template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: >
  Backend API for Managing Game Knight events

Parameters:
  Mode:
    Type: String
    Description: Mode of deployment
    AllowedValues:
      - prod
      - dev
      - sandbox

  Stage:
    Type: String
    Default: Staging
    Description: API Stage

  # CognitoUserPoolArn:
  #   Type: String
  #   Default: arn:aws:cognito-idp:us-east-1:569879156317:userpool/us-east-1_Okkk4SAZX
  #   Description: Cognito User Pool Arn

Conditions:
  # isDev: !Equals [!Ref Mode, dev]
  isNotProd: !Not [!Equals [!Ref Mode, prod]]

Mappings:
  EnvMap:
    prod:
      # CloudFrontS3Bucket: cdkstack-bucket83908e77-7tr0zgs93uwh
      EventsTableName: game_events
      ApiGatewayName: Game Knights Events API
      OwnerTag: EventsAPI
      StackName: GameKnightsEventsAPI
      UserPoolEnv: prod
    dev:
      # CloudFrontS3Bucket: cdkstack-bucketdevff8a9acd-pine3ubqpres
      EventsTableName: game_events_dev
      ApiGatewayName: Game Knights Events API DEV
      OwnerTag: DevEventsAPI
      StackName: DEVGameKnightsEventsAPI
      UserPoolEnv: prod
    sandbox:
      # CloudFrontS3Bucket:
      EventsTableName: game_events_sandbox
      ApiGatewayName: Game Knights Events API Sandbox
      OwnerTag: SandboxEventsAPI
      StackName: SandboxGameKnightsEventsAPI
      UserPoolEnv: sandbox

Resources:
  EventsApiGateway:
    Type: AWS::Serverless::Api
    Properties:
      Name: !FindInMap [EnvMap, !Ref Mode, ApiGatewayName]
      StageName: !Ref Stage
      MethodSettings:
        - LoggingLevel: INFO
          ResourcePath: "/*" # allows for logging on any resource
          HttpMethod: "*" # allows for logging on any method
      # Cognito pool auth
      Auth:
        DefaultAuthorizer: CognitoPasswordless
        Authorizers:
          CognitoPasswordless:
            # UserPoolArn: !Ref CognitoUserPoolArn
            # UserPoolArn: !Sub "{{resolve:ssm:/cubesandcardboard/combined/userpool/arn}}"
            # UserPoolArn: !Sub "{{resolve:ssm:/cubesandcardboard/${Mode}/userpool/arn}}"
            UserPoolArn: !Sub
              - "{{resolve:ssm:/cubesandcardboard/${env}/userpool/arn}}"
              - env: !FindInMap [EnvMap, !Ref Mode, UserPoolEnv]
      Cors: "'*'"
      EndpointConfiguration:
        Type: EDGE
      Tags:
        Owner: !FindInMap [EnvMap, !Ref Mode, OwnerTag]
      DefinitionBody:
        "Fn::Transform":
          Name: "AWS::Include"
          Parameters:
            Location: "swagger.yaml"
            # Location: s3://cp-sam-deploy-east1/swagger.yaml
  # EventsApiGatewaySSM:
  #   Type: AWS::SSM::Parameter
  #   Properties:
  #     Name: !Sub "/cubesandcardboard/${Mode}/events-api"
  #     Type: String
  #     Value: !Sub "https://${EventsApiGateway}.execute-api.${AWS::Region}.amazonaws.com/${Stage}"
  #     Description: !Sub "API Gateway URL for ${Mode}"
  EventsApiGatewayFqdnSSM:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub "/cubesandcardboard/${Mode}/events-api/fqdn"
      Type: String
      Value: !Sub "${EventsApiGateway}.execute-api.${AWS::Region}.amazonaws.com"
      Description: !Sub "API Gateway FQDN for ${Mode}"
  EventsApiGatewayStageSSM:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub "/cubesandcardboard/${Mode}/events-api/stage"
      Type: String
      Value: !Ref Stage
      Description: !Sub "API Gateway URL for ${Mode}"

