@description('Deployment environment')
param environment string
@description('Azure region')
param location string
@description('Resource tags')
param tags object

resource sbNamespace 'Microsoft.ServiceBus/namespaces@2022-10-01-preview' = {
  name: 'sb-oms-integration-${environment}'
  location: location
  sku: { name: 'Standard', tier: 'Standard' }
  properties: {
    minimumTlsVersion: '1.2'
    zoneRedundant: environment == 'prod' ? true : false
  }
  tags: tags
}

// Topic: partitioned for throughput; dup detection prevents replay within 10 min
resource sbTopic 'Microsoft.ServiceBus/namespaces/topics@2022-10-01-preview' = {
  parent: sbNamespace
  name: 'oms-orders-topic'
  properties: {
    enablePartitioning: true
    requiresDuplicateDetection: true
    duplicateDetectionHistoryTimeWindow: 'PT10M'
    defaultMessageTimeToLive: 'P14D'
    maxSizeInMegabytes: 1024
  }
}

// Subscription: maxDelivery=10 then auto-DLQ; lockDuration=5min matches function timeout
resource sbSubscription 'Microsoft.ServiceBus/namespaces/topics/subscriptions@2022-10-01-preview' = {
  parent: sbTopic
  name: 'oms-d365-subscription'
  properties: {
    maxDeliveryCount: 10
    lockDuration: 'PT5M'
    deadLetteringOnMessageExpiration: true
    defaultMessageTimeToLive: 'P14D'
    enableBatchedOperations: true
  }
}

output namespaceName string = sbNamespace.name
output namespaceId string = sbNamespace.id
output topicId string = sbTopic.id
output subscriptionName string = sbSubscription.name
output namespaceHostname string = '${sbNamespace.name}.servicebus.windows.net'

@description('Deployment environment')
param environment string
@description('Azure region')
param location string
@description('Resource tags')
param tags object

// Autoscale in prod; manual 400 RU/s in dev/uat
var throughputSettings = environment == 'prod'
  ? { autoscaleSettings: { maxThroughput: 4000 } }
  : { throughput: 400 }

// Session consistency: best trade-off - cheaper than Strong, sufficient for our batch pattern
resource cosmosAccount 'Microsoft.DocumentDB/databaseAccounts@2023-04-15' = {
  name: 'cosmos-oms-integration-${environment}'
  location: location
  kind: 'GlobalDocumentDB'
  properties: {
    databaseAccountOfferType: 'Standard'
    consistencyPolicy: {
      defaultConsistencyLevel: 'Session'
      maxStalenessPrefix: 100
      maxIntervalInSeconds: 5
    }
    locations: [{
      locationName: location
      failoverPriority: 0
      isZoneRedundant: environment == 'prod' ? true : false
    }]
    enableAutomaticFailover: false
    publicNetworkAccess: environment == 'prod' ? 'Disabled' : 'Enabled'
    minimalTlsVersion: 'Tls12'
  }
  tags: tags
}

resource database 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases@2023-04-15' = {
  parent: cosmosAccount
  name: 'oms-integration-db'
  properties: { resource: { id: 'oms-integration-db' } }
}

// Partition key: /orderId — millions of unique values = perfect cardinality, no hot partition
// TTL: 30 days auto-deletes processed documents to control storage cost
resource container 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2023-04-15' = {
  parent: database
  name: 'oms-orders'
  properties: {
    resource: {
      id: 'oms-orders'
      partitionKey: { paths: ['/orderId'], kind: 'Hash', version: 2 }
      defaultTtl: 2592000
      indexingPolicy: {
        indexingMode: 'consistent'
        automatic: true
        includedPaths: [{ path: '/*' }]
        excludedPaths: [{ path: '/omsEvent/*' }, { path: '/"_etag"/?' }]
        compositeIndexes: [
          [
            { path: '/processingStatus', order: 'ascending' }
            { path: '/ingestedAt', order: 'ascending' }
          ]
        ]
      }
    }
    options: throughputSettings
  }
}

output endpoint string = cosmosAccount.properties.documentEndpoint
output accountName string = cosmosAccount.name
output accountId string = cosmosAccount.id
output databaseName string = database.name

@description('Deployment environment')
param environment string
@description('Azure region')
param location string
@description('Resource tags')
param tags object

// ZRS in prod = zone-redundant (survives datacenter failure)
// LRS in dev/uat = cheaper, sufficient for non-prod
resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: 'saomsintegration${environment}'   // max 24 chars, no hyphens
  location: location
  sku: { name: environment == 'prod' ? 'Standard_ZRS' : 'Standard_LRS' }
  kind: 'StorageV2'
  properties: {
    accessTier: 'Hot'
    minimumTlsVersion: 'TLS1_2'
    allowBlobPublicAccess: false
    supportsHttpsTrafficOnly: true
    networkAcls: {
      defaultAction: environment == 'prod' ? 'Deny' : 'Allow'
      bypass: 'AzureServices'
    }
  }
  tags: tags
}

resource blobService 'Microsoft.Storage/storageAccounts/blobServices@2023-01-01' = {
  parent: storageAccount
  name: 'default'
  properties: {
    deleteRetentionPolicy: { enabled: true, days: 7 }
    isVersioningEnabled: environment == 'prod' ? true : false
  }
}

// Staging container: holds ZIP packages for Logic App to read and deliver to D365
resource stagingContainer 'Microsoft.Storage/storageAccounts/blobServices/containers@2023-01-01' = {
  parent: blobService
  name: 'oms-d365-payloads'
  properties: { publicAccess: 'None' }
}

// Safety net: any ZIP older than 7 days was not processed — auto-delete
resource lifecyclePolicy 'Microsoft.Storage/storageAccounts/managementPolicies@2023-01-01' = {
  parent: storageAccount
  name: 'default'
  properties: {
    policy: {
      rules: [{
        name: 'delete-old-staging-zips'
        enabled: true
        type: 'Lifecycle'
        definition: {
          filters: { blobTypes: ['blockBlob'], prefixMatch: ['oms-d365-payloads/'] }
          actions: { baseBlob: { delete: { daysAfterModificationGreaterThan: 7 } } }
        }
      }]
    }
  }
}

output storageAccountName string = storageAccount.name
output storageAccountId string = storageAccount.id
output stagingContainerName string = stagingContainer.name
output blobEndpoint string = storageAccount.properties.primaryEndpoints.blob

@description('Deployment environment')
param environment string
@description('Azure region')
param location string
@description('Resource tags')
param tags object
@description('Storage account name for AzureWebJobsStorage')
param storageAccountName string
@description('Application Insights connection string')
param appInsightsConnectionString string
@description('Cosmos DB endpoint URL')
param cosmosDbEndpoint string
@description('Cosmos DB account name')
param cosmosDbAccountName string
@description('Service Bus namespace name')
param serviceBusNamespaceName string
