# Plan-time tests for the scanning grant. mock_provider means no AWS account
# and no credentials: these assert what the module WOULD create.
mock_provider "aws" {}

override_data {
  target = data.aws_vpcs.default
  values = { ids = ["vpc-0aaaaaaaaaaaaaaaa"] }
}

# The termination queue's ARN feeds an EventBridge target, which the provider
# validates as an ARN; the mock's random string is not one.
override_resource {
  target = aws_sqs_queue.terminations
  values = { arn = "arn:aws:sqs:eu-west-1:123456789012:carlos-test-host-terminations" }
}

variables {
  name                  = "carlos-test-ie"
  sg_description        = "carlos test host"
  iam_name              = "carlos-test-host"
  instance_type         = "t4g.small"
  root_volume_size      = 20
  user_data             = "#!/bin/sh\n"
  deployment_bucket_arn = "arn:aws:s3:::carlos-test-platform"
  data_bucket_arn       = "arn:aws:s3:::carlos-test-ie"
  ssm_parameter_arn     = "arn:aws:ssm:eu-west-1:123456789012:parameter/carlos/*"
  store_bucket_prefix   = "carlos-store-test-"
}

run "off_by_default" {
  command = plan
  assert {
    condition     = length(aws_iam_role_policy.host_store_scan) == 0
    error_message = "store_scanning defaults to false and must create nothing"
  }
}

run "on_grants_exactly_read_and_tag" {
  command = plan
  variables {
    store_scanning = true
  }
  assert {
    condition     = length(aws_iam_role_policy.host_store_scan) == 1
    error_message = "store_scanning = true must create the scan policy"
  }
  assert {
    condition     = aws_iam_role_policy.host_store_scan[0].name == "carlos-test-host-store-scan"
    error_message = "the policy is named <iam_name>-store-scan"
  }
  assert {
    condition = toset(jsondecode(aws_iam_role_policy.host_store_scan[0].policy).Statement[0].Action) == toset([
      "s3:GetObject", "s3:GetObjectTagging", "s3:PutObjectTagging",
    ])
    error_message = "exactly the three actions the scanner calls, no more"
  }
  assert {
    condition     = jsondecode(aws_iam_role_policy.host_store_scan[0].policy).Statement[0].Resource == "arn:aws:s3:::carlos-store-test-*/*"
    error_message = "scoped to objects under the store prefix"
  }
}

run "refused_without_a_store_prefix" {
  command = plan
  variables {
    store_scanning      = true
    store_bucket_prefix = ""
  }
  expect_failures = [aws_iam_role_policy.host_store_scan]
}