import * as iam from '@aws-cdk/aws-iam'
import * as sst from "@serverless-stack/resources";
import {EndpointType} from '@aws-cdk/aws-apigateway'
import {InterfaceVpcEndpoint} from '@aws-cdk/aws-ec2'

export default class ApiStack extends sst.Stack {
  constructor(scope, id, props) {
    super(scope, id, props);

    // import existing VPC endpoint
    const endpointAPIGateway = InterfaceVpcEndpoint.fromInterfaceVpcEndpointAttributes(this,'vpcEndpoint',{
      port: 443,
      vpcEndpointId: process.env.VPC_ENDPOINT
    })

    // allow incoming traffic to a private API only from a specified VPC endpoint
    const apiResourcePolicy = new iam.PolicyDocument({
      statements: [
        new iam.PolicyStatement({
          effect: iam.Effect.DENY,
          principals: [new iam.AnyPrincipal()],
          actions: ['execute-api:Invoke'],
          resources: ['execute-api:/*/*/*'],
          conditions: {
            StringNotEquals: {
              "aws:sourceVpce": process.env.VPC_ENDPOINT
            }
          }
        }),
        new iam.PolicyStatement({
          principals: [new iam.AnyPrincipal()],
          actions: ['execute-api:Invoke'],
          resources: ['execute-api:/*/*/*']
        })
      ]
    })

    // create the REST API
    const api = new sst.ApiGatewayV1Api(this, 'api', {
      defaultFunctionProps: {
        srcPath: "src",
      },
      restApi: {
        policy: apiResourcePolicy,
        endpointConfiguration: {
            types: [EndpointType.PRIVATE], 
            vpcEndpoints: [endpointAPIGateway]
          }
        },
        routes: {
          "GET /companies/{companyId}/profiles/search":"functions/company.handler",
          "GET /companies/{companyId}/communities/{communityId}/profiles/search":"functions/community.handler"
        },
      })


    // show the private REST API endpoint 
    // https://{rest-api-id}-{vpce-id}.execute-api.{region}.<http://amazonaws.com/{stage}|amazonaws.com/{stage}>
    this.addOutputs({
      "ApiEndpoint": "https://"+ api.restApi.restApiId + "-" + process.env.VPC_ENDPOINT + ".execute-api." + this.region + ".<http://amazonaws.com/|amazonaws.com/>" + this.stage
    });
  }
}