# ---------------------------------------------------------------------------
# T6: host the advisor UI on S3 + CloudFront. The bucket is private; CloudFront
# reaches it via Origin Access Control. index.html is static and committed; the
# live endpoint is injected via a generated config.js so we never bake an
# ephemeral URL into the repo.
# ---------------------------------------------------------------------------

resource "aws_s3_bucket" "ui" {
  bucket_prefix = "${local.name}-ui-"
  force_destroy = true
  tags          = local.onprem_tag
}

resource "aws_cloudfront_origin_access_control" "ui" {
  name                              = "${local.name}-ui-oac"
  origin_access_control_origin_type = "s3"
  signing_behavior                  = "always"
  signing_protocol                  = "sigv4"
}

resource "aws_cloudfront_distribution" "ui" {
  enabled             = true
  default_root_object = "index.html"
  comment             = "${local.name} advisor UI"

  origin {
    domain_name              = aws_s3_bucket.ui.bucket_regional_domain_name
    origin_id                = "ui-s3"
    origin_access_control_id = aws_cloudfront_origin_access_control.ui.id
  }

  default_cache_behavior {
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    target_origin_id       = "ui-s3"
    viewer_protocol_policy = "redirect-to-https"
    forwarded_values {
      query_string = false
      cookies { forward = "none" }
    }
  }

  restrictions {
    geo_restriction { restriction_type = "none" }
  }

  viewer_certificate {
    cloudfront_default_certificate = true
  }

  tags = local.cloud_tag
}

resource "aws_s3_bucket_policy" "ui" {
  bucket = aws_s3_bucket.ui.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "cloudfront.amazonaws.com" }
      Action    = "s3:GetObject"
      Resource  = "${aws_s3_bucket.ui.arn}/*"
      Condition = { StringEquals = { "AWS:SourceArn" = aws_cloudfront_distribution.ui.arn } }
    }]
  })
}

resource "aws_s3_object" "index" {
  bucket       = aws_s3_bucket.ui.id
  key          = "index.html"
  source       = "${path.module}/../ui/index.html"
  etag         = filemd5("${path.module}/../ui/index.html")
  content_type = "text/html"
}

# Injected config: the endpoint the UI posts to. Defaults to the backend /demo
# round trip; set var.ui_gateway_url to point the browser at Fusion instead.
locals {
  ui_endpoint = var.ui_gateway_url != "" ? var.ui_gateway_url : "${trimsuffix(aws_apigatewayv2_stage.default.invoke_url, "/")}/demo"
}

resource "aws_s3_object" "config" {
  bucket       = aws_s3_bucket.ui.id
  key          = "config.js"
  content      = "window.DEMO_ENDPOINT = \"${local.ui_endpoint}\";\n"
  content_type = "application/javascript"
  etag         = md5(local.ui_endpoint)
}

output "ui_url" { value = "https://${aws_cloudfront_distribution.ui.domain_name}" }