# Origin Access Controls =====================================================

resource "aws_cloudfront_origin_access_control" "this" {
  for_each = var.origin_access_controls

  name                              = each.value.name
  description                       = each.value.description
  origin_access_control_origin_type = each.value.origin_access_control_origin_type
  signing_behavior                  = each.value.signing_behavior
  signing_protocol                  = each.value.signing_protocol
}

# CloudFront distributions ===================================================

resource "aws_cloudfront_distribution" "this" {
  for_each = var.distributions

  comment         = each.value.comment
  enabled         = each.value.enabled
  http_version    = each.value.http_version
  price_class     = each.value.price_class
  aliases         = each.value.aliases
  web_acl_id      = each.value.waf_web_acl_id
  is_ipv6_enabled = true

  dynamic "origin" {
    for_each = each.value.origins
    content {
      origin_id   = origin.value.origin_id
      domain_name = origin.value.domain_name
      origin_path = origin.value.origin_path

      origin_access_control_id = origin.value.s3_oac_id

      dynamic "custom_header" {
        for_each = origin.value.custom_headers
        content {
          name  = custom_header.key
          value = custom_header.value
        }
      }

      dynamic "custom_origin_config" {
        for_each = origin.value.custom_origin != null ? [origin.value.custom_origin] : []
        content {
          http_port              = custom_origin_config.value.http_port
          https_port             = custom_origin_config.value.https_port
          origin_protocol_policy = custom_origin_config.value.protocol_policy
          origin_ssl_protocols   = custom_origin_config.value.ssl_protocols
        }
      }
    }
  }

  default_cache_behavior {
    target_origin_id       = each.value.default_cache_behavior.target_origin_id
    viewer_protocol_policy = each.value.default_cache_behavior.viewer_protocol_policy
    allowed_methods        = each.value.default_cache_behavior.allowed_methods
    cached_methods         = each.value.default_cache_behavior.cached_methods
    compress               = each.value.default_cache_behavior.compress
    cache_policy_id        = each.value.default_cache_behavior.cache_policy_id

    dynamic "forwarded_values" {
      for_each = each.value.default_cache_behavior.cache_policy_id == null ? [true] : []
      content {
        query_string = false
        cookies { forward = "none" }
      }
    }

    min_ttl     = each.value.default_cache_behavior.ttl_min
    default_ttl = each.value.default_cache_behavior.ttl_default
    max_ttl     = each.value.default_cache_behavior.ttl_max
  }

  dynamic "ordered_cache_behavior" {
    for_each = each.value.ordered_cache_behaviors
    content {
      path_pattern           = ordered_cache_behavior.value.path_pattern
      target_origin_id       = ordered_cache_behavior.value.target_origin_id
      viewer_protocol_policy = ordered_cache_behavior.value.viewer_protocol_policy
      allowed_methods        = ordered_cache_behavior.value.allowed_methods
      cached_methods         = ordered_cache_behavior.value.cached_methods
      compress               = ordered_cache_behavior.value.compress
      cache_policy_id        = ordered_cache_behavior.value.cache_policy_id
      min_ttl                = ordered_cache_behavior.value.ttl_min
      default_ttl            = ordered_cache_behavior.value.ttl_default
      max_ttl                = ordered_cache_behavior.value.ttl_max

      dynamic "forwarded_values" {
        for_each = ordered_cache_behavior.value.cache_policy_id == null ? [true] : []
        content {
          query_string = false
          cookies { forward = "none" }
        }
      }
    }
  }

  restrictions {
    geo_restriction {
      restriction_type = each.value.geo_restriction.restriction_type
      locations        = each.value.geo_restriction.locations
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = each.value.acm_certificate_arn == null
    acm_certificate_arn            = each.value.acm_certificate_arn
    ssl_support_method             = each.value.acm_certificate_arn != null ? "sni-only" : null
    minimum_protocol_version       = each.value.acm_certificate_arn != null ? "TLSv1.2_2021" : null
  }

  dynamic "logging_config" {
    for_each = each.value.logging_bucket != null ? [true] : []
    content {
      bucket          = each.value.logging_bucket
      prefix          = each.value.logging_prefix
      include_cookies = false
    }
  }

  tags = local.tags
}