resource "aws_security_group" "apigw-vpclink" {
  name        = "o11y-${var.env}-${var.logical_region_name}-apigw-vpclink"
  description = "Security group for API Gateway VPC Link to access NLB"
  vpc_id      = module.vpc.vpc_id

  tags = merge({
    tidbcloud-auto-deploy-owner = local.eks.name
  }, var.tags)
}

# API Gateway VPC Link ENIs initiate outbound traffic to private ALB/NLB backends.
# Keep this scoped to the shoot VPC CIDR to avoid broad egress while preventing 5xx timeouts.
resource "aws_vpc_security_group_egress_rule" "apigw_vpclink_http_to_vpc" {
  security_group_id = aws_security_group.apigw-vpclink.id
  ip_protocol       = "tcp"
  from_port         = 80
  to_port           = 80
  cidr_ipv4         = var.vpc.cidr
  description       = "Allow API Gateway VPC link to reach internal HTTP backends in VPC"
}

resource "aws_vpc_security_group_egress_rule" "apigw_vpclink_https_to_vpc" {
  security_group_id = aws_security_group.apigw-vpclink.id
  ip_protocol       = "tcp"
  from_port         = 443
  to_port           = 443
  cidr_ipv4         = var.vpc.cidr
  description       = "Allow API Gateway VPC link to reach internal HTTPS backends in VPC"
}

data "aws_lb" "ngx-r" {
  count      = var.destroy_mode ? 0 : 1
  depends_on = [module.cloud-addon-cd]
  name       = "ngx-r-${var.logical_region_name}"
}

data "aws_lb" "alb-rs" {
  count      = var.destroy_mode ? 0 : 1
  depends_on = [module.o11y-regional-server-cd]
  name       = "alb-rs-${var.logical_region_name}"
}

resource "aws_apigatewayv2_vpc_link" "o11y-vpc-link" {
  name               = "o11y-${var.env}-${var.logical_region_name}"
  subnet_ids         = module.vpc.private_subnets
  security_group_ids = [aws_security_group.apigw-vpclink.id]
  tags = merge({
    tidbcloud-auto-deploy-owner = local.eks.name
  }, var.tags)
}

resource "aws_api_gateway_rest_api" "o11y-apigw" {
  name        = "o11y-${var.env}-${var.logical_region_name}"
  description = "API Gateway for O11Y region ${var.logical_region_name}"
  endpoint_configuration {
    types = ["REGIONAL"]
  }
  tags = merge({
    tidbcloud-auto-deploy-owner = local.eks.name
  }, var.tags)
}

resource "aws_api_gateway_resource" "ds" {
  rest_api_id = aws_api_gateway_rest_api.o11y-apigw.id
  parent_id   = aws_api_gateway_rest_api.o11y-apigw.root_resource_id
  path_part   = "ds"
}

resource "aws_api_gateway_resource" "ds-proxy" {
  rest_api_id = aws_api_gateway_rest_api.o11y-apigw.id
  parent_id   = aws_api_gateway_resource.ds.id
  path_part   = "{proxy+}"
}

resource "aws_api_gateway_method" "ds-proxy-any" {
  rest_api_id   = aws_api_gateway_rest_api.o11y-apigw.id
  resource_id   = aws_api_gateway_resource.ds-proxy.id
  http_method   = "ANY"
  authorization = "AWS_IAM"
  request_parameters = {
    "method.request.path.proxy" = true
  }
}

resource "aws_api_gateway_integration" "vpc-link-integration" {
  depends_on              = [aws_api_gateway_method.ds-proxy-any]
  rest_api_id             = aws_api_gateway_rest_api.o11y-apigw.id
  resource_id             = aws_api_gateway_resource.ds-proxy.id
  http_method             = "ANY"
  type                    = "HTTP_PROXY"
  integration_http_method = "ANY"
  uri                     = "http://${local.ngx_r_dns_name}/{proxy}"
  connection_type         = "VPC_LINK"
  connection_id           = aws_apigatewayv2_vpc_link.o11y-vpc-link.id
  integration_target      = local.ngx_r_arn

  request_parameters = {
    "integration.request.path.proxy" = "method.request.path.proxy"
  }
}

resource "aws_api_gateway_resource" "rs" {
  rest_api_id = aws_api_gateway_rest_api.o11y-apigw.id
  parent_id   = aws_api_gateway_rest_api.o11y-apigw.root_resource_id
  path_part   = "rs"
}

resource "aws_api_gateway_resource" "rs-proxy" {
  rest_api_id = aws_api_gateway_rest_api.o11y-apigw.id
  parent_id   = aws_api_gateway_resource.rs.id
  path_part   = "{proxy+}"
}

resource "aws_api_gateway_method" "rs-proxy-any" {
  rest_api_id   = aws_api_gateway_rest_api.o11y-apigw.id
  resource_id   = aws_api_gateway_resource.rs-proxy.id
  http_method   = "ANY"
  authorization = "AWS_IAM"
  request_parameters = {
    "method.request.path.proxy" = true
  }
}

resource "aws_api_gateway_integration" "rs-vpc-link-integration" {
  depends_on              = [aws_api_gateway_method.rs-proxy-any]
  rest_api_id             = aws_api_gateway_rest_api.o11y-apigw.id
  resource_id             = aws_api_gateway_resource.rs-proxy.id
  http_method             = "ANY"
  type                    = "HTTP_PROXY"
  integration_http_method = "ANY"
  uri                     = "http://${local.alb_rs_dns_name}/{proxy}"
  connection_type         = "VPC_LINK"
  connection_id           = aws_apigatewayv2_vpc_link.o11y-vpc-link.id
  integration_target      = local.alb_rs_arn

  request_parameters = {
    "integration.request.path.proxy" = "method.request.path.proxy"
  }
}

resource "aws_api_gateway_deployment" "tidbcloud" {
  depends_on = [
    aws_api_gateway_method.ds-proxy-any,
    aws_api_gateway_integration.vpc-link-integration,
    aws_api_gateway_method.rs-proxy-any,
    aws_api_gateway_integration.rs-vpc-link-integration,
  ]
  rest_api_id = aws_api_gateway_rest_api.o11y-apigw.id
  description = "Initial deployment"
}

resource "aws_api_gateway_stage" "tidbcloud" {
  deployment_id = aws_api_gateway_deployment.tidbcloud.id
  rest_api_id   = aws_api_gateway_rest_api.o11y-apigw.id
  stage_name    = "tidbcloud"
  description   = "Production stage for tidbcloud"
}

locals {
  ngx_r_dns_name  = try(data.aws_lb.ngx-r[0].dns_name, "")
  ngx_r_arn       = try(data.aws_lb.ngx-r[0].arn, "")
  alb_rs_dns_name = try(data.aws_lb.alb-rs[0].dns_name, "")
  alb_rs_arn      = try(data.aws_lb.alb-rs[0].arn, "")
}

locals {
  api_endpoint = "https://${aws_api_gateway_rest_api.o11y-apigw.id}.execute-api.${var.aws_region}.amazonaws.com/tidbcloud"
}