  # EventsApiGatewayCloudWatchRole:
  #   Type: AWS::IAM::Role
  #   Properties:
  #     RoleName: !Sub "game-knights-events-api-gateway-cloudwatch-role-${Mode}"
  #     AssumeRolePolicyDocument:
  #       Version: "2012-10-17"
  #       Statement:
  #         - Effect: Allow
  #           Principal:
  #             Service: apigateway.amazonaws.com

  EventsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !FindInMap [EnvMap, !Ref Mode, EventsTableName]
      AttributeDefinitions:
        - AttributeName: "event_id"
          AttributeType: "S"
        - AttributeName: "event_type"
          AttributeType: "S"
        - AttributeName: "date"
          AttributeType: "S"
      KeySchema:
        - AttributeName: "event_id"
          KeyType: "HASH"
      GlobalSecondaryIndexes:
        - IndexName: EventTypeByDate
          KeySchema:
            - AttributeName: "event_type"
              KeyType: "HASH"
            - AttributeName: "date"
              KeyType: "RANGE"
          Projection:
            ProjectionType: "ALL"
      BillingMode: PAY_PER_REQUEST
      Tags:
        - Key: Name
          Value: !FindInMap [EnvMap, !Ref Mode, EventsTableName]
        - Key: Owner
          Value: !FindInMap [EnvMap, !Ref Mode, OwnerTag]

  # API Backend Bucket
  BackendBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "${Mode}-cubes-and-cardboard-backend"
      Tags:
        - Key: Owner
          Value: !FindInMap [EnvMap, !Ref Mode, OwnerTag]

  RsvpAlertsScheduleGroup:
    Type: AWS::Scheduler::ScheduleGroup
    Properties:
      Name: !Sub rsvp_alerts_${Mode}
      Tags:
        - Key: Owner
          Value: !FindInMap [EnvMap, !Ref Mode, OwnerTag]

  ReservedRsvpRefreshScheduleGroup:
    Type: AWS::Scheduler::ScheduleGroup
    Properties:
      Name: !Sub reserved_rsvp_refresh_${Mode}
      Tags:
        - Key: Owner
          Value: !FindInMap [EnvMap, !Ref Mode, OwnerTag]

  ReservedRsvpRefreshScheduleRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub reserved_rsvp_refresh_scheduler_role_${Mode}
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: scheduler.amazonaws.com
            Action: sts:AssumeRole
      Description: !Sub Role used by reserved_rsvp_refresh_${Mode} schedules
      Policies:
        - PolicyName: InvokeManageEventsFunction
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Action: lambda:InvokeFunction
                Resource: !GetAtt ManageEventsFunction.Arn
                Effect: Allow
      Tags:
        - Key: Owner
          Value: !FindInMap [EnvMap, !Ref Mode, OwnerTag]

  RsvpAlertsScheduleGroup:
    Type: AWS::Scheduler::ScheduleGroup
    Properties:
      Name: !Sub rsvp_alerts_${Mode}
      Tags:
        - Key: Owner
          Value: !FindInMap [EnvMap, !Ref Mode, OwnerTag]

  ReservedRsvpRefreshScheduleGroup:
    Type: AWS::Scheduler::ScheduleGroup
    Properties:
      Name: !Sub reserved_rsvp_refresh_${Mode}
      Tags:
        - Key: Owner
          Value: !FindInMap [EnvMap, !Ref Mode, OwnerTag]

  ReservedRsvpRefreshScheduleRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub reserved_rsvp_refresh_scheduler_role_${Mode}
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: scheduler.amazonaws.com
            Action: sts:AssumeRole
      Description: !Sub Role used by reserved_rsvp_refresh_${Mode} schedules
      Policies:
        - PolicyName: InvokeManageEventsFunction
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Action: lambda:InvokeFunction
                Resource: !GetAtt ManageEventsFunction.Arn
                Effect: Allow
      Tags:
        - Key: Owner
          Value: !FindInMap [EnvMap, !Ref Mode, OwnerTag]

  ManageEventsFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub manage_events_${Mode}
      CodeUri: manage_events/
      Handler: app.lambda_handler
      Runtime: python3.12
      Architectures:
        - arm64
      MemorySize: 512
      Timeout: 30
      Events:
        # /events
        GetEvents:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /events
            Method: GET
            Auth:
              Authorizer: CognitoPasswordless
        EventsOptions:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /events
            Method: OPTIONS
            Auth:
              Authorizer: NONE

        # /event
        GetEvent:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /event
            Method: GET
            Auth:
              Authorizer: CognitoPasswordless
        CreateEvent:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /event
            Method: POST
            Auth:
              Authorizer: CognitoPasswordless
        DeleteEvent:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /event
            Method: DELETE
            Auth:
              Authorizer: CognitoPasswordless
        UpdateEvent:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /event
            Method: PUT
            Auth:
              Authorizer: CognitoPasswordless
        EventOptions:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /event
            Method: OPTIONS
            Auth:
              Authorizer: NONE

        # /players
        GetPlayers:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /players
            Method: GET
            Auth:
              Authorizer: CognitoPasswordless
        PlayersOptions:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /players
            Method: OPTIONS
            Auth:
              Authorizer: NONE

        # /players/import
        ImportPlayers:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /players/import
            Method: POST
            Auth:
              Authorizer: CognitoPasswordless
        ImportPlayersOptions:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /players/import
            Method: OPTIONS
            Auth:
              Authorizer: NONE

        # /player
        CreatePlayer:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /player
            Method: POST
            Auth:
              Authorizer: CognitoPasswordless
        UpdatePlayer:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /player
            Method: PUT
            Auth:
              Authorizer: CognitoPasswordless
        PlayerOptions:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /player
            Method: OPTIONS
            Auth:
              Authorizer: NONE

        # /player/self
        UpdatePlayerSelf:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /player/self
            Method: PUT
            Auth:
              Authorizer: CognitoPasswordless
        PlayerSelfOptions:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /player/self
            Method: OPTIONS
            Auth:
              Authorizer: NONE

        # /event/rsvp
        PostEventRSVP:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /event/rsvp
            Method: POST
            RequestParameters:
            Auth:
              Authorizer: CognitoPasswordless
        DeleteEventRSVP:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /event/rsvp
            Method: DELETE
            RequestParameters:
            Auth:
              Authorizer: CognitoPasswordless
        EventRsvpOptions:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /event/rsvp
            Method: OPTIONS
            Auth:
              Authorizer: NONE

        # /activitylogs
        GetActivityLogs:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /activitylogs
            Method: GET
            Auth:
              Authorizer: CognitoPasswordless
        ActivityLogsOptions:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /activitylogs
            Method: OPTIONS
            Auth:
              Authorizer: NONE

        # /alerts
        GetAlerts:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /alerts
            Method: GET
            Auth:
              Authorizer: CognitoPasswordless
        AlertsOptions:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /alerts
            Method: OPTIONS
            Auth:
              Authorizer: NONE

        # /alerts/player
        GetAlertsPlayer:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /alerts/player
            Method: GET
            Auth:
              Authorizer: CognitoPasswordless
        PutAlertsPlayer:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /alerts/player
            Method: PUT
            Auth:
              Authorizer: CognitoPasswordless
        AlertsPlayerOptions:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /alerts/player
            Method: OPTIONS
            Auth:
              Authorizer: NONE
      Tags:
        Owner: !FindInMap [EnvMap, !Ref Mode, OwnerTag]
      Environment:
        Variables:
          mode: !Ref Mode
          table_name_prod: !If [isNotProd, !ImportValue EventsTable-prod-GameKnightsEventsAPI, ""]
          table_name: !FindInMap [EnvMap, !Ref Mode, EventsTableName]
          # s3_bucket: !FindInMap [EnvMap, !Ref Mode, CloudFrontS3Bucket]
          s3_bucket: !Sub "{{resolve:ssm:/cubesandcardboard/${Mode}/frontend-bucket}}"
          rsvp_sqs_url: !Ref RsvpAlertSqsQueue
          sns_topic: !Ref BggPictureSnsTopic
          backend_bucket: !Ref BackendBucket
          user_pool_id: !Sub
            - "{{resolve:ssm:/cubesandcardboard/${env}/userpool/id}}"
            - env: !FindInMap [EnvMap, !Ref Mode, UserPoolEnv]
          user_pool_id_prod: "{{resolve:ssm:/cubesandcardboard/prod/userpool/id}}"
          bgg_picture_fn: !Ref RetrieveBGGImageFunction
          cognito_cloudwatch_role: !GetAtt CognitoCloudWatchRole.Arn
          # reserved_rsvp_refresh_schedule_group: !Ref ReservedRsvpRefreshScheduleGroup
          # reserved_rsvp_refresh_schedule_role: !GetAtt ReservedRsvpRefreshScheduleRole.Arn
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref EventsTable
        - !If
          - isNotProd
          - DynamoDBReadPolicy:
              TableName: !ImportValue EventsTable-prod-GameKnightsEventsAPI
          - !Ref "AWS::NoValue"
        - SQSSendMessagePolicy:
            QueueName: !GetAtt RsvpAlertSqsQueue.QueueName
        - S3CrudPolicy:
            # BucketName: !FindInMap [EnvMap, !Ref Mode, CloudFrontS3Bucket]
            BucketName: !Sub "{{resolve:ssm:/cubesandcardboard/${Mode}/frontend-bucket}}"
        - S3CrudPolicy:
            BucketName: !Ref BackendBucket
        - SNSPublishMessagePolicy:
            TopicName: !GetAtt BggPictureSnsTopic.TopicName
        - LambdaInvokePolicy:
            FunctionName: !Ref RetrieveBGGImageFunction
          # Allow cognito pool ListUsers
        - Statement:
            - Effect: Allow
              Action:
                - cognito-idp:ListUsers
                - cognito-idp:ListUsersInGroup
                - cognito-idp:ListGroups
                - cognito-idp:AdminGetUser
                - cognito-idp:AdminCreateUser
                - cognito-idp:AdminAddUserToGroup
                - cognito-idp:AdminRemoveUserFromGroup
                - cognito-idp:AdminUpdateUserAttributes
                - cognito-idp:AdminDeleteUserAttributes
                # Resource: !Ref CognitoUserPoolArn
                # Resource: !Sub "{{resolve:ssm:/cubesandcardboard/combined/userpool/arn}}"
                # Resource: !Sub "{{resolve:ssm:/cubesandcardboard/${Mode}/userpool/arn}}"
              Resource: !Sub
                - "{{resolve:ssm:/cubesandcardboard/${env}/userpool/arn}}"
                - env: !FindInMap [EnvMap, !Ref Mode, UserPoolEnv]
        - !If
          - isNotProd
          - Statement:
              - Effect: Allow
                Action:
                  - cognito-idp:GetCSVHeader
                  - cognito-idp:CreateUserImportJob
                  - cognito-idp:DescribeUserImportJob
                  - cognito-idp:ListUserImportJobs
                  - cognito-idp:StartUserImportJob
                  - cognito-idp:StopUserImportJob
                  - cognito-idp:AdminSetUserPassword
                  - iam:PassRole
                Resource:
                  - !GetAtt CognitoCloudWatchRole.Arn
                  - !Sub
                    - "{{resolve:ssm:/cubesandcardboard/${env}/userpool/arn}}"
                    - env: !FindInMap [EnvMap, !Ref Mode, UserPoolEnv]
          - !Ref "AWS::NoValue"
        - !If
          - isNotProd
          - Statement:
              - Effect: Allow
                Action:
                  - cognito-idp:ListUsers
                  - cognito-idp:ListUsersInGroup
                  - cognito-idp:ListGroups
                Resource: "{{resolve:ssm:/cubesandcardboard/prod/userpool/arn}}"
          - !Ref "AWS::NoValue"
        - Statement:
            - Effect: Allow
              Action:
                - logs:StartQuery
                - logs:StopQuery
                - logs:GetQueryResults
              Resource:
                - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/manage_events_${Mode}:*"
                - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/manage_events_${Mode}:log-stream:*"
        - Statement:
            - Effect: Allow
              Action:
                - scheduler:GetSchedule
                - scheduler:UpdateSchedule
                - iam:PassRole
              Resource:
                - !Sub "arn:aws:scheduler:${AWS::Region}:${AWS::AccountId}:schedule/${RsvpAlertsScheduleGroup}/rsvp_alerts_schedule_${Mode}"
                - !Sub "arn:aws:scheduler:${AWS::Region}:${AWS::AccountId}:schedule/${RsvpAlertsScheduleGroup}/rsvp_alerts_schedule_${Mode}"
                - !GetAtt RsvpAlertsFunctionScheduleEventRole.Arn
  ManageEventsFunctionRoleScheduleEventPolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: ReservedRsvpRefresh
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - scheduler:GetSchedule
              - scheduler:UpdateSchedule
              - scheduler:CreateSchedule
              - scheduler:DeleteSchedule
              - iam:PassRole
            Resource:
              - !Sub "arn:aws:scheduler:${AWS::Region}:${AWS::AccountId}:schedule/${ReservedRsvpRefreshScheduleGroup}/*"
              - !GetAtt ReservedRsvpRefreshScheduleRole.Arn
      Roles:
        - !Ref ManageEventsFunctionRole

  CognitoCloudWatchRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "CognitoCloudWatchRole-${Mode}"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: cognito-idp.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: CognitoCloudWatchPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:DescribeLogStreams
                  - logs:PutLogEvents
                Resource:
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/cognito/*"
      Tags:
        - Key: Owner
          Value: !FindInMap [EnvMap, !Ref Mode, OwnerTag]

  BggSearchFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub "BggSearch_${Mode}"
      CodeUri: bgg_search/
      Handler: bgg_search.lambda_handler
      Runtime: python3.12
      Architectures:
        - arm64
      MemorySize: 512
      Timeout: 30
      Events:
        GameSearch:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /gamesearch
            Method: GET
            Auth:
              Authorizer: CognitoPasswordless
        GameSearchOptions:
          Type: Api
          Properties:
            RestApiId: !Ref EventsApiGateway
            Path: /gamesearch
            Method: OPTIONS
            Auth:
              Authorizer: NONE

  RsvpAlertsFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      FunctionName: !Sub "rsvp_alerts_${Mode}"
      CodeUri: rsvp_alerts_ts/
      Handler: app.lambdaHandler
      Runtime: nodejs20.x
      Architectures:
        - arm64
      MemorySize: 256
      Timeout: 30
      Environment:
        Variables:
          MODE: !Ref Mode
          RSVP_SQS_URL: !Ref RsvpAlertSqsQueue
          # S3_BUCKET: !FindInMap [EnvMap, !Ref Mode, CloudFrontS3Bucket]
          S3_BUCKET: !Sub "{{resolve:ssm:/cubesandcardboard/${Mode}/frontend-bucket}}"
          TABLE_NAME: !FindInMap [EnvMap, !Ref Mode, EventsTableName]
          BACKEND_BUCKET: !Ref BackendBucket
          NODE_OPTIONS: --enable-source-maps
      Events:
        ScheduleEvent:
          # Initial Scheduled event placeholder (modified by the 'manage_events' lambda after each RSVP change)
          Type: ScheduleV2
          Properties:
            Name: !Sub "rsvp_alerts_schedule_${Mode}"
            GroupName: !Ref RsvpAlertsScheduleGroup
            GroupName: !Ref RsvpAlertsScheduleGroup
            ScheduleExpression: "at(2024-04-02T03:59:00)"
            State: DISABLED
      Policies:
        - SESCrudPolicy:
            IdentityName: cubesandcardboard.net
        - SQSPollerPolicy:
            QueueName: !GetAtt RsvpAlertSqsQueue.QueueName
        - S3ReadPolicy:
            # BucketName: !FindInMap [EnvMap, !Ref Mode, CloudFrontS3Bucket]
            BucketName: !Sub "{{resolve:ssm:/cubesandcardboard/${Mode}/frontend-bucket}}"
        - S3ReadPolicy:
            BucketName: !Ref BackendBucket
        - DynamoDBReadPolicy:
            TableName: !Ref EventsTable
      Tags:
        Owner: !FindInMap [EnvMap, !Ref Mode, OwnerTag]
    Metadata: # Manage esbuild properties
      BuildMethod: esbuild
      BuildProperties:
        Minify: true
        Target: "es2022"
        Sourcemap: true
        EntryPoints:
          - app.ts
        External:
          - emitter

  RetrieveBGGImageFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub "RetrieveBGGImage_${Mode}"
      CodeUri: bgg_picture/
      Handler: app.lambda_handler
      Runtime: python3.12
      Architectures:
        - arm64
      MemorySize: 512
      Timeout: 30
      Events:
        MySNSEvent:
          Type: SNS
          Properties:
            Topic: !Ref BggPictureSnsTopic
      Policies:
        - S3ReadPolicy:
            # BucketName: !FindInMap [EnvMap, !Ref Mode, CloudFrontS3Bucket]
            BucketName: !Sub "{{resolve:ssm:/cubesandcardboard/${Mode}/frontend-bucket}}"
        - S3WritePolicy:
            # BucketName: !FindInMap [EnvMap, !Ref Mode, CloudFrontS3Bucket]
            BucketName: !Sub "{{resolve:ssm:/cubesandcardboard/${Mode}/frontend-bucket}}"

      Tags:
        Owner: !FindInMap [EnvMap, !Ref Mode, OwnerTag]

  BggPictureSnsTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub "BggPictureSnsTopic_${Mode}"
      Tags:
        - Key: Owner
          Value: !FindInMap [EnvMap, !Ref Mode, OwnerTag]

  RsvpAlertSqsQueue:
    Type: AWS::SQS::Queue
    Properties:
      ContentBasedDeduplication: true
      QueueName: !Sub "sqs_rsvp_alerts_${Mode}.fifo"
      FifoQueue: true
      VisibilityTimeout: 700
      Tags:
        - Key: Owner
          Value: !FindInMap [EnvMap, !Ref Mode, OwnerTag]

Outputs:
  EventsApiGateway:
    Description: "API Gateway endpoint URL for Staging stage for Game Knights Events function"
    Value: !Sub "https://${EventsApiGateway}.execute-api.${AWS::Region}.amazonaws.com/${Stage}/"
  EventsApiGatewayRestApiId:
    Description: "API Gateway ARN for Game Knights Events AWS API Gateway"
    Value: !Ref EventsApiGateway
    Export:
      Name: !Sub "EventsApiGateway-RestApiId-${Mode}"
  EventsApiGatewayRootResourceId:
    Value: !GetAtt EventsApiGateway.RootResourceId
    Export:
      Name: !Sub "EventsApiGateway-RootResourceId-${Mode}"
  RsvpSQSUrl:
    Value: !Ref RsvpAlertSqsQueue
  SNSTopic:
    Value: !Ref BggPictureSnsTopic
  BackendBucket:
    Value: !Ref BackendBucket
  EventsTable:
    Value: !Ref EventsTable
    Export:
      Name: !Sub "EventsTable-${Mode}-${AWS::StackName}"
  RsvpAlertsFunctionScheduleEventRoleArn:
    Value: !GetAtt RsvpAlertsFunctionScheduleEventRole.Arn
  ReservedRsvpRefreshScheduleRole:
    Value: !GetAtt ReservedRsvpRefreshScheduleRole.Arn
  ManageEventsFunctionName:
    Value: !Ref ManageEventsFunction