template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Description: >
  AWS

  SAM Template for NVA Publication Service




Parameters:
  CognitoAuthorizerArn:
    Type: 'AWS::SSM::Parameter::Value<String>'
    Description: Reference to Cognito UserPool for the stage
    Default: CognitoAuthorizerArn
  CognitoAuthorizationUri:
    Type: 'AWS::SSM::Parameter::Value<String>'
    Default: '/NVA/CognitoUri'
  ExternalCognitoAuthorizerArn:
    Type: 'AWS::SSM::Parameter::Value<String>'
    Description: Reference to ARN of ExternalUsers UserPool
    Default: ExternalCognitoAuthorizerArn
  ExternalCognitoAuthorizerUrl:
    Type: 'AWS::SSM::Parameter::Value<String>'
    Description: Reference to URL for ExternalUsers UserPool
    Default: ExternalCognitoAuthorizerUrl
  ApiDomain:
    Type: 'AWS::SSM::Parameter::Value<String>'
    Description: The Api domain
    Default: /NVA/ApiDomain
  CustomDomainBasePath:
    Type: String
    Description: Base path mapping in CustomDomain
    Default: publication
  NewNvaEventBusArn:
    Type: 'AWS::SSM::Parameter::Value<String>'
    Default: '/NVA/Events/EventsBusArn'
  NewNvaEventBusName:
    Type: 'AWS::SSM::Parameter::Value<String>'
    Default: '/NVA/Events/EventsBusName'
  NvaEventsBucketsName:
    Type: 'AWS::SSM::Parameter::Value<String>'
    Default: '/NVA/Events/EventsBucketName'
  ExpandedEntriesPersistenceBucketName:
    Type: 'AWS::SSM::Parameter::Value<String>'
    Default: '/NVA/Events/PersistedEntriesBucketName'
  ExpandedEntriesPersistenceBucketArn:
    Type: 'AWS::SSM::Parameter::Value<String>'
    Default: '/NVA/Events/PersistedEntriesBucketArn'
  ResourceStorageBucketName:
    Type: 'AWS::SSM::Parameter::Value<String>'
    Default: '/NVA/PublicationData'
  AthenaQueriesBucketName:
    Type: 'AWS::SSM::Parameter::Value<String>'
    Default: '/NVA/Athena/QueriesBucketName'
  BrageMigrationInputBucketName:
    Type: 'String'
    Default: "brage-migration-input-files"
    Description: Name of bucket for input brage migration files
  BrageMigrationErrorBucketName:
    Type: 'String'
    Default: "brage-migration-reports"
    Description: Name of bucket for output brage migration errors
  MaxConcurrency:
    Type: Number
    Default: 100
    Description: Max number of provisioned hot instances for a lambda function
  MinConcurrency:
    Type: Number
    Default: 1
    MaxValue: 1
    MinValue: 1
    Description: Min number of provisioned hot instances for a lambda function
  EventBridgeMaxAttempt:
    Type: Number
    Default: 1
    MinValue: 1
    MaxValue: 5
    Description: Max attempt to put events into AWS EventBridge Event Bus. Default is 1.
  Suffix:
    Type: String
    Default: ''
    Description: Suffix used for naming resources for feature branches to avoid conflicts.
  NvaApplicationDomain:
    Type: AWS::SSM::Parameter::Value<String>
    Default: /NVA/ApplicationDomain
    Description: Domain-name for the NVA frontend
  ScopusZipBucketName:
    Type: String
    Default: "scopus-zip-files-v2"
    Description: Name of bucket for incoming zip-files to be unzipped (containing scopus xml-files)
  ScopusXmlBucketName:
    Type: String
    Default: "scopus-xml-files-v2"
    Description: Name of bucket for unzipped scopus xml files
  ScopusImportReportBucketName:
    Type: 'String'
    Default: "scopus-import-reports"
    Description: Name of bucket for output of reports
  ImportCandidateStorageBucketName:
    Type: 'String'
    Default: "nva-import-candidate-resources"
    Description: Name of bucket for scopus file import
  PiaRestHost:
    Type: 'AWS::SSM::Parameter::Value<String>'
    Default: '/NVA/PiaRestHost'
  PiaRestCredentialsTokenName:
    Type: String
    Default: 'PiaRestCredentials'
  PiaRestUsernameKey:
    Type: String
    Default: "PiaRestUser"
  PiaRestUsernamePasswordKey:
    Type: String
    Default: "PiaRestPass"
  CristinImportNviPatchQueueUrl:
    Type: AWS::SSM::Parameter::Value<String>
    Description: SQS Queue Url for proceeding nvi data from cristin
    Default: /NVA/Queues/CristinImportNviQueueUrl
  SlackSnsArn:
    Type: AWS::SSM::Parameter::Value<String>
    Default: '/NVA/Monitoring/SlackSnsArn'
  CristinUnitsS3ObjectUri:
    Type: 'AWS::SSM::Parameter::Value<String>'
    Default: '/NVA/S3/CristinIntermediateStorage/Units'
  AllowedOrigins:
    Type: String
    Description: comma separated list of external clients that are allowed to contact the HTTP APIs, "*" indicates that all origins are allowed
    Default: '*'

Conditions:
  WithSuffix: !Not [ !Equals [ !Ref Suffix, '' ] ]

Globals:
  Api:
    Cors:
      AllowMethods: "'PUT, GET,OPTIONS,DELETE,POST'"
      AllowHeaders: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,Location'"
      AllowOrigin: "'*'"
  Function:
    Runtime: java21
    Timeout: 20
    MemorySize: 1800 # 1 vCPU
    Environment:
      Variables:
        COGNITO_HOST: !Ref CognitoAuthorizationUri
        API_HOST: !Ref ApiDomain
        API_SCHEME: 'https'
        ID_NAMESPACE: !Sub 'https://${ApiDomain}/${CustomDomainBasePath}'
        EVENTS_BUCKET: !Ref NvaEventsBucketsName
        BACKEND_CLIENT_AUTH_URL: !Ref CognitoAuthorizationUri
        EXTERNAL_USER_POOL_URI: !Ref ExternalCognitoAuthorizerUrl
    Architectures:
      - arm64

Resources:

  ApiAccessLogGroup:
    Type: AWS::Logs::LogGroup

  #===========================DynamoDB Table========================================================

  # NB! for compatibility reasons (ResourceService is re-used) NvaImportCandidatesTable should be a copy of NvaResourcesTable
  # Any changes done to the structure of NvaResourcesTable should be duplicated in NvaImportCandidatesTable
  # Remove this message if they no longer need to be compatible.

  NvaResourcesTable:
    Type: AWS::DynamoDB::Table
    UpdateReplacePolicy: Retain
    DeletionPolicy: Delete # DeletionPolicy should be added on main branch stacks through use of stack policy
    Properties:
      TableName: !Sub nva-resources-${AWS::StackName}
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: PK0
          AttributeType: S
        - AttributeName: SK0
          AttributeType: S
        - AttributeName: PK1
          AttributeType: S
        - AttributeName: SK1
          AttributeType: S
        - AttributeName: PK2
          AttributeType: S
        - AttributeName: SK2
          AttributeType: S
        - AttributeName: PK3
          AttributeType: S
        - AttributeName: SK3
          AttributeType: S
        - AttributeName: PK4
          AttributeType: S
        - AttributeName: SK4
          AttributeType: S
      KeySchema:
        - AttributeName: PK0
          KeyType: HASH
        - AttributeName: SK0
          KeyType: RANGE
      GlobalSecondaryIndexes:
        - IndexName: ByTypeCustomerStatus
          KeySchema:
            - AttributeName: PK1
              KeyType: HASH
            - AttributeName: SK1
              KeyType: RANGE
          Projection:
            ProjectionType: ALL
        - IndexName: ByCustomerResource
          KeySchema:
            - AttributeName: PK2
              KeyType: HASH
            - AttributeName: SK2
              KeyType: RANGE
          Projection:
            ProjectionType: ALL
        - IndexName: ResourcesByIdentifier
          KeySchema:
            - AttributeName: PK3
              KeyType: HASH
            - AttributeName: SK3
              KeyType: RANGE
          Projection:
            ProjectionType: ALL
        - IndexName: ResourceByCristinId
          KeySchema:
            - AttributeName: PK4
              KeyType: HASH
            - AttributeName: SK4
              KeyType: RANGE
          Projection:
            ProjectionType: ALL
      StreamSpecification:
        StreamViewType: NEW_AND_OLD_IMAGES
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: true
      Tags:
        - Key: IncludedInBackup
          Value: 'true'
        - Key: TemporaryTag
          Value: 'this_is_a_test_to_trigger_stack_update'

  # NB! for compatibility reasons NvaImportCandidatesTable should be a copy of NvaResourcesTable
  NvaImportCandidatesTable:
    Type: AWS::DynamoDB::Table
    UpdateReplacePolicy: Retain
    DeletionPolicy: Delete # DeletionPolicy should be added on main branch stacks through use of stack policy
    Properties:
      TableName: !Sub nva-import-candidates-${AWS::StackName}
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: PK0
          AttributeType: S
        - AttributeName: SK0
          AttributeType: S
        - AttributeName: PK1
          AttributeType: S
        - AttributeName: SK1
          AttributeType: S
        - AttributeName: PK2
          AttributeType: S
        - AttributeName: SK2
          AttributeType: S
        - AttributeName: PK3
          AttributeType: S
        - AttributeName: SK3
          AttributeType: S
        - AttributeName: PK4
          AttributeType: S
        - AttributeName: SK4
          AttributeType: S
      KeySchema:
        - AttributeName: PK0
          KeyType: HASH
        - AttributeName: SK0
          KeyType: RANGE
      GlobalSecondaryIndexes:
        - IndexName: ByTypeCustomerStatus
          KeySchema:
            - AttributeName: PK1
              KeyType: HASH
            - AttributeName: SK1
              KeyType: RANGE
          Projection:
            ProjectionType: ALL
        - IndexName: ByCustomerResource
          KeySchema:
            - AttributeName: PK2
              KeyType: HASH
            - AttributeName: SK2
              KeyType: RANGE
          Projection:
            ProjectionType: ALL
        - IndexName: ResourcesByIdentifier
          KeySchema:
            - AttributeName: PK3
              KeyType: HASH
            - AttributeName: SK3
              KeyType: RANGE
          Projection:
            ProjectionType: ALL
        - IndexName: ResourceByCristinId
          KeySchema:
            - AttributeName: PK4
              KeyType: HASH
            - AttributeName: SK4
              KeyType: RANGE
          Projection:
            ProjectionType: ALL
      StreamSpecification:
        StreamViewType: NEW_AND_OLD_IMAGES
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: true
      Tags:
        - Key: IncludedInBackup
          Value: 'true'
        - Key: TemporaryTag
          Value: 'this_is_a_test_to_trigger_stack_update'

  DownloadUrlShorteningTable:
    Type: AWS::DynamoDB::Table
    UpdateReplacePolicy: Retain
    DeletionPolicy: Delete
    Properties:
      TableName: !Sub nva-download-url-shorterner-${AWS::StackName}
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: shortenedUri
          AttributeType: S
      KeySchema:
        - AttributeName: shortenedUri
          KeyType: HASH
      StreamSpecification:
        StreamViewType: NEW_AND_OLD_IMAGES
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: false
      TimeToLiveSpecification:
        AttributeName: expiresDate
        Enabled: true

  #===============================DLOQs===================================================================

  DynamodbEventFanoutStreamRecordsDLQ:
    Type: "AWS::SQS::Queue"
  UpdateDoiStatusDLQ:
    Type: "AWS::SQS::Queue"
  DeletePublicationEventProducerDlq:
    Type: "AWS::SQS::Queue"
  PublicationFanoutHandlerDLQ:
    Type: "AWS::SQS::Queue"
  DeleteDraftPublicationHandlerDLQ:
    Type: "AWS::SQS::Queue"
  DoiRequestEventProducerDLQ:
    Type: "AWS::SQS::Queue"
  ResourceExpansionHandlerDLQ:
    Type: "AWS::SQS::Queue"
  ImportCandidateBatchScanDLQ:
    Type: "AWS::SQS::Queue"
  ImportCandidateExpansionHandlerDLQ:
    Type: "AWS::SQS::Queue"
  ImportCandidateDataEntryUpdateHandlerDLQ:
    Type: "AWS::SQS::Queue"
  DeleteImportCandidateEventHandlerDLQ:
    Type: "AWS::SQS::Queue"
  DeleteImportCandidateHandlerDLQ:
    Type: "AWS::SQS::Queue"
  BrageMergingRollbackHandlerDLQ:
    Type: "AWS::SQS::Queue"
  RecoveryQueue:
    Type: AWS::SQS::Queue
    Properties:
      MessageRetentionPeriod: 1209600 #14 days
  RecoveryBatchScanHandlerDLQ:
    Type: "AWS::SQS::Queue"
  DeleteFileFromS3EventHandlerDLQ:
    Type: "AWS::SQS::Queue"



  #==============================ROLES=======================================================================

  DeleteDraftPublicationLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: Events
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - events:PutEvents
                Resource: !GetAtt InternalBus.Arn
              - Effect: Allow
                Action:
                  - sqs:SendMessage
                  - sqs:ReceiveMessage
                  - sqs:DeleteMessage
                Resource: !GetAtt DeleteDraftPublicationHandlerDLQ.Arn

  UpdateDoiStatusLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: Events
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - sqs:SendMessage
                  - sqs:ReceiveMessage
                  - sqs:DeleteMessage
                Resource: !GetAtt UpdateDoiStatusDLQ.Arn

  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action: sts:AssumeRole

  DefaultLambdaPermissions:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub DefaultLambdaPermissions-${AWS::StackName}
      Roles:
        - !Ref LambdaRole
        - !Ref DeleteDraftPublicationLambdaRole
        - !Ref UpdateDoiStatusLambdaRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
              - lambda:InvokeFunction
            Resource: "*"

  DatabaseAccessLambdaManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Roles:
        - !Ref LambdaRole
        - !Ref DeleteDraftPublicationLambdaRole
        - !Ref UpdateDoiStatusLambdaRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - dynamodb:*
            Resource:
              - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/nva-resources-${AWS::StackName}
              - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/nva-resources-${AWS::StackName}/index/*
              - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/nva-import-candidates-${AWS::StackName}
              - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/nva-import-candidates-${AWS::StackName}/index/*

  S3AccessManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Roles:
        - !Ref LambdaRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - s3:GetObject
              - s3:ListBucket
              - s3:ListBucketMultipartUploads
              - s3:PutObject
              - s3:PutObjectAcl
            Resource: "*"

  S3AccessResourceStorageManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - s3:GetObject
              - s3:ListBucket
              - s3:ListBucketMultipartUploads
              - s3:PutObject
              - s3:PutObjectAcl
            Resource:
              - !Sub 'arn:aws:s3:::${ResourceStorageBucketName}/*'

  MultipartUploadResourceStorageBucketManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - s3:GetObject
              - s3:GetObjectMetadata
              - s3:PutObject
              - s3:CreateMultipartUpload
              - s3:CompleteMultipartUpload
              - s3:AbortMultipartUpload
              - s3:ListMultipartUploadParts
              - s3:ListBucketMultipartUploads
            Resource:
              - !Sub 'arn:aws:s3:::${ResourceStorageBucketName}/*'

  S3DeleteAccessManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - s3:DeleteObject
            Resource:
              - !Sub 'arn:aws:s3:::cristin-import-${AWS::AccountId}/*'
              - !Sub '${ExpandedEntriesPersistenceBucketArn}/*'
              - !Sub 'arn:aws:s3:::${ResourceStorageBucketName}/*'

  DynamoDbStreamsAccessPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub DynamoDbStreamAccessPolicy-${AWS::StackName}
      Roles:
        - !Ref LambdaRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - dynamodb:GetShardIterator
              - dynamodb:DescribeStream
              - dynamodb:ListStreams
              - dynamodb:GetRecords
            Resource:
              - !GetAtt NvaResourcesTable.StreamArn
              - !GetAtt NvaImportCandidatesTable.StreamArn


  EventsLambdaManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Roles:
        - !Ref LambdaRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - events:*
              - sqs:SendMessage
              - sqs:SendMessageBatch
              - sqs:ReceiveMessage
              - sqs:DeleteMessage
              - sqs:GetQueueAttributes
              - sqs:ChangeMessageVisibility
            Resource: "*"

  BackendCognitoClientCredentialsSecretManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Roles:
        - !Ref LambdaRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - secretsmanager:GetSecretValue
            Resource:
              - !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:BackendCognitoClientCredentials-*"
              - !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:${PiaRestCredentialsTokenName}-*"

  DownloadUrlShorteningTableManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - dynamodb:PutItem
              - dynamodb:GetItem
            Resource:
              - !GetAtt DownloadUrlShorteningTable.Arn

  NvaPublicationApi:
    Type: AWS::Serverless::Api
    Properties:
      AccessLogSetting:
        DestinationArn: !GetAtt ApiAccessLogGroup.Arn
        Format: '{ "apiId": "$context.apiId", "requestId": "$context.requestId", "requestTime": "$context.requestTime", "requestTimeEpoch": "$context.requestTimeEpoch", "httpMethod": "$context.httpMethod", "path": "$context.path", "status": "$context.status",  "error.message": "$context.error.message" }'
      StageName: Prod
      EndpointConfiguration: REGIONAL
      DefinitionBody:
        'Fn::Transform':
          Name: AWS::Include
          Parameters:
            Location: ./docs/openapi.yaml


  ScopusBucketsAccessPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub ScopusBucketsAccessPolicy-${AWS::StackName}
      Roles:
        - !Ref LambdaRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - 's3:*'
            Resource:
              - !Sub '${ScopusXmlBucket.Arn}/*'
              - !Sub '${ScopusZipBucket.Arn}/*'
              - !Sub '${ImportCandidateStorageBucket.Arn}/*'

  #================================ApiGateway handlers====================================================
  NvaCreatePublicationFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-rest
      Handler: no.unit.nva.publication.create.CreatePublicationHandler::handleRequest
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          TABLE_NAME: !Ref NvaResourcesTable
          BACKEND_CLIENT_SECRET_NAME: 'BackendCognitoClientCredentials'
      Role: !GetAtt LambdaRole.Arn
      Events:
        GetEvent:
          Type: Api
          Properties:
            Path: /
            Method: post
            RestApiId: !Ref NvaPublicationApi

  NvaFetchPublicationFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-rest
      Handler: no.unit.nva.publication.fetch.FetchPublicationHandler::handleRequest
      AutoPublishAlias: live
      DeploymentPreference:
        Type: AllAtOnce
      ProvisionedConcurrencyConfig:
        ProvisionedConcurrentExecutions: 1
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          TABLE_NAME: !Ref NvaResourcesTable
          NVA_FRONTEND_DOMAIN: !Ref NvaApplicationDomain
          BACKEND_CLIENT_SECRET_NAME: 'BackendCognitoClientCredentials'
      Role: !GetAtt LambdaRole.Arn
      Events:
        GetEvent:
          Type: Api
          Properties:
            Path: /{publicationIdentifier}
            Method: get
            RestApiId: !Ref NvaPublicationApi

  NvaFetchPublicationContextFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-rest
      Handler: no.unit.nva.publication.fetch.FetchPublicationContextHandler::handleRequest
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          CUSTOM_DOMAIN_BASE_PATH: !Ref CustomDomainBasePath
      Role: !GetAtt LambdaRole.Arn
      Events:
        GetEvent:
          Type: Api
          Properties:
            Path: /context
            Method: get
            RestApiId: !Ref NvaPublicationApi

  NvaFetchPublicationFunctionScalableTarget:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MaxCapacity: !Ref MaxConcurrency
      MinCapacity: !Ref MinConcurrency
      ResourceId: !Sub function:${NvaFetchPublicationFunction}:live # You need to specify an alias or version here
      RoleARN: !Sub arn:aws:iam::${AWS::AccountId}:role/aws-service-role/lambda.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_LambdaConcurrency
      ScalableDimension: lambda:function:ProvisionedConcurrency
      ServiceNamespace: lambda
    DependsOn: NvaFetchPublicationFunctionAliaslive # This is your function logical ID + "Alias" + what you use for AutoPublishAlias

  NvaFetchPublicationFunctionScalingPolicy:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName: NvaFetchPublicationFunctionScalingPolicy
      PolicyType: TargetTrackingScaling
      ScalingTargetId: !Ref NvaFetchPublicationFunctionScalableTarget
      TargetTrackingScalingPolicyConfiguration:
        TargetValue: 0.70 # Any value between 0.1 and 0.9 can be used here
        PredefinedMetricSpecification:
          PredefinedMetricType: LambdaProvisionedConcurrencyUtilization

  NvaUpdatePublicationFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-rest
      Handler: no.unit.nva.publication.update.UpdatePublicationHandler::handleRequest
      MemorySize: 8192
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          TABLE_NAME: !Ref NvaResourcesTable
          BACKEND_CLIENT_SECRET_NAME: 'BackendCognitoClientCredentials'
          NVA_EVENT_BUS_NAME: !Ref NewNvaEventBusName
      Policies:
        - !GetAtt BackendCognitoClientCredentialsSecretManagedPolicy.PolicyArn
        - !GetAtt EventsLambdaManagedPolicy.PolicyArn
        - !GetAtt DatabaseAccessLambdaManagedPolicy.PolicyArn
      Events:
        PutEvent:
          Type: Api
          Properties:
            Path: /{publicationIdentifier}
            Method: put
            RestApiId: !Ref NvaPublicationApi

  PublishPublicationFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-rest
      Handler: no.unit.nva.publication.update.PublishPublicationHandler::handleRequest
      MemorySize: 8192
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          TABLE_NAME: !Ref NvaResourcesTable
      Policies:
        - !GetAtt DatabaseAccessLambdaManagedPolicy.PolicyArn
      Events:
        PutEvent:
          Type: Api
          Properties:
            Path: /{publicationIdentifier}/publish
            Method: post
            RestApiId: !Ref NvaPublicationApi

  NvaDeletePublicationFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-rest
      Handler: no.unit.nva.publication.delete.DeletePublicationHandler::handleRequest
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          TABLE_NAME: !Ref NvaResourcesTable
          DOMAIN_NAME: !Ref ApiDomain
      Policies:
        - !GetAtt BackendCognitoClientCredentialsSecretManagedPolicy.PolicyArn
        - !GetAtt DatabaseAccessLambdaManagedPolicy.PolicyArn
      Events:
        PutEvent:
          Type: Api
          Properties:
            Path: /{publicationIdentifier}
            Method: delete
            RestApiId: !Ref NvaPublicationApi

  NvaPublicationsByOwnerFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-rest
      Handler: no.unit.nva.publication.fetch.PublicationsByOwnerHandler::handleRequest
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          TABLE_NAME: !Ref NvaResourcesTable
      Role: !GetAtt LambdaRole.Arn
      Events:
        GetEvent:
          Type: Api
          Properties:
            Path: /by-owner
            Method: get
            RestApiId: !Ref NvaPublicationApi

  NvaCreateMessageFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: messages
      Handler: no.unit.nva.publication.messages.create.NewCreateMessageHandler::handleRequest
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          TABLE_NAME: !Ref NvaResourcesTable
      Role: !GetAtt LambdaRole.Arn
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /{publicationIdentifier}/ticket/{ticketIdentifier}/message
            Method: post
            RestApiId: !Ref NvaPublicationApi

  DeleteMessageHandler:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: messages
      Handler: no.unit.nva.publication.messages.delete.DeleteMessageHandler::handleRequest
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          TABLE_NAME: !Ref NvaResourcesTable
      Role: !GetAtt LambdaRole.Arn
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /{publicationIdentifier}/ticket/{ticketIdentifier}/message/{messageIdentifier}
            Method: delete
            RestApiId: !Ref NvaPublicationApi

  ListTicketsHandler:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: tickets
      Handler: no.unit.nva.publication.ticket.read.ListTicketsHandler::handleRequest
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          TABLE_NAME: !Ref NvaResourcesTable
      Role: !GetAtt LambdaRole.Arn
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /tickets
            Method: get
            RestApiId: !Ref NvaPublicationApi

  UpdateTicketHandler:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: tickets
      Handler: no.unit.nva.publication.ticket.update.UpdateTicketHandler::handleRequest
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          TABLE_NAME: !Ref NvaResourcesTable
          BACKEND_CLIENT_SECRET_NAME: 'BackendCognitoClientCredentials'
      Role: !GetAtt LambdaRole.Arn
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /{publicationIdentifier}/ticket/{ticketIdentifier}
            Method: put
            RestApiId: !Ref NvaPublicationApi

  DeleteTicketHandler:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: tickets
      Handler: no.unit.nva.publication.ticket.delete.DeleteTicketHandler::handleRequest
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          TABLE_NAME: !Ref NvaResourcesTable
      Role: !GetAtt LambdaRole.Arn
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /{publicationIdentifier}/ticket/{ticketIdentifier}
            Method: delete
            RestApiId: !Ref NvaPublicationApi

  CreateTicketFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: tickets
      Handler: no.unit.nva.publication.ticket.create.CreateTicketHandler::handleRequest
      Timeout: 10
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          TABLE_NAME: !Ref NvaResourcesTable
          BACKEND_CLIENT_SECRET_NAME: 'BackendCognitoClientCredentials'
      Role: !GetAtt LambdaRole.Arn
      Events:
        GetEvent:
          Type: Api
          Properties:
            Path: /{publicationIdentifier}/ticket
            Method: post
            RestApiId: !Ref NvaPublicationApi

  GetTicketFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: tickets
      Handler: no.unit.nva.publication.ticket.read.GetTicketHandler::handleRequest
      Timeout: 10
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          TABLE_NAME: !Ref NvaResourcesTable
      Role: !GetAtt LambdaRole.Arn
      Events:
        GetEvent:
          Type: Api
          Properties:
            Path: /{publicationIdentifier}/ticket/{ticketIdentifier}
            Method: get
            RestApiId: !Ref NvaPublicationApi

  ListTicketsForPublicationHandler:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: tickets
      Handler: no.unit.nva.publication.ticket.read.ListTicketsForPublicationHandler::handleRequest
      Timeout: 10
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          TABLE_NAME: !Ref NvaResourcesTable
      Role: !GetAtt LambdaRole.Arn
      Events:
        GetEvent:
          Type: Api
          Properties:
            Path: /{publicationIdentifier}/tickets
            Method: get
            RestApiId: !Ref NvaPublicationApi

  NvaFetchImportCandidateFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-rest
      Handler: no.unit.nva.publication.fetch.FetchImportCandidateHandler::handleRequest
      AutoPublishAlias: live
      DeploymentPreference:
        Type: AllAtOnce
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          TABLE_NAME: !Ref NvaImportCandidatesTable
      Role: !GetAtt LambdaRole.Arn
      Events:
        GetEvent:
          Type: Api
          Properties:
            Path: /import-candidate/{importCandidateIdentifier}
            Method: get
            RestApiId: !Ref NvaPublicationApi

  ImportCandidatePresignedUrlHandler:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-rest
      Handler: no.unit.nva.publication.download.ImportCandidatePresignedUrlHandler::handleRequest
      AutoPublishAlias: live
      DeploymentPreference:
        Type: AllAtOnce
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          TABLE_NAME: !Ref NvaImportCandidatesTable
          IMPORT_CANDIDATES_STORAGE_BUCKET: !Ref ImportCandidateStorageBucket
      Role: !GetAtt LambdaRole.Arn
      Events:
        GetEvent:
          Type: Api
          Properties:
            Path: /import-candidate/{importCandidateIdentifier}/file/{fileIdentifier}
            Method: get
            RestApiId: !Ref NvaPublicationApi

  UpdateImportStatusHandler:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-rest
      Handler: no.unit.nva.publication.update.UpdateImportStatusHandler::handleRequest
      AutoPublishAlias: live
      DeploymentPreference:
        Type: AllAtOnce
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          TABLE_NAME: !Ref NvaImportCandidatesTable
      Role: !GetAtt LambdaRole.Arn
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /import-candidate/{importCandidateIdentifier}
            Method: put
            RestApiId: !Ref NvaPublicationApi

  CreatePublicationFromImportCandidateFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-rest
      Handler: no.unit.nva.publication.create.CreatePublicationFromImportCandidateHandler::handleRequest
      AutoPublishAlias: live
      DeploymentPreference:
        Type: AllAtOnce
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          IMPORT_CANDIDATES_TABLE_NAME: !Ref NvaImportCandidatesTable
          RESOURCE_TABLE_NAME: !Ref NvaResourcesTable
          NVA_PERSISTED_STORAGE_BUCKET_NAME: !Ref ResourceStorageBucketName
          IMPORT_CANDIDATES_STORAGE_BUCKET: !Ref ImportCandidateStorageBucket
          PIA_SECRETS_NAME: !Ref PiaRestCredentialsTokenName
          PIA_USERNAME_KEY: !Ref PiaRestUsernameKey
          PIA_PASSWORD_KEY: !Ref PiaRestUsernamePasswordKey
          PIA_REST_API: !Ref PiaRestHost
      Role: !GetAtt LambdaRole.Arn
      Events:
        GetEvent:
          Type: Api
          Properties:
            Path: /import-candidate/{importCandidateIdentifier}
            Method: post
            RestApiId: !Ref NvaPublicationApi

  DownloadPublicationFileFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub '/aws/lambda/${DownloadPublicationFileFunction}'
      RetentionInDays: 90

  DownloadPublicationFileFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-rest
      Handler: no.unit.nva.publication.download.CreatePresignedDownloadUrlHandler::handleRequest
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          SHORTENED_URI_TABLE_NAME: !Ref DownloadUrlShorteningTable
          NVA_PERSISTED_STORAGE_BUCKET_NAME: !Ref ResourceStorageBucketName
          TABLE_NAME: !Ref NvaResourcesTable
          CUSTOM_DOMAIN_BASE_PATH: !Ref CustomDomainBasePath
      Policies:
        - !GetAtt S3AccessResourceStorageManagedPolicy.PolicyArn
        - !GetAtt DatabaseAccessLambdaManagedPolicy.PolicyArn
        - !GetAtt DownloadUrlShorteningTableManagedPolicy.PolicyArn
        - !GetAtt BackendCognitoClientCredentialsSecretManagedPolicy.PolicyArn # because of identityServiceClient::getExternalClient call
      Events:
        AnonymousGetEvent:
          Type: Api
          Properties:
            Path: /{publicationIdentifier}/filelink/{fileIdentifier}
            Method: get
            RestApiId: !Ref NvaPublicationApi

  ResolveShortenedUrlFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub '/aws/lambda/${ResolveShortenedUrlFunction}'
      RetentionInDays: 90

  ResolveShortenedUrlFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-rest
      Handler: no.unit.nva.publication.download.ResolveShortenedUrlHandler::handleRequest
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          SHORTENED_URI_TABLE_NAME: !Ref DownloadUrlShorteningTable
      Policies:
        - !GetAtt DownloadUrlShorteningTableManagedPolicy.PolicyArn
      Events:
        AnonymousGetEvent:
          Type: Api
          Properties:
            Path: /file/{fileIdentifier}
            Method: get
            RestApiId: !Ref NvaPublicationApi

  FetchPublicationLogFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-log
      Handler: no.unit.nva.publication.log.rest.FetchPublicationLogHandler::handleRequest
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          TABLE_NAME: !Ref NvaResourcesTable
      Role: !GetAtt LambdaRole.Arn
      Events:
        GetEvent:
          Type: Api
          Properties:
            Path: /{publicationIdentifier}/log
            Method: get
            RestApiId: !Ref NvaPublicationApi
            
  CreateUploadFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-file
      Environment:
        Variables:
          NVA_PERSISTED_STORAGE_BUCKET_NAME: !Ref ResourceStorageBucketName
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          BACKEND_CLIENT_SECRET_NAME: 'BackendCognitoClientCredentials'
          BACKEND_CLIENT_AUTH_URL: !Ref CognitoAuthorizationUri
          TABLE_NAME: !Ref NvaResourcesTable
      Handler: no.unit.nva.publication.file.upload.CreateUploadHandler::handleRequest
      Policies:
        - !GetAtt MultipartUploadResourceStorageBucketManagedPolicy.PolicyArn
        - !GetAtt BackendCognitoClientCredentialsSecretManagedPolicy.PolicyArn
        - !GetAtt DatabaseAccessLambdaManagedPolicy.PolicyArn
      Events:
        CreateEvent:
          Type: Api
          Properties:
            Path: /{publicationIdentifier}/file-upload/create
            Method: post
            RestApiId: !Ref NvaPublicationApi

  ListPartsUploadFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-file
      Environment:
        Variables:
          NVA_PERSISTED_STORAGE_BUCKET_NAME: !Ref ResourceStorageBucketName
          ALLOWED_ORIGIN: !Ref AllowedOrigins
      Handler: no.unit.nva.publication.file.upload.ListPartsHandler::handleRequest
      Policies:
        - !GetAtt MultipartUploadResourceStorageBucketManagedPolicy.PolicyArn
      Events:
        ListEvent:
          Type: Api
          Properties:
            Path: /{publicationIdentifier}/file-upload/listparts
            Method: post
            RestApiId: !Ref NvaPublicationApi

  PrepareUploadPartFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-file
      Environment:
        Variables:
          NVA_PERSISTED_STORAGE_BUCKET_NAME: !Ref ResourceStorageBucketName
          ALLOWED_ORIGIN: !Ref AllowedOrigins
      Handler: no.unit.nva.publication.file.upload.PrepareUploadPartHandler::handleRequest
      Policies:
        - !GetAtt MultipartUploadResourceStorageBucketManagedPolicy.PolicyArn
      Events:
        PrepareEvent:
          Type: Api
          Properties:
            Path: /{publicationIdentifier}/file-upload/prepare
            Method: post
            RestApiId: !Ref NvaPublicationApi

  AbortUploadFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-file
      Environment:
        Variables:
          NVA_PERSISTED_STORAGE_BUCKET_NAME: !Ref ResourceStorageBucketName
          ALLOWED_ORIGIN: !Ref AllowedOrigins
      Handler: no.unit.nva.publication.file.upload.AbortMultipartUploadHandler::handleRequest
      Policies:
        - !GetAtt MultipartUploadResourceStorageBucketManagedPolicy.PolicyArn
      Events:
        AbortEvent:
          Type: Api
          Properties:
            Path: /{publicationIdentifier}/file-upload/abort
            Method: post
            RestApiId: !Ref NvaPublicationApi

  CompleteUploadFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-file
      Environment:
        Variables:
          NVA_PERSISTED_STORAGE_BUCKET_NAME: !Ref ResourceStorageBucketName
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          BACKEND_CLIENT_SECRET_NAME: 'BackendCognitoClientCredentials'
          BACKEND_CLIENT_AUTH_URL: !Ref CognitoAuthorizationUri
          TABLE_NAME: !Ref NvaResourcesTable
      Handler: no.unit.nva.publication.file.upload.CompleteUploadHandler::handleRequest
      Policies:
        - !GetAtt MultipartUploadResourceStorageBucketManagedPolicy.PolicyArn
        - !GetAtt BackendCognitoClientCredentialsSecretManagedPolicy.PolicyArn
        - !GetAtt DatabaseAccessLambdaManagedPolicy.PolicyArn
      Events:
        CompleteEvent:
          Type: Api
          Properties:
            Path: /{publicationIdentifier}/file-upload/complete
            Method: post
            RestApiId: !Ref NvaPublicationApi

  UpdateFileFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-file
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          BACKEND_CLIENT_SECRET_NAME: 'BackendCognitoClientCredentials'
          BACKEND_CLIENT_AUTH_URL: !Ref CognitoAuthorizationUri
          TABLE_NAME: !Ref NvaResourcesTable
      Handler: no.unit.nva.publication.file.upload.UpdateFileHandler::handleRequest
      Policies:
        - !GetAtt DatabaseAccessLambdaManagedPolicy.PolicyArn
        - !GetAtt BackendCognitoClientCredentialsSecretManagedPolicy.PolicyArn
      Events:
        CompleteEvent:
          Type: Api
          Properties:
            Path: /{publicationIdentifier}/file/{fileIdentifier}
            Method: post
            RestApiId: !Ref NvaPublicationApi

  DeleteFileFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-file
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          BACKEND_CLIENT_SECRET_NAME: 'BackendCognitoClientCredentials'
          BACKEND_CLIENT_AUTH_URL: !Ref CognitoAuthorizationUri
          TABLE_NAME: !Ref NvaResourcesTable
      Handler: no.unit.nva.publication.file.upload.DeleteFileHandler::handleRequest
      Policies:
        - !GetAtt DatabaseAccessLambdaManagedPolicy.PolicyArn
        - !GetAtt BackendCognitoClientCredentialsSecretManagedPolicy.PolicyArn
      Events:
        CompleteEvent:
          Type: Api
          Properties:
            Path: /{publicationIdentifier}/file/{fileIdentifier}
            Method: delete
            RestApiId: !Ref NvaPublicationApi


  #==========================Event Lambda functions====================================================

  BrageMigrationEventConsumer:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: brage-import
      Handler: no.sikt.nva.brage.migration.lambda.BrageEntryEventConsumer::handleRequest
      Role: !GetAtt LambdaRole.Arn
      Timeout: 900
      Environment:
        Variables:
          BRAGE_MIGRATION_ERROR_BUCKET_NAME: !Sub "${BrageMigrationErrorBucketName}-${AWS::AccountId}"
          TABLE_NAME: !Ref NvaResourcesTable
          NVA_PERSISTED_STORAGE_BUCKET_NAME: !Ref ResourceStorageBucketName
          DOMAIN_NAME: !Ref ApiDomain
      Events:
        BrageMigrationEvent:
          Type: S3
          Properties:
            Bucket: !Ref BrageMigrationInputBucket
            Events: 's3:ObjectCreated:*'
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: '.json'
      EventInvokeConfig:
        DestinationConfig:
          OnFailure:
            Type: SQS
            Destination: !GetAtt BrageMigrationDLQ.Arn

  BrageMergingRollbackFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: brage-import
      Handler: no.sikt.nva.brage.migration.lambda.BrageMergingRollbackHandler::handleRequest
      Policies:
        - !GetAtt EventsLambdaManagedPolicy.PolicyArn
        - !GetAtt S3DeleteAccessManagedPolicy.PolicyArn
        - !GetAtt DatabaseAccessLambdaManagedPolicy.PolicyArn
        - !GetAtt S3AccessManagedPolicy.PolicyArn
      Environment:
        Variables:
          BRAGE_MIGRATION_ERROR_BUCKET_NAME: !Sub "${BrageMigrationErrorBucketName}-${AWS::AccountId}"
          TABLE_NAME: !Ref NvaResourcesTable
          NVA_PERSISTED_STORAGE_BUCKET_NAME: !Ref ResourceStorageBucketName
          DOMAIN_NAME: !Ref ApiDomain
          EVENT_BUS_NAME: !GetAtt InternalBus.Name
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            EventBusName: !GetAtt InternalBus.Name
            Pattern:
              detail:
                topic: [ "BrageMerging.Rollback.Request" ]
      EventInvokeConfig:
        DestinationConfig:
          OnFailure:
            Type: SQS
            Destination: !GetAtt BrageMergingRollbackHandlerDLQ.Arn


  NvaScopusFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: scopus-import
      Handler: no.sikt.nva.scopus.ScopusHandler::handleRequest
      Role: !GetAtt LambdaRole.Arn
      Timeout: 900
      ReservedConcurrentExecutions: 50
      Environment:
        Variables:
          API_HOST: !Ref ApiDomain
          TABLE_NAME: !Ref NvaImportCandidatesTable
          PIA_SECRETS_NAME: !Ref PiaRestCredentialsTokenName
          PIA_USERNAME_KEY: !Ref PiaRestUsernameKey
          PIA_PASSWORD_KEY: !Ref PiaRestUsernamePasswordKey
          PIA_REST_API: !Ref PiaRestHost
          SCOPUS_IMPORT_BUCKET: !Sub "${ScopusImportReportBucketName}-${AWS::AccountId}"
          IMPORT_CANDIDATES_STORAGE_BUCKET: !Ref ImportCandidateStorageBucket
          BACKEND_CLIENT_SECRET_NAME: 'BackendCognitoClientCredentials'
          CROSSREF_FETCH_DOI_URI: 'https://api.crossref.org/v1/works/'
      Events:
        Scopus:
          Type: S3
          Properties:
            Bucket: !Ref ScopusXmlBucket
            Events: 's3:ObjectCreated:*'
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: '.xml'

  ScopusDeletionEventEmitter:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: s3-import-commons
      Handler: no.unit.nva.publication.s3imports.DeleteImportCandidatesEventEmitter::handleRequest
      Role: !GetAtt LambdaRole.Arn
      Timeout: 900
      Environment:
        Variables:
          EVENTS_BUCKET: !Ref NvaEventsBucketsName
          EVENT_BUS_NAME: !GetAtt InternalBus.Name
          AWC_ACCOUNT_ID: !Ref AWS::AccountId
          SCOPUS_IMPORT_BUCKET: !Sub "${ScopusImportReportBucketName}-${AWS::AccountId}"
      Events:
        Scopus:
          Type: S3
          Properties:
            Bucket: !Ref ScopusXmlBucket
            Events: 's3:ObjectCreated:*'
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: '.txt'

  DeleteImportCandidateEventConsumer:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.delete.DeleteImportCandidateEventConsumer::handleRequest
      Role: !GetAtt LambdaRole.Arn
      Timeout: 900
      Environment:
        Variables:
          API_HOST: !Ref ApiDomain
          TABLE_NAME: !Ref NvaImportCandidatesTable
          EVENT_BUS_NAME: !GetAtt InternalBus.Name
          EVENTS_BUCKET: !Ref NvaEventsBucketsName
          ALLOWED_ORIGIN: !Ref AllowedOrigins
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            EventBusName: !GetAtt InternalBus.Name
            Pattern:
              detail:
                topic: [ "ImportCandidates.Scopus.Delete" ]
      EventInvokeConfig:
        DestinationConfig:
          OnSuccess:
            Type: EventBridge
            Destination: !Ref NewNvaEventBusArn
          OnFailure:
            Type: SQS
            Destination: !GetAtt DeleteImportCandidateHandlerDLQ.Arn


  DeletionProcessInitializationHandler:
    DependsOn: EventsLambdaManagedPolicy
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.delete.DeletionProcessInitializationHandler::handleRequest
      Role: !GetAtt LambdaRole.Arn
      ReservedConcurrentExecutions: 1
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            EventBusName: !GetAtt InternalBus.Name
            Pattern:
              detail:
                responsePayload:
                  topic:
                    - PublicationService.DoiRequest.Update
      EventInvokeConfig:
        DestinationConfig:
          OnSuccess:
            Type: EventBridge
            Destination: !Ref NewNvaEventBusArn # event is consumed by DoiRegistrar service
          OnFailure:
            Type: SQS
            Destination: !GetAtt DeletePublicationEventProducerDlq.Arn

  LogicallyDeleteEntriesHandler:
    DependsOn: EventsLambdaManagedPolicy
    Type: AWS::Serverless::Function
    Description: 'Listens for Delete event emitted from LogicallyDeleteImportedPublicationsButton. Removes resource from DynamoDB. Parses a DeleteEntryEvent'
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.delete.DeletePublicationHandler::handleRequest
      Role: !GetAtt LambdaRole.Arn
      ReservedConcurrentExecutions: 1
      Environment:
        Variables:
          EVENT_BUS_NAME: !GetAtt InternalBus.Name
          TABLE_NAME: !Ref NvaResourcesTable
          DOMAIN_NAME: !Ref ApiDomain
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            EventBusName: !GetAtt InternalBus.Name
            Pattern:
              detail:
                topic: [ "DeleteEntriesEvent.FileEntry.Delete" ]


  DoiRequestEventProducer:
    DependsOn: EventsLambdaManagedPolicy
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.tickets.DoiRequestEventProducer::handleRequest
      ReservedConcurrentExecutions: 1
      Role: !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          EVENT_BUS_NAME: !GetAtt InternalBus.Name
          AWC_ACCOUNT_ID: !Ref AWS::AccountId
          BASE_PATH: !Ref CustomDomainBasePath
          DOMAIN_NAME: !Ref ApiDomain
          TABLE_NAME: !Ref NvaResourcesTable
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            EventBusName: !GetAtt InternalBus.Name
            Pattern:
              detail:
                responsePayload:
                  topic: [ "PublicationService.DoiRequest.Update" ]
      EventInvokeConfig:
        DestinationConfig:
          OnSuccess:
            Type: EventBridge
            Destination: !Ref NewNvaEventBusArn
          OnFailure:
            Type: SQS
            Destination: !GetAtt DoiRequestEventProducerDLQ.Arn


  ResourceExpansionHandler:
    DependsOn: EventsLambdaManagedPolicy
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.expandresources.ExpandDataEntriesHandler::handleRequest
      Timeout: 200
      Role: !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          EVENTS_BUCKET: !Ref NvaEventsBucketsName
          TABLE_NAME: !Ref NvaResourcesTable
          BACKEND_CLIENT_SECRET_NAME: 'BackendCognitoClientCredentials'
          BACKEND_CLIENT_AUTH_URL: !Ref CognitoAuthorizationUri
          RECOVERY_QUEUE: !Ref RecoveryQueue
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            EventBusName: !GetAtt InternalBus.Name
            Pattern:
              detail:
                responsePayload:
                  topic:
                    - "PublicationService.Resource.Update"
                    - "PublicationService.Message.Update"
                    - "PublicationService.DoiRequest.Update"
                    - "PublicationService.PublishingRequest.Update"
                    - "PublicationService.GeneralSupportRequest.Update"
                    - "PublicationService.UnpublishRequest.Update"
      EventInvokeConfig:
        DestinationConfig:
          OnSuccess:
            Type: EventBridge
            Destination: !GetAtt InternalBus.Arn
          OnFailure:
            Type: SQS
            Destination: !GetAtt ResourceExpansionHandlerDLQ.Arn

  ImportCandidateExpansionHandler:
    DependsOn: EventsLambdaManagedPolicy
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.expandresources.ExpandImportCandidateHandler::handleRequest
      Role: !GetAtt LambdaRole.Arn
      Timeout: 900
      Environment:
        Variables:
          EVENTS_BUCKET: !Ref NvaEventsBucketsName
          PERSISTED_ENTRIES_BUCKET: !Ref ExpandedEntriesPersistenceBucketName
          TABLE_NAME: !Ref NvaImportCandidatesTable
          API_HOST: !Ref ApiDomain
          BACKEND_CLIENT_SECRET_NAME: 'BackendCognitoClientCredentials'
          BACKEND_CLIENT_AUTH_URL: !Ref CognitoAuthorizationUri
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            EventBusName: !GetAtt InternalBus.Name
            Pattern:
              detail:
                responsePayload:
                  topic:
                    - "ImportCandidates.DataEntry.Update"
      EventInvokeConfig:
        DestinationConfig:
          OnSuccess:
            Type: EventBridge
            Destination: !Ref NewNvaEventBusArn
          OnFailure:
            Type: SQS
            Destination: !GetAtt ImportCandidateExpansionHandlerDLQ.Arn

  DeleteImportCandidateEventHandler:
    DependsOn: EventsLambdaManagedPolicy
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.delete.DeleteImportCandidateEventHandler::handleRequest
      Role: !GetAtt LambdaRole.Arn
      ReservedConcurrentExecutions: 1
      Environment:
        Variables:
          EVENTS_BUCKET: !Ref NvaEventsBucketsName
          PERSISTED_ENTRIES_BUCKET: !Ref ExpandedEntriesPersistenceBucketName
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            EventBusName: !GetAtt InternalBus.Name
            Pattern:
              detail:
                responsePayload:
                  topic:
                    - "ImportCandidates.DataEntry.Delete"
      EventInvokeConfig:
        DestinationConfig:
          OnSuccess:
            Type: EventBridge
            Destination: !Ref NewNvaEventBusArn
          OnFailure:
            Type: SQS
            Destination: !GetAtt DeleteImportCandidateEventHandlerDLQ.Arn

  ExpandedResourcesPersistenceHandler:
    DependsOn: EventsLambdaManagedPolicy
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.persistence.ExpandedDataEntriesPersistenceHandler::handleRequest
      Role: !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          EVENTS_BUCKET: !Ref NvaEventsBucketsName
          PERSISTED_ENTRIES_BUCKET: !Ref ExpandedEntriesPersistenceBucketName
          RECOVERY_QUEUE: !Ref RecoveryQueue
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            EventBusName: !GetAtt InternalBus.Name
            Pattern:
              detail:
                responsePayload:
                  topic: [ "PublicationService.ExpandedDataEntry.Update" ]
      EventInvokeConfig:
        DestinationConfig:
          OnSuccess:
            Type: EventBridge
            Destination: !Ref NewNvaEventBusArn
          OnFailure:
            Type: SQS
            Destination: !GetAtt ResourceExpansionHandlerDLQ.Arn
  AnalyticsIntegrationHandler:
    DependsOn: EventsLambdaManagedPolicy
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.persistence.AnalyticsIntegrationHandler::handleRequest
      Role: !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          EVENTS_BUCKET: !Ref NvaEventsBucketsName
          PERSISTED_ENTRIES_BUCKET: !Ref ExpandedEntriesPersistenceBucketName
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            EventBusName: !GetAtt InternalBus.Name
            State: "DISABLED" # disabled for now to avoid extra compute during batch scans for something we don't use
            Pattern:
              detail:
                responsePayload:
                  topic: [ "PublicationService.ExpandedDataEntry.Update" ]
      EventInvokeConfig:
        DestinationConfig:
          OnFailure:
            Type: SQS
            Destination: !GetAtt ResourceExpansionHandlerDLQ.Arn
  AcceptedPublishingRequestHandler:
    DependsOn: EventsLambdaManagedPolicy
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.tickets.AcceptedPublishingRequestEventHandler::handleRequest
      Role: !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          EVENTS_BUCKET: !Ref NvaEventsBucketsName
          TABLE_NAME: !Ref NvaResourcesTable
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            EventBusName: !GetAtt InternalBus.Name
            Pattern:
              detail:
                responsePayload:
                  topic: [ "PublicationService.PublishingRequest.Update" ]

  HandleIdentifierEventHandler:
    DependsOn: EventsLambdaManagedPolicy
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.identifiers.HandleIdentifierEventHandler::handleRequest
      Role: !GetAtt LambdaRole.Arn
      ReservedConcurrentExecutions: 1
      Timeout: 900
      Environment:
        Variables:
          EVENTS_BUCKET: !Ref NvaEventsBucketsName
          TABLE_NAME: !Ref NvaResourcesTable
          API_DOMAIN: !Ref ApiDomain
          HANDLE_BASE_PATH: handle
          BACKEND_CLIENT_SECRET_NAME: 'BackendCognitoClientCredentials'
          BACKEND_CLIENT_AUTH_URL: !Ref CognitoAuthorizationUri
          NVA_FRONTEND_DOMAIN: !Ref NvaApplicationDomain
      Events:
        HandleWorkQueueEvent:
          Type: SQS
          Properties:
            Queue: !GetAtt HandleWorkQueue.Arn

  HandleWorkQueue:
    Type: AWS::SQS::Queue
    Properties:
      VisibilityTimeout: 900 #Equal to or more than HandleIdentifierEventHandler Timeout
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt HandleDLQ.Arn
        maxReceiveCount: 5

  HandleDLQ:
    Type: AWS::SQS::Queue
    Properties:
      MessageRetentionPeriod: 1209600 #14 days

  HandleDLQAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: HandleDLQAlarm in publication-api
      AlarmDescription: If this alarm is triggered, then check sqs messages on publication-api HandleDLQ
      MetricName: ApproximateNumberOfMessagesVisible
      Namespace: AWS/SQS
      Statistic: Sum
      Dimensions:
        - Name: QueueName
          Value: !GetAtt HandleDLQ.QueueName
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      ComparisonOperator: GreaterThanOrEqualToThreshold
      AlarmActions:
        - !Ref SlackSnsArn

  PublicationServiceUpdateRule:
    Type: AWS::Events::Rule
    Properties:
      EventBusName: !GetAtt InternalBus.Name
      Description: "Event rule handle identifier minting. Should not be enabled before ALL migrations are done."
      State: DISABLED
      EventPattern:
        detail:
          responsePayload:
            topic:
              - "PublicationService.Resource.Update"
      Targets:
        - Arn: !GetAtt HandleWorkQueue.Arn
          Id: HandleWorkQueueTarget
          DeadLetterConfig:
            Arn: !GetAtt HandleDLQ.Arn

  HandleWorkQueuePolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref HandleWorkQueue
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: "events.amazonaws.com"
            Action: 'sqs:SendMessage'
            Resource: !GetAtt HandleWorkQueue.Arn
            Condition:
              ArnEquals:
                aws:SourceArn: !GetAtt PublicationServiceUpdateRule.Arn

  PersistLogEntryEventHandler:
    DependsOn: EventsLambdaManagedPolicy
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.log.PersistLogEntryEventHandler::handleRequest
      Timeout: 200
      Policies:
        - !GetAtt BackendCognitoClientCredentialsSecretManagedPolicy.PolicyArn
        - !GetAtt EventsLambdaManagedPolicy.PolicyArn
        - !GetAtt DatabaseAccessLambdaManagedPolicy.PolicyArn
        - !GetAtt S3AccessManagedPolicy.PolicyArn
      Environment:
        Variables:
          EVENTS_BUCKET: !Ref NvaEventsBucketsName
          TABLE_NAME: !Ref NvaResourcesTable
          BACKEND_CLIENT_SECRET_NAME: 'BackendCognitoClientCredentials'
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            EventBusName: !GetAtt InternalBus.Name
            Pattern:
              detail:
                responsePayload:
                  topic: [ "PublicationService.Resource.Update", "PublicationService.FileEntry.Update", "PublicationService.FileEntry.Delete" ]

  EventBasedBatchScanHandlerTest:
    DependsOn: EventsLambdaManagedPolicy
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.batch.EventBasedBatchScanHandler::handleRequest
      Role: !GetAtt LambdaRole.Arn
      Timeout: 900
      ReservedConcurrentExecutions: 1
      Environment:
        Variables:
          EVENT_BUS_NAME: !GetAtt InternalBus.Name
          EVENTS_BUCKET: !Ref NvaEventsBucketsName
          HANDLER_EVENTS_FOLDER: 'ignored'
          TABLE_NAME: !Ref NvaResourcesTable
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            EventBusName: !GetAtt InternalBus.Name
            Pattern:
              detail:
                topic: [ "PublicationService.DataEntry.ScanAndUpdateRowVersion" ]

      EventInvokeConfig:
        DestinationConfig:
          OnSuccess:
            Type: EventBridge
            Destination: !GetAtt InternalBus.Arn
          OnFailure:
            Type: SQS
            Destination: !GetAtt ResourceExpansionHandlerDLQ.Arn

  RecoveryBatchScanHandler:
    DependsOn: EventsLambdaManagedPolicy
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.recovery.RecoveryBatchScanHandler::handleRequest
      Role: !GetAtt LambdaRole.Arn
      Timeout: 900
      ReservedConcurrentExecutions: 1
      Environment:
        Variables:
          EVENT_BUS_NAME: !GetAtt InternalBus.Name
          EVENTS_BUCKET: !Ref NvaEventsBucketsName
          TABLE_NAME: !Ref NvaResourcesTable
          RECOVERY_QUEUE: !Ref RecoveryQueue
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            EventBusName: !GetAtt InternalBus.Name
            Pattern:
              detail:
                topic: [ "PublicationService.Recovery.Refresh" ]

      EventInvokeConfig:
        DestinationConfig:
          OnFailure:
            Type: SQS
            Destination: !GetAtt RecoveryBatchScanHandlerDLQ.Arn

  EventBasedImportCandidateBatchScanHandlerTest:
    DependsOn: EventsLambdaManagedPolicy
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.batch.EventBasedBatchScanHandler::handleRequest
      Role: !GetAtt LambdaRole.Arn
      Timeout: 900
      ReservedConcurrentExecutions: 1
      Environment:
        Variables:
          EVENT_BUS_NAME: !GetAtt InternalBus.Name
          EVENTS_BUCKET: !Ref NvaEventsBucketsName
          HANDLER_EVENTS_FOLDER: 'ignored'
          TABLE_NAME: !Ref NvaImportCandidatesTable
          CRISTIN_UNITS_S3_URI: !Ref CristinUnitsS3ObjectUri
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            EventBusName: !GetAtt InternalBus.Name
            Pattern:
              detail:
                topic: [ "ImportCandidates.DataEntry.ScanAndUpdateRowVersion" ]

      EventInvokeConfig:
        DestinationConfig:
          OnSuccess:
            Type: EventBridge
            Destination: !GetAtt InternalBus.Arn
          OnFailure:
            Type: SQS
            Destination: !GetAtt ImportCandidateBatchScanDLQ.Arn

  DataEntryUpdateHandler:
    DependsOn: EventsLambdaManagedPolicy
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.fanout.DataEntryUpdateHandler::handleRequest
      ReservedConcurrentExecutions: 1
      Role: !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          EVENTS_BUCKET: !Ref NvaEventsBucketsName
          EVENT_BUS_NAME: !GetAtt InternalBus.Name
          HANDLER_EVENTS_FOLDER: "not used"
          RECOVERY_QUEUE: !Ref RecoveryQueue
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            EventBusName: !GetAtt InternalBus.Name
            Pattern:
              detail:
                topic: [ "PublicationService.Database.Update" ]
      EventInvokeConfig:
        DestinationConfig:
          OnSuccess:
            Type: EventBridge
            Destination: !GetAtt InternalBus.Arn
          OnFailure:
            Type: SQS
            Destination: !GetAtt PublicationFanoutHandlerDLQ.Arn

  ImportCandidateDataEntryUpdateHandler:
    DependsOn: EventsLambdaManagedPolicy
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.fanout.ImportCandidateDataEntryUpdateHandler::handleRequest
      ReservedConcurrentExecutions: 1
      Role: !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          EVENTS_BUCKET: !Ref NvaEventsBucketsName
          EVENT_BUS_NAME: !GetAtt InternalBus.Name
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            EventBusName: !GetAtt InternalBus.Name
            Pattern:
              detail:
                topic: [ "ImportCandidates.Database.Update" ]
      EventInvokeConfig:
        DestinationConfig:
          OnSuccess:
            Type: EventBridge
            Destination: !GetAtt InternalBus.Arn
          OnFailure:
            Type: SQS
            Destination: !GetAtt ImportCandidateDataEntryUpdateHandlerDLQ.Arn

  DeleteDraftPublicationHandler:
    DependsOn: EventsLambdaManagedPolicy
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.delete.DeleteDraftPublicationHandler::handleRequest
      Role: !GetAtt DeleteDraftPublicationLambdaRole.Arn
      Environment:
        Variables:
          TABLE_NAME: !Ref NvaResourcesTable
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            EventBusName: !Ref NewNvaEventBusName
            Pattern:
              detail:
                responsePayload:
                  topic:
                    - DoiRegistrarService.Doi.DeletedDraft
                  hasDoi:
                    - false
      EventInvokeConfig:
        DestinationConfig:
          OnSuccess:
            Type: EventBridge
            Destination: !GetAtt InternalBus.Arn
          OnFailure:
            Type: SQS
            Destination: !GetAtt DeleteDraftPublicationHandlerDLQ.Arn


  DynamodbStreamToEventBridgeHandler:
    Type: AWS::Serverless::Function
    DependsOn:
      - DatabaseAccessLambdaManagedPolicy
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.dynamodbstream.DynamodbStreamToEventBridgeHandler::handleRequest
      Timeout: 360
      Tracing: Active
      ReservedConcurrentExecutions: 1
      Role: !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          EVENTS_BUCKET: !Ref NvaEventsBucketsName
          DLQ_URL: !Ref DynamodbEventFanoutStreamRecordsDLQ
          MAX_ATTEMPT: !Ref EventBridgeMaxAttempt
          EVENT_BUS_NAME: !GetAtt InternalBus.Name
          OUTPUT_EVENT_TOPIC: 'PublicationService.Database.Update'
      Events:
        FanoutSource:
          Type: DynamoDB
          Properties:
            Stream: !GetAtt NvaResourcesTable.StreamArn
            StartingPosition: TRIM_HORIZON
            BatchSize: 1
            Enabled: true

  ImportCandidateDynamodbStreamToEventBridgeHandler:
    Type: AWS::Serverless::Function
    DependsOn:
      - DatabaseAccessLambdaManagedPolicy
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.dynamodbstream.DynamodbStreamToEventBridgeHandler::handleRequest
      Timeout: 360
      Tracing: Active
      ReservedConcurrentExecutions: 1
      Role: !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          EVENTS_BUCKET: !Ref NvaEventsBucketsName
          DLQ_URL: !Ref DynamodbEventFanoutStreamRecordsDLQ
          MAX_ATTEMPT: !Ref EventBridgeMaxAttempt
          EVENT_BUS_NAME: !GetAtt InternalBus.Name
          OUTPUT_EVENT_TOPIC: 'ImportCandidates.Database.Update'
      Events:
        FanoutSource:
          Type: DynamoDB
          Properties:
            Stream: !GetAtt NvaImportCandidatesTable.StreamArn
            StartingPosition: TRIM_HORIZON
            BatchSize: 1
            Enabled: true


  UpdateDoiStatusHandlerFunction:
    DependsOn: EventsLambdaManagedPolicy
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.tickets.UpdateDoiStatusHandler::handleRequest
      Role: !GetAtt UpdateDoiStatusLambdaRole.Arn
      Environment:
        Variables:
          TABLE_NAME: !Ref NvaResourcesTable
          AWC_ACCOUNT_ID: !Ref AWS::AccountId
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            EventBusName: !Ref NewNvaEventBusName
            Pattern:
              detail:
                responsePayload:
                  topic:
                    - DoiRegistrarService.Doi.Updated
      EventInvokeConfig:
        DestinationConfig:
          OnFailure:
            Type: SQS
            Destination: !GetAtt UpdateDoiStatusDLQ.Arn


  CristinEntriesEventEmitter:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: s3-import-commons
      Handler: no.unit.nva.publication.s3imports.FileEntriesEventEmitter::handleRequest
      Timeout: 600 # 10 min timeout
      ReservedConcurrentExecutions: 50
      Role: !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          AWC_ACCOUNT_ID: !Ref AWS::AccountId
          TABLE_NAME: !Ref NvaResourcesTable
          EVENT_BUS_NAME: !GetAtt InternalBus.Name
          BATCH_EMISSION_INTERVAL_MILLIS: 700
          CRISTIN_IMPORT_DATA_ENTRY_QUEUE_URL: !Ref CristinImportDataEntryQueue
          CRISTIN_IMPORT_PATCH_QUEUE_URL: !Ref CristinImportPatchQueue
          CRISTIN_IMPORT_NVI_PATCH_QUEUE_URL: !Ref CristinImportNviPatchQueueUrl
          BRAGE_IMPORT_PATCH_QUEUE_URL: !Ref BrageImportPatchQueue
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            EventBusName: !GetAtt InternalBus.Name
            Pattern:
              detail:
                topic: [ "PublicationService.DataImport.Filename" ]
                subtopic: [ "PublicationService.CristinData.DataEntry", "PublicationService.CristinData.PatchEntry", "PublicationService.CristinData.NviPatch", "PublicationService.BrageData.PatchEntry" ]

  DeleteFileEventHandler:
    DependsOn: EventsLambdaManagedPolicy
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.delete.DeleteFileEventHandler::handleRequest
      Environment:
        Variables:
          EVENTS_BUCKET: !Ref NvaEventsBucketsName
          EVENT_BUS_NAME: !GetAtt InternalBus.Name
          TABLE_NAME: !Ref NvaResourcesTable
          NVA_PERSISTED_STORAGE_BUCKET_NAME: !Ref ResourceStorageBucketName
      Policies:
        - !GetAtt EventsLambdaManagedPolicy.PolicyArn
        - !GetAtt S3AccessManagedPolicy.PolicyArn
        - !GetAtt S3DeleteAccessManagedPolicy.PolicyArn
        - !GetAtt DatabaseAccessLambdaManagedPolicy.PolicyArn
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            EventBusName: !GetAtt InternalBus.Name
            Pattern:
              detail:
                responsePayload:
                  topic:
                    - PublicationService.FileEntry.Delete
      EventInvokeConfig:
        DestinationConfig:
          OnSuccess:
            Type: EventBridge
            Destination: !GetAtt InternalBus.Arn
          OnFailure:
            Type: SQS
            Destination: !GetAtt DeleteFileFromS3EventHandlerDLQ.Arn

  #==========================Manually triggered functions=============================================

  BatchScanStartHandler:
    DependsOn: EventsLambdaManagedPolicy
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.batch.BatchScanStartHandler::handleRequest
      Timeout: 60
      Role: !GetAtt LambdaRole.Arn
      ReservedConcurrentExecutions: 1
      Environment:
        Variables:
          EVENT_BUS_NAME: !GetAtt InternalBus.Name
          EVENTS_BUCKET: !Ref NvaEventsBucketsName
          HANDLER_EVENTS_FOLDER: 'ignored'
          OUTPUT_EVENT_TOPIC: 'PublicationService.DataEntry.ScanAndUpdateRowVersion'

  ManuallyUpdatePublicationsHandler:
    DependsOn: EventsLambdaManagedPolicy
    Type: AWS::Serverless::Function
    Description: 'Lambda function to update publications fetched from search-api'
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.batch.ManuallyUpdatePublicationsHandler::handleRequest
      Timeout: 900
      Role: !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          TABLE_NAME: !Ref NvaResourcesTable
          API_HOST: !Ref ApiDomain


  ImportCandidatesBatchScanStartHandler:
    DependsOn: EventsLambdaManagedPolicy
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: publication-event-handlers
      Handler: no.unit.nva.publication.events.handlers.batch.BatchScanStartHandler::handleRequest
      Timeout: 60
      Role: !GetAtt LambdaRole.Arn
      ReservedConcurrentExecutions: 1
      Environment:
        Variables:
          EVENT_BUS_NAME: !GetAtt InternalBus.Name
          EVENTS_BUCKET: !Ref NvaEventsBucketsName
          HANDLER_EVENTS_FOLDER: 'ignored'
          OUTPUT_EVENT_TOPIC: 'ImportCandidates.DataEntry.ScanAndUpdateRowVersion'

  StartCristinImportButton:
    Type: AWS::Serverless::Function
    Properties:
      Description: 'Starts Cristin Import. Accepts Json object with "uri" field'
      CodeUri: s3-import-commons
      Handler: no.unit.nva.publication.s3imports.FilenameEventEmitter::handleRequest
      Timeout: 900 # 15 min timeout
      ReservedConcurrentExecutions: 1
      Role: !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          AWC_ACCOUNT_ID: !Ref AWS::AccountId
          TABLE_NAME: !Ref NvaResourcesTable
          EVENT_BUS_NAME: !GetAtt InternalBus.Name
          BATCH_EMISSION_INTERVAL_MILLIS: 700
          CRISTIN_IMPORT_DATA_ENTRY_QUEUE_URL: !Ref CristinImportDataEntryQueue
          CRISTIN_IMPORT_PATCH_QUEUE_URL: !Ref CristinImportPatchQueue

  CristinRerunErrorsEventEmitter:
    Type: AWS::Serverless::Function
    Properties:
      Description: 'Reruns cristin-import entries that have failed under import. Takes uri with s3 errors location as input'
      CodeUri: cristin-import
      Handler: no.unit.nva.cristin.lambda.CristinRerunErrorsEventEmitter::handleRequest
      Timeout: 900 # 15 min timeout
      ReservedConcurrentExecutions: 1
      Policies:
        - !GetAtt EventsLambdaManagedPolicy.PolicyArn
        - !GetAtt S3DeleteAccessManagedPolicy.PolicyArn
        - !GetAtt S3AccessManagedPolicy.PolicyArn
      Environment:
        Variables:
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          CRISTIN_IMPORT_BUCKET: !Sub 'cristin-import-${AWS::AccountId}'
          CRISTIN_IMPORT_DATA_ENTRY_QUEUE_URL: !Ref CristinImportDataEntryQueue

  LogicallyDeleteImportedPublicationsButton:
    Type: AWS::Serverless::Function
    Properties:
      Description: 'Starts Batch logically delete publication. Accepts Json object with "uri" field pointing to a s3 path containing objects keys corresponding to publication ids that should be deleted.'
      CodeUri: s3-import-commons
      Handler: no.unit.nva.publication.s3imports.DeleteEntriesEventEmitter::handleRequest
      Timeout: 900 # 15 min timeout
      ReservedConcurrentExecutions: 1
      Role: !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          AWC_ACCOUNT_ID: !Ref AWS::AccountId # batch-event emitter needs to know the aws-account.
          EVENT_BUS_NAME: !GetAtt InternalBus.Name
          BATCH_EMISSION_INTERVAL_MILLIS: 700

  DoiToReferenceDoiUpdateButton:
    Type: AWS::Serverless::Function
    Properties:
      Description: 'Accepts Json object with "uri" field pointing to a s3 bucket containing results.csv file.'
      CodeUri: s3-import-commons
      Handler: no.unit.nva.publication.s3imports.DoiToReferenceDoiUpdateEventEmitter::handleRequest
      Timeout: 900 # 15 min timeout
      ReservedConcurrentExecutions: 1
      Role: !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          TABLE_NAME: !Ref NvaResourcesTable
          EVENT_BUS_NAME: !GetAtt InternalBus.Name

  ReserveDoiHandler:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: datacite-commons
      Handler: no.unit.nva.doi.handlers.ReserveDoiHandler::handleRequest
      Environment:
        Variables:
          BACKEND_CLIENT_SECRET_NAME: 'BackendCognitoClientCredentials'
          ALLOWED_ORIGIN: !Ref AllowedOrigins
          TABLE_NAME: !Ref NvaResourcesTable
      Role: !GetAtt LambdaRole.Arn
      Events:
        GetEvent:
          Type: Api
          Properties:
            Path: /{publicationIdentifier}/doi
            Method: post
            RestApiId: !Ref NvaPublicationApi


  ScopusUnzipperFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: index.lambda_handler
      Runtime: python3.12
      Timeout: 900
      Environment:
        Variables:
          XML_BUCKET_NAME: !Ref ScopusXmlBucket
      PackageType: Zip
      InlineCode: |
        import boto3, zipfile, os
        from io import BytesIO
        def lambda_handler(event, context):
            xml_bucket = os.environ['XML_BUCKET_NAME']
            zip_bucket = event['Records'][0]['s3']['bucket']['name']
            zip_file = event['Records'][0]['s3']['object']['key']
            client = boto3.client('s3')
            resource = boto3.resource('s3')
            zip_object = resource.Object(bucket_name=zip_bucket, key=zip_file)
            buffer = BytesIO(zip_object.get()['Body'].read())
            z = zipfile.ZipFile(buffer)
            for fname in z.namelist():
                client.put_object(
                    Body=z.open(fname).read(),
                    Bucket=zip_bucket if fname.endswith('.zip') else xml_bucket,
                    Key=f'unzipped/{fname}' if fname.endswith('.zip') else fname
                )
      Role: !GetAtt LambdaRole.Arn
      Events:
        UnzipEvent:
          Type: S3
          Properties:
            Bucket: !Ref ScopusZipBucket
            Events: s3:ObjectCreated:*
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: '.zip'

  #============================ SQS QUEUE LAMBDAS =====================================================================#
  # Lambdas triggered by push messages to SQS queues
  #====================================================================================================================#

  CristinImportDataEntryQueue:
    Type: "AWS::SQS::Queue"
  CristinImportPatchQueue:
    Type: "AWS::SQS::Queue"
  CristinImportDLQ:
    Type: "AWS::SQS::Queue"
  BrageImportPatchQueue:
    Type: "AWS::SQS::Queue"
  BrageMigrationDLQ:
    Type: "AWS::SQS::Queue"

  CristinEntriesSQSConsumer:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: cristin-import
      Handler: no.unit.nva.cristin.lambda.CristinEntryEventConsumer::handleRequest
      Timeout: 30
      Role: !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          AWC_ACCOUNT_ID: !Ref AWS::AccountId
          TABLE_NAME: !Ref NvaResourcesTable
          BATCH_EMISSION_INTERVAL_MILLIS: 0
          DOMAIN_NAME: !Ref ApiDomain
          EVENT_BUS_NAME: !GetAtt InternalBus.Name
          CRISTIN_UNITS_S3_OBJECT_URI: !Ref CristinUnitsS3ObjectUri
          CRISTIN_IMPORT_BUCKET: !Sub 'cristin-import-${AWS::AccountId}'
      Events:
        SqsEvent:
          Type: SQS
          Properties:
            Queue: !GetAtt CristinImportDataEntryQueue.Arn
            BatchSize: 1
            ScalingConfig:
              MaximumConcurrency: 50
      EventInvokeConfig:
        MaximumRetryAttempts: 0


  CristinEntriesPatchSqsConsumer:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: cristin-import
      Handler: no.unit.nva.cristin.lambda.CristinPatchEventConsumer::handleRequest
      Timeout: 30
      Role: !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          EVENT_BUS_NAME: !GetAtt InternalBus.Name
          AWC_ACCOUNT_ID: !Ref AWS::AccountId
          TABLE_NAME: !Ref NvaResourcesTable
          BATCH_EMISSION_INTERVAL_MILLIS: 0
          DOMAIN_NAME: !Ref ApiDomain
      Events:
        SqsEvent:
          Type: SQS
          Properties:
            Queue: !GetAtt CristinImportPatchQueue.Arn
            BatchSize: 1
            ScalingConfig:
              MaximumConcurrency: 50
      EventInvokeConfig:
        MaximumRetryAttempts: 0

  BrageEntriesPatchSqsConsumer:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: brage-import
      Handler: no.sikt.nva.brage.migration.lambda.BragePatchEventConsumer::handleRequest
      Timeout: 30
      Role: !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          EVENT_BUS_NAME: !GetAtt InternalBus.Name
          AWC_ACCOUNT_ID: !Ref AWS::AccountId
          TABLE_NAME: !Ref NvaResourcesTable
          BATCH_EMISSION_INTERVAL_MILLIS: 0
          DOMAIN_NAME: !Ref ApiDomain
          BRAGE_MIGRATION_ERROR_BUCKET_NAME: !Sub "${BrageMigrationErrorBucketName}-${AWS::AccountId}"
      Events:
        SqsEvent:
          Type: SQS
          Properties:
            Queue: !GetAtt BrageImportPatchQueue.Arn
            BatchSize: 1
            ScalingConfig:
              MaximumConcurrency: 50
      EventInvokeConfig:
        MaximumRetryAttempts: 0

  #=============================Internal Event Bus=============================================================
  InternalBus:
    Type: AWS::Events::EventBus
    Properties:
      Name: !Join [ '',[ 'resource-service-internal-bus',!Ref Suffix ] ]

  #=========================Cristin-Brage-Athena===================================================================

  CristinImportDatabase:
    Type: AWS::Glue::Database
    Properties:
      CatalogId: !Ref AWS::AccountId
      DatabaseInput:
        Description: Read-only database mirroring the data in S3 bucket for expanded resources
        Name: cristin

  BrageImportDatabase:
    Type: AWS::Glue::Database
    Properties:
      CatalogId: !Ref AWS::AccountId
      DatabaseInput:
        Description: Read-only database mirroring the data in S3 bucket for brage errors
        Name: brage-errors

  CristinCrawler:
    Type: AWS::Glue::Crawler
    Properties:
      Configuration: >
        {
            "Version":1.0,
            "Grouping":{
              "TableLevelConfiguration":2
            }
        }
      DatabaseName: !Ref    CristinImportDatabase
      Description: Crawler that crawls the s3 bucket of the cristin data
      Name: CristinCrawler
      RecrawlPolicy:
        RecrawlBehavior: CRAWL_EVERYTHING
      Role: !GetAtt CristinCrawlerRole.Arn
      SchemaChangePolicy:
        DeleteBehavior: DELETE_FROM_DATABASE
        UpdateBehavior: UPDATE_IN_DATABASE
      Targets:
        S3Targets:
          - Path: !Sub 's3://cristin-import-${AWS::AccountId}/2022-10-18'

  BrageErrorCrawler:
    Type: AWS::Glue::Crawler
    Properties:
      Configuration: >
        {
            "Version":1.0,
            "Grouping":{
              "TableLevelConfiguration":3
            }
        }
      DatabaseName: !Ref    BrageImportDatabase
      Description: Crawler that crawls the s3 bucket of the brage reports data
      Name: BrageErrorCrawler
      RecrawlPolicy:
        RecrawlBehavior: CRAWL_EVERYTHING
      Role: !GetAtt CristinCrawlerRole.Arn
      SchemaChangePolicy:
        DeleteBehavior: DELETE_FROM_DATABASE
        UpdateBehavior: UPDATE_IN_DATABASE
      Targets:
        S3Targets:
          - Path: !Sub 's3://brage-migration-reports-884807050265/ERROR/2023-07-25:14/'
            Exclusions: [ '*.error' ]



  CristinWorkgroup:
    Type: AWS::Athena::WorkGroup
    Properties:
      Description: A workgroup for quering Cristin data and import errors
      Name: CristinAthenaWorkgroup
      RecursiveDeleteOption: true
      State: ENABLED
      WorkGroupConfiguration:
        EnforceWorkGroupConfiguration: false
        ResultConfiguration:
          OutputLocation: !Sub "s3://${AthenaQueriesBucketName}/results"

  CristinErrorsCrawler:
    Type: AWS::Glue::Crawler
    Properties:
      Configuration: >
        {
            "Version":1.0,
            "Grouping":{
              "TableLevelConfiguration":3
            }
        }
      DatabaseName: !Ref    CristinImportDatabase
      Description: Crawler that crawls the s3 bucket of the cristin data
      Name: CristinImportErrorCrawler
      RecrawlPolicy:
        RecrawlBehavior: CRAWL_EVERYTHING
      Role: !GetAtt CristinCrawlerRole.Arn
      SchemaChangePolicy:
        DeleteBehavior: DELETE_FROM_DATABASE
        UpdateBehavior: UPDATE_IN_DATABASE
      Targets:
        S3Targets:
          - Path: !Sub 's3://cristin-import-${AWS::AccountId}/errors/2022-10-31T15:04:41.245923Z'
            Exclusions: [ '*.error' ]


  CristinPatchErrorsCrawler:
    Type: AWS::Glue::Crawler
    Properties:
      Configuration: >
        {
            "Version":1.0,
            "Grouping":{
              "TableLevelConfiguration":6
            }
        }
      DatabaseName: !Ref    CristinImportDatabase
      Description: Crawler that crawls the s3 bucket of the cristin patch errors
      Name: CristinPatchErrorCrawler
      RecrawlPolicy:
        RecrawlBehavior: CRAWL_EVERYTHING
      Role: !GetAtt CristinCrawlerRole.Arn
      SchemaChangePolicy:
        DeleteBehavior: DELETE_FROM_DATABASE
        UpdateBehavior: UPDATE_IN_DATABASE
      Targets:
        S3Targets:
          - Path: !Sub 's3://cristin-import-884807050265/PATCH_ERRORS/2023-02-17T15:06:19.291467Z'
            Exclusions: [ '*.error' ]



  ImportQuery:
    Type: AWS::Athena::NamedQuery
    Properties:
      Database: !Ref  AnalyticsExportDatabase
      Description: >
        Lowercase all field names so that the CristinEntryEventConsumer importer will work.
        Athena lowercases all field names and we cannot change this for now. So if we want
        to test the import with small datasets we have to do this.
      Name: Lowercase-field-names
      # external_location is the output folder
      QueryString: >
        CREATE TABLE "cristin"."lower_cased_dataset"
        with (
        external_location ='s3://cristin-import-AccountId/lower-cased-dataset-folder',
        bucket_count = 2000,
        bucketed_by = ARRAY['id'],
        format = 'JSON',
        write_compression='GZIP')
        as
        SELECT * FROM "cristin"."not_lowercased_dataset"
      WorkGroup: !Ref CristinWorkgroup

  CristinCrawlerRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - glue.amazonaws.com
            Action: sts:AssumeRole
      Path: "/"
      ManagedPolicyArns: [ 'arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole' ]
      Policies:
        - PolicyName: CrawlerReadsPersistedMetadataPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - s3:GetObject
                  - s3:ListBucket
                  - s3:PutObject
                Resource:
                  - !Sub "arn:aws:s3:::cristin-import-${AWS::AccountId}/*"
                  - !Sub "arn:aws:s3:::brage-migration-reports-${AWS::AccountId}/*"
                  - !Sub "arn:aws:s3:::brage-migration-input-files-${AWS::AccountId}/*"


  #==========================BI=============================================================================
  AnalyticsExportDatabase:
    Type: AWS::Glue::Database
    Properties:
      CatalogId: !Ref AWS::AccountId
      DatabaseInput:
        Description: Read-only database mirroring the data in S3 bucket for expanded resources
        Name: nva

  PublicationsCrawler:
    Type: AWS::Glue::Crawler
    Properties:
      DatabaseName: !Ref  AnalyticsExportDatabase
      # Minimum table level configuration is currently 3 because the crawler looks at the path
      # /bucketName/analytics/publications which is level 3.
      # More info here: https://docs.aws.amazon.com/glue/latest/dg/crawler-configuration.html
      Configuration: >
        {
            "Version":1.0,
            "Grouping":{
              "TableLevelConfiguration":3
            }
        }
      Description: Crawler that crawls the s3 bucket of persited publication metadata
      Name: PublicationsCrawler
      RecrawlPolicy:
        RecrawlBehavior: CRAWL_EVERYTHING
      Role: !GetAtt PublicationsCrawlerRole.Arn
      SchemaChangePolicy:
        DeleteBehavior: DELETE_FROM_DATABASE
        UpdateBehavior: UPDATE_IN_DATABASE
      Targets:
        S3Targets:
          - Path: !Sub 's3://${ExpandedEntriesPersistenceBucketName}/analytics/publications'

  AthenaWorkgroup:
    Type: AWS::Athena::WorkGroup
    Properties:
      Description: A workgroup for any service/user that queries NVA data through Athena
      Name: NvaAthenaWorkgroup
      RecursiveDeleteOption: true
      State: ENABLED
      WorkGroupConfiguration:
        EnforceWorkGroupConfiguration: true
        ResultConfiguration:
          OutputLocation: !Sub "s3://${AthenaQueriesBucketName}/results"

  BiQuery:
    Type: AWS::Athena::NamedQuery
    Properties:
      Database: !Ref  AnalyticsExportDatabase
      Description: Currently nothing special. To be the view used by BI
      Name: BI Query
      QueryString: >
        CREATE OR REPLACE VIEW demo_view_nested_fields AS
        SELECT entitydescription.maintitle, contributor.identity.name
        FROM "nva"."publications"
        CROSS JOIN unnest(entitydescription.contributors) as t(contributor)
        limit 20
      WorkGroup: !Ref AthenaWorkgroup

  PublicationsCrawlerRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - glue.amazonaws.com
            Action: sts:AssumeRole
      Path: "/"
      ManagedPolicyArns: [ 'arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole' ]
      Policies:
        - PolicyName: CrawlerReadsPersistedMetadataPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - s3:GetObject
                  - s3:ListBucket
                  - s3:PutObject
                Resource:
                  - !Sub "arn:aws:s3:::persisted-resources-${AWS::AccountId}/"
                  - !Sub "arn:aws:s3:::persisted-resources-${AWS::AccountId}/*"


  #===========================BasePathMappings========================================================

  NvaPublicationBasePathMapping:
    Type: AWS::ApiGateway::BasePathMapping
    Properties:
      BasePath: !If
        - WithSuffix
        - !Sub ${CustomDomainBasePath}-${Suffix}
        - !Sub ${CustomDomainBasePath}
      DomainName: !Ref ApiDomain
      RestApiId: !Ref NvaPublicationApi
      Stage: !Ref NvaPublicationApi.Stage


  #============================S3 buckets===============================================================

  BrageMigrationInputBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "${BrageMigrationInputBucketName}-${AWS::AccountId}"
      LifecycleConfiguration:
        Rules:
          - Id: DeleteContentAfter3Days
            Status: Enabled
            ExpirationInDays: 3

  BrageMigrationErrorBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "${BrageMigrationErrorBucketName}-${AWS::AccountId}"

  ScopusZipBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "${ScopusZipBucketName}-${AWS::AccountId}"
      LifecycleConfiguration:
        Rules:
          - Id: DeleteContentAfter3Days
            Status: Enabled
            ExpirationInDays: 3
            Prefix: 'unzipped'

  ScopusXmlBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "${ScopusXmlBucketName}-${AWS::AccountId}"
      LifecycleConfiguration:
        Rules:
          - Id: DeleteContentAfter3Days
            Status: Enabled
            ExpirationInDays: 3

  ImportCandidateStorageBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "${ImportCandidateStorageBucketName}-${AWS::AccountId}"

  ScopusImportReportBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "${ScopusImportReportBucketName}-${AWS::AccountId}"


  #============================Alarms===============================================================

  RecoveryQueueAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: Publication-api recovery queue threshold exceeded
      AlarmDescription: If this alarm is triggered, then check sqs messages on publication-api recovery queue.
      MetricName: ApproximateNumberOfMessagesVisible
      Namespace: AWS/SQS
      Statistic: Sum
      Dimensions:
        - Name: QueueName
          Value: !GetAtt RecoveryQueue.QueueName
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      ComparisonOperator: GreaterThanOrEqualToThreshold
      AlarmActions:
        - !Ref SlackSnsArn