import { Construct } from "constructs";
import * as lambda from "aws-cdk-lib/aws-lambda";
import * as apigw from "aws-cdk-lib/aws-apigateway";
import { HostedZone, ARecord, RecordTarget } from "aws-cdk-lib/aws-route53";
import {
  Certificate,
  CertificateValidation,
} from "aws-cdk-lib/aws-certificatemanager";
import * as targets from "aws-cdk-lib/aws-route53-targets";
import * as iam from "aws-cdk-lib/aws-iam";
import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
import {
  Distribution,
  ViewerProtocolPolicy,
  CachePolicy,
  AllowedMethods,
} from "aws-cdk-lib/aws-cloudfront";
import { HttpOrigin, S3BucketOrigin } from "aws-cdk-lib/aws-cloudfront-origins";
import * as s3 from "aws-cdk-lib/aws-s3";
import * as s3deploy from "aws-cdk-lib/aws-s3-deployment";
import { Duration, RemovalPolicy, Stack } from "aws-cdk-lib";

interface RemixAppConstructProps {
  domainName: string;
  subDomain: string;
}

export class RemixAppConstruct extends Construct {
  constructor(scope: Construct, id: string, props: RemixAppConstructProps) {
    super(scope, id);

    const { domainName, subDomain } = props;
    const fullDomainName = `${subDomain}.${domainName}`;

    // Use the provided hosted zone or look it up
    const hostedZone = HostedZone.fromLookup(this, "HostedZone", {
      domainName: domainName,
    });

    const certificate = new Certificate(this, "ApiCertificate", {
      domainName: fullDomainName,
      validation: CertificateValidation.fromDns(hostedZone),
    });

    // Define the IAM Role with an explicit physical name
    const remixAppRole = new iam.Role(this, "RemixAppRole", {
      roleName: "RemixAppRole", // Explicit physical name
      assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName(
          "service-role/AWSLambdaBasicExecutionRole"
        ),
      ],
    });

    // Grant Lambda outbound internet access permissions
    remixAppRole.addToPolicy(
      new iam.PolicyStatement({
        actions: ["ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface"],
        resources: ["*"],
      })
    );

    // Grant permissions to read the secret
    const secret = secretsmanager.Secret.fromSecretNameV2(
      this,
      "SuperDuperSecret",
      "SECRET_ENV_VARS"
    );
    secret.grantRead(remixAppRole);

    // Define the Lambda function
    const remixAppFunction = new lambda.Function(this, "RemixAppFunction", {
      runtime: lambda.Runtime.NODEJS_20_X,
      handler: "index.handler",
      code: lambda.Code.fromAsset("packages/remix-app"),
      timeout: Duration.minutes(15), // Set timeout to 15 minutes
      environment: {},
      role: remixAppRole,
    });

    const api = new apigw.RestApi(this, "RemixAppAPI", {
      restApiName: "RemixApp Service",
      description: "This service hosts the Remix app.",
      deployOptions: {
        stageName: "prod",
      },
    });

    const apiDomainName = new apigw.DomainName(this, "ApiDomainName", {
      domainName: fullDomainName,
      certificate: certificate,
      endpointType: apigw.EndpointType.REGIONAL,
      securityPolicy: apigw.SecurityPolicy.TLS_1_2,
    });

    new apigw.BasePathMapping(this, "BasePathMapping", {
      domainName: apiDomainName,
      restApi: api,
      basePath: "",
    });

    const integration = new apigw.LambdaIntegration(remixAppFunction, {
      proxy: true,
    });

    const proxyResource = api.root.addResource("{proxy+}");
    proxyResource.addMethod("ANY", integration);

    // Create an S3 bucket for the static assets
    const staticAssetsBucket = new s3.Bucket(this, "StaticAssetsBucket", {
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
      removalPolicy: RemovalPolicy.DESTROY,
      autoDeleteObjects: true,
      objectOwnership: s3.ObjectOwnership.BUCKET_OWNER_ENFORCED, // Required for OAC
    });

    // Deploy static assets to the S3 bucket
    new s3deploy.BucketDeployment(this, "DeployStaticAssets", {
      sources: [s3deploy.Source.asset("packages/remix-app/build/client")],
      destinationBucket: staticAssetsBucket,
    });

    // Create an S3 origin using Origin Access Control (OAC)
    const s3Origin = S3BucketOrigin.withOriginAccessControl(staticAssetsBucket);

    // Set up CloudFront distribution with both API Gateway and S3 origins
    const distribution = new Distribution(this, "ApiCloudFrontDistribution", {
      defaultBehavior: {
        origin: new HttpOrigin(
          `${api.restApiId}.execute-api.${Stack.of(this).region}.amazonaws.com`,
          {
            originPath: "/prod", // Ensure this matches the API Gateway stage
          }
        ),
        viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
        cachePolicy: CachePolicy.CACHING_DISABLED, // For dynamic content
        allowedMethods: AllowedMethods.ALLOW_ALL,
      },
      domainNames: [fullDomainName],
      certificate: certificate,
      additionalBehaviors: {
        "favicon.ico": {
          origin: s3Origin,
          viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
          cachePolicy: CachePolicy.CACHING_OPTIMIZED,
        },
        "logo-*": {
          origin: s3Origin,
          viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
          cachePolicy: CachePolicy.CACHING_OPTIMIZED,
        },
        "/assets/*": {
          origin: s3Origin,
          viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
          cachePolicy: CachePolicy.CACHING_OPTIMIZED,
        },
      },
    });

    // Update the Route 53 ARecord to point to the CloudFront distribution
    new ARecord(this, "ApiAliasRecord", {
      zone: hostedZone,
      recordName: subDomain,
      target: RecordTarget.fromAlias(
        new targets.CloudFrontTarget(distribution)
      ),
    });
  }
}