}/tokenize" }
output "restore_url_custom" { value = "https://${local.api_fqdn}/restore" }
output "demo_url_custom" { value = "https://${local.api_fqdn}/demo" }