locals {
  session_product_pca_enabled = local.persona == "premium"
  # Keep the historical subject while widening the CA's use; changing it replaces the root.
  session_product_pca_common_name = substr(replace(lower("cp9-${local.session_name}-dedicated-component-pca"), "_", "-"), 0, 64)
}

resource "aws_acmpca_certificate_authority" "session_product" {
  count = local.session_product_pca_enabled ? 1 : 0

  type       = "ROOT"
  usage_mode = "SHORT_LIVED_CERTIFICATE"

  certificate_authority_configuration {
    key_algorithm     = "RSA_2048"
    signing_algorithm = "SHA256WITHRSA"

    subject {
      common_name  = local.session_product_pca_common_name
      organization = "cp9"
    }
  }

  permanent_deletion_time_in_days = 7
}

resource "aws_acmpca_certificate" "session_product_root" {
  count = local.session_product_pca_enabled ? 1 : 0

  certificate_authority_arn   = aws_acmpca_certificate_authority.session_product[0].arn
  certificate_signing_request = aws_acmpca_certificate_authority.session_product[0].certificate_signing_request
  signing_algorithm           = "SHA256WITHRSA"
  template_arn                = "arn:aws:acm-pca:::template/RootCACertificate/V1"

  validity {
    type  = "DAYS"
    value = 7
  }
}

resource "aws_acmpca_certificate_authority_certificate" "session_product" {
  count = local.session_product_pca_enabled ? 1 : 0

  certificate               = aws_acmpca_certificate.session_product_root[0].certificate
  certificate_authority_arn = aws_acmpca_certificate_authority.session_product[0].arn
}

moved {
  from = aws_acmpca_certificate_authority.dedicated_component
  to   = aws_acmpca_certificate_authority.session_product
}

moved {
  from = aws_acmpca_certificate.dedicated_component_root
  to   = aws_acmpca_certificate.session_product_root
}

moved {
  from = aws_acmpca_certificate_authority_certificate.dedicated_component
  to   = aws_acmpca_certificate_authority_certificate.session_product
}