# Region HA spec 1 §6: every box-evidence prefix is create-only and never
# deleted, and the Denies name those prefixes and nothing wider (a broad
# Deny on this bucket once broke every lease release). Each statement is
# checked whole: effect, principal, actions, condition and resources, so
# turning a Deny into an Allow, dropping an action or loosening the
# conditional-write condition fails here.

mock_provider "aws" {}

override_resource {
  target = aws_s3_bucket.deployment
  values = { arn = "arn:aws:s3:::dep" }
}

variables {
  deployment_bucket_name = "dep"
  data_bucket_name       = "data"
}

run "evidence_prefixes_are_create_only_and_never_deleted" {
  command = plan

  assert {
    condition = jsonencode([
      for s in jsondecode(aws_s3_bucket_policy.deployment_box_records.policy).Statement : s if s.Sid == "BoxRecordsAreCreateOnly"
      ]) == jsonencode([{
        Action = "s3:PutObject"
        Condition = {
          Bool = { "s3:ObjectCreationOperation" = "true" }
          Null = { "s3:if-none-match" = "true" }
        }
        Effect    = "Deny"
        Principal = "*"
        Resource = [
          "arn:aws:s3:::dep/control/boxes/*",
          "arn:aws:s3:::dep/control/box-volumes/*",
          "arn:aws:s3:::dep/control/box-enrollment/*",
          "arn:aws:s3:::dep/control/box-fences/*",
        ]
        Sid = "BoxRecordsAreCreateOnly"
    }])
    error_message = "BoxRecordsAreCreateOnly must Deny, to everyone, every PutObject without If-None-Match on exactly the four box-evidence prefixes"
  }

  assert {
    condition = jsonencode([
      for s in jsondecode(aws_s3_bucket_policy.deployment_box_records.policy).Statement : s if s.Sid == "BoxRecordsAreNeverDeleted"
      ]) == jsonencode([{
        Action    = ["s3:DeleteObject", "s3:DeleteObjectVersion"]
        Effect    = "Deny"
        Principal = "*"
        Resource = [
          "arn:aws:s3:::dep/control/boxes/*",
          "arn:aws:s3:::dep/control/box-volumes/*",
          "arn:aws:s3:::dep/control/box-enrollment/*",
          "arn:aws:s3:::dep/control/box-fences/*",
        ]
        Sid = "BoxRecordsAreNeverDeleted"
    }])
    error_message = "BoxRecordsAreNeverDeleted must Deny, to everyone, both delete actions on exactly the four box-evidence prefixes"
  }
}