resource "aws_verifiedaccess_instance" "main" {
  description = "testing purpose"
  tags = {
    "Name" : "${local.resource_prefix}-instance"
  }
}

resource "aws_verifiedaccess_trust_provider" "personal_okta" {
  policy_reference_name    = "okta"
  trust_provider_type      = "user"
  user_trust_provider_type = "oidc"
  oidc_options {
    client_id = var.okta_client_id
    client_secret = data.aws_ssm_parameter.okta_client_secret.value
    issuer = var.okta_domain
    authorization_endpoint = "${var.okta_domain}/v1/authorize"
    token_endpoint = "${var.okta_domain}/v1/token"
    user_info_endpoint = "${var.okta_domain}/v1/userinfo"
    scope = "openid profile groups"
  }
  tags = {
    "Name" : "${local.resource_prefix}-trust-provider"
  }
}

resource "aws_verifiedaccess_instance_trust_provider_attachment" "personal_okta_main" {
  verifiedaccess_instance_id       = aws_verifiedaccess_instance.main.id
  verifiedaccess_trust_provider_id = aws_verifiedaccess_trust_provider.personal_okta.id
}

resource "aws_verifiedaccess_group" "poc_group" {
  verifiedaccess_instance_id = aws_verifiedaccess_instance.main.id
  policy_document = <<EOT
  permit(principal, action, resource)
  when {
    context.${aws_verifiedaccess_trust_provider.personal_okta.policy_reference_name}.email_verified == true
  };
  EOT
  depends_on = [ aws_verifiedaccess_instance_trust_provider_attachment.personal_okta_main ]
  tags = {
    "Name" : "${local.resource_prefix}-group"
  }
}
resource "aws_verifiedaccess_endpoint" "private_endpoint" {
  application_domain     = local.private_endpoint
  attachment_type        = "vpc"
  description            = "app 2"
  domain_certificate_arn = module.acm.acm_certificate_arn
  endpoint_domain_prefix = local.resource_prefix
  endpoint_type          = "load-balancer"
  policy_document = <<EOT
  permit(principal, action, resource)
  when {
    context.${aws_verifiedaccess_trust_provider.personal_okta.policy_reference_name}.groups.containsAny(["Private"])
  };
  EOT
  load_balancer_options {
    load_balancer_arn = module.private_alb.arn
    port              = 443
    protocol          = "https"
    subnet_ids        = data.aws_subnets.spoke_v3_private.ids
  }
  security_group_ids       = [module.private_alb.security_group_id]
  verified_access_group_id = aws_verifiedaccess_group.poc_group.id
  tags = {
    "Name" : "${local.resource_prefix}-private-endpoint"
  }
}