# Plan-time tests for the console mail grant. mock_provider means no AWS account
# and no credentials: these assert what the module WOULD create.
mock_provider "aws" {}

override_data {
  target = data.aws_vpcs.default
  values = { ids = ["vpc-0aaaaaaaaaaaaaaaa"] }
}

override_data {
  target = data.aws_caller_identity.current
  values = { account_id = "123456789012" }
}

# The termination queue's ARN feeds an EventBridge target, which the provider
# validates as an ARN; the mock's random string is not one.
override_resource {
  target = aws_sqs_queue.terminations
  values = { arn = "arn:aws:sqs:eu-west-1:123456789012:carlos-test-host-terminations" }
}

variables {
  name                  = "carlos-test-ie"
  sg_description        = "carlos test host"
  iam_name              = "carlos-test-host"
  instance_type         = "t4g.small"
  root_volume_size      = 20
  user_data             = "#!/bin/sh\n"
  deployment_bucket_arn = "arn:aws:s3:::carlos-test-platform"
  data_bucket_arn       = "arn:aws:s3:::carlos-test-ie"
  ssm_parameter_arn     = "arn:aws:ssm:eu-west-1:123456789012:parameter/carlos/*"
}

run "off_by_default" {
  command = plan
  assert {
    condition     = length(aws_iam_role_policy.host_console_mail) == 0
    error_message = "console_mail_from empty must create no policy"
  }
}

run "from_and_region_set_creates_policy" {
  command = plan
  variables {
    console_mail_from   = "noreply@console-mail.bab.example.com"
    console_mail_region = "eu-west-1"
  }
  assert {
    condition     = length(aws_iam_role_policy.host_console_mail) == 1
    error_message = "From + region set must create one policy"
  }
  assert {
    condition     = aws_iam_role_policy.host_console_mail[0].name == "carlos-test-host-console-mail"
    error_message = "the policy is named <iam_name>-console-mail"
  }
  assert {
    condition = toset(jsondecode(aws_iam_role_policy.host_console_mail[0].policy).Statement[0].Action) == toset([
      "ses:SendEmail",
    ])
    error_message = "the only action is ses:SendEmail"
  }
  assert {
    condition = contains(
      jsondecode(aws_iam_role_policy.host_console_mail[0].policy).Statement[0].Resource,
      "arn:aws:ses:eu-west-1:123456789012:identity/console-mail.bab.example.com"
    )
    error_message = "must contain identity ARN with domain extracted from From address"
  }
  assert {
    condition = contains(
      jsondecode(aws_iam_role_policy.host_console_mail[0].policy).Statement[0].Resource,
      "arn:aws:ses:eu-west-1:123456789012:configuration-set/carlos-bab"
    )
    error_message = "must contain configuration-set/carlos-bab ARN"
  }
  assert {
    condition = contains(
      jsondecode(aws_iam_role_policy.host_console_mail[0].policy).Statement[0].Resource,
      "arn:aws:ses:eu-west-1:123456789012:tenant/carlos-bab/*"
    )
    error_message = "must contain tenant/carlos-bab/* ARN"
  }
  assert {
    condition     = jsondecode(aws_iam_role_policy.host_console_mail[0].policy).Statement[0].Condition.StringEquals["ses:FromAddress"] == "noreply@console-mail.bab.example.com"
    error_message = "must have ses:FromAddress condition matching the From address"
  }
}

run "from_set_without_region_fails_precondition" {
  command = plan
  variables {
    console_mail_from   = "noreply@console-mail.bab.example.com"
    console_mail_region = ""
  }
  expect_failures = [aws_iam_role_policy.host_console_mail]
}

run "uppercase_from_fails_validation" {
  command = plan
  variables {
    console_mail_from   = "noreply@console-mail.bab.EXAMPLE.COM"
    console_mail_region = "eu-west-1"
  }
  expect_failures = [var.console_mail_from]
}