resource "alicloud_oss_bucket" "test_data" {
  bucket        = local.oss_bucket_name
  storage_class = "Standard"
  force_destroy = true
  tags          = local.tags

  server_side_encryption_rule {
    sse_algorithm = "AES256"
  }

  # AliCloud OSS supports a bucket-wide lifecycle rule with a negative prefix
  # filter. Keep the rule broad so newly added disposable prefixes are covered
  # automatically, while excluding the complete import/ tree (including its
  # import/csv/ sample data) from object expiry.
  lifecycle_rule {
    id = "expire-test-objects-except-import-after-one-day"
    # Keep the empty root prefix explicit. The OSS lifecycle XML schema expects
    # Prefix to be present when a Filter.Not exclusion is used.
    prefix  = ""
    enabled = true

    filter {
      not {
        prefix = "import/"
      }
    }

    expiration {
      days = 1
    }
  }

  # OSS rejects AbortMultipartUpload in a rule that uses Filter.Not, and it
  # also rejects duplicate prefixes across rules. Keep multipart cleanup in
  # separate rules for each managed prefix while retaining the import/
  # exclusion for completed object expiration above.
  lifecycle_rule {
    id      = "abort-cdc-multipart-uploads-after-one-day"
    prefix  = "cdc/"
    enabled = true

    abort_multipart_upload {
      days = 1
    }
  }

  lifecycle_rule {
    id      = "abort-backup-export-multipart-uploads-after-one-day"
    prefix  = "backup-export/"
    enabled = true

    abort_multipart_upload {
      days = 1
    }
  }

  lifecycle_rule {
    id      = "abort-import-multipart-uploads-after-one-day"
    prefix  = "import/"
    enabled = true

    abort_multipart_upload {
      days = 1
    }
  }
}

resource "alicloud_oss_bucket_acl" "test_data" {
  bucket = alicloud_oss_bucket.test_data.bucket
  acl    = "private"
}

resource "alicloud_ram_role" "services" {
  role_name   = substr("${replace(local.deployment_name, "-", "")}ecs", 0, 64)
  description = "Date Integration test ECS access to its OSS export bucket"
  force       = true
  tags        = local.tags
  assume_role_policy_document = jsonencode({
    Version = "1"
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = {
        Service = ["ecs.aliyuncs.com"]
      }
    }]
  })
}

resource "alicloud_ram_policy" "oss" {
  policy_name     = substr("${replace(local.deployment_name, "-", "")}oss", 0, 128)
  description     = "Read and write access to the Date Integration test OSS bucket"
  force           = true
  rotate_strategy = "DeleteOldestNonDefaultVersionWhenLimitExceeded"
  tags            = local.tags
  policy_document = jsonencode({
    Version = "1"
    Statement = [{
      Effect = "Allow"
      Action = [
        "oss:AbortMultipartUpload",
        "oss:DeleteObject",
        "oss:GetBucket",
        "oss:GetObject",
        "oss:ListObjects",
        "oss:ListParts",
        "oss:PutObject",
      ]
      Resource = [
        "acs:oss:*:*:${local.oss_bucket_name}",
        "acs:oss:*:*:${local.oss_bucket_name}/*",
      ]
    }]
  })
}

resource "alicloud_ram_role_policy_attachment" "oss" {
  policy_name = alicloud_ram_policy.oss.policy_name
  policy_type = "Custom"
  role_name   = alicloud_ram_role.services.role_name
}

# Premium import reads the OSS test bucket with AK/SK (OSS import in the
# Premium tier authenticates with a long-lived access key, not a RAM role),
# while the ECS RAM role above remains the bootstrap/smoke access path. The
# access key is scoped to the AliCloud import prefixes so import E2E never
# reaches the CDC or backup-export fixtures. Both CSV and SQL fixtures are
# seeded under their own prefixes for the same import bucket.
resource "alicloud_ram_user" "import" {
  name         = substr("${replace(local.deployment_name, "-", "")}import", 0, 64)
  display_name = "Date Integration test OSS premium-import access"
  force        = true
}

resource "alicloud_ram_access_key" "import" {
  user_name = alicloud_ram_user.import.name
}

resource "alicloud_ram_policy" "import" {
  policy_name     = substr("${replace(local.deployment_name, "-", "")}import", 0, 128)
  description     = "Read access to the Date Integration test OSS import prefix"
  force           = true
  rotate_strategy = "DeleteOldestNonDefaultVersionWhenLimitExceeded"
  tags            = local.tags
  policy_document = jsonencode({
    Version = "1"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "oss:GetBucket",
          "oss:ListObjects",
        ]
        Resource = ["acs:oss:*:*:${local.oss_bucket_name}"]
      },
      {
        Effect = "Allow"
        Action = [
          "oss:AbortMultipartUpload",
          "oss:GetObject",
          "oss:ListParts",
        ]
        Resource = [
          "acs:oss:*:*:${local.oss_bucket_name}/import/csv/*",
          "acs:oss:*:*:${local.oss_bucket_name}/import/sql/*",
        ]
      },
    ]
  })
}

resource "alicloud_ram_user_policy_attachment" "import" {
  policy_name = alicloud_ram_policy.import.policy_name
  policy_type = "Custom"
  user_name   = alicloud_ram_user.import.name
}