mock_provider "aws" {}

override_resource {
  target = aws_s3_bucket.deployment
  values = { arn = "arn:aws:s3:::dep" }
}

variables {
  deployment_bucket_name = "dep"
  data_bucket_name       = "data"
}

run "only_exact_box_roles_create_fences" {
  command = plan
  variables {
    box_fence_writer_role_arns = ["arn:aws:iam::123456789012:role/box-worker"]
  }
  assert {
    condition = jsonencode([
      for s in jsondecode(aws_s3_bucket_policy.deployment_box_records.policy).Statement : s if s.Sid == "OnlyBoxRolesWriteTerminationFences"
      ]) == jsonencode([{
        Sid       = "OnlyBoxRolesWriteTerminationFences"
        Effect    = "Deny"
        Principal = "*"
        Action    = "s3:PutObject"
        Resource  = "arn:aws:s3:::dep/control/box-fences/*"
        Condition = { ArnNotEquals = { "aws:PrincipalArn" = ["arn:aws:iam::123456789012:role/box-worker"] } }
    }])
    error_message = "Only exact approved box roles may create termination fences."
  }
}

run "empty_box_role_inventory_denies_everyone" {
  command = plan
  assert {
    condition = jsonencode([
      for s in jsondecode(aws_s3_bucket_policy.deployment_box_records.policy).Statement : s.Condition.ArnNotEquals["aws:PrincipalArn"] if s.Sid == "OnlyBoxRolesWriteTerminationFences"
    ]) == jsonencode([["arn:aws:iam::000000000000:role/nobody"]])
    error_message = "An empty box-role inventory must grant no fence writer."
  }
}

run "wildcard_writer_roles_are_refused" {
  command = plan
  variables {
    box_fence_writer_role_arns = ["arn:aws:iam::123456789012:role/*"]
  }
  expect_failures = [var.box_fence_writer_role_arns]
}