data "terraform_remote_state" "shared" {
  backend = "s3"
  config = {
    bucket = "assessment-model-terraform-state"
    key    = "env:/${var.stage}/terraform.tfstate"
    region = "eu-west-2"
  }
}

data "aws_secretsmanager_secret_version" "db_credentials" {
  secret_id = "${var.stage}/assessment_model/db_credentials"
}

locals {
  db_credentials = jsondecode(data.aws_secretsmanager_secret_version.db_credentials.secret_string)
}

module "lambda" {
  source = "../../modules/lambda_with_sqs"

  name  = "landlord-description-overrides"
  stage = var.stage

  image_uri = local.image_uri

  # The classifier calls OpenAI once per distinct description per column, so it
  # is latency-bound. 300s leaves headroom under the queue's 1000s visibility
  # timeout. batch_size = 1 keeps one upload per invocation, so a single bad
  # record cannot redrive its siblings. maximum_concurrency caps fan-out to
  # respect OpenAI rate limits.
  timeout             = 300
  batch_size          = 1
  maximum_concurrency = 5

  environment = merge(
    {
      STAGE             = var.stage
      LOG_LEVEL         = "info"
      POSTGRES_USERNAME = local.db_credentials.db_assessment_model_username
      POSTGRES_PASSWORD = local.db_credentials.db_assessment_model_password
      OPENAI_API_KEY    = var.openai_api_key
    },
  )
}

# Attach S3 read policy so the handler can read the original upload CSV.
resource "aws_iam_role_policy_attachment" "landlord_overrides_s3_read" {
  role       = module.lambda.role_name
  policy_arn = data.terraform_remote_state.shared.outputs.landlord_overrides_s3_read_arn
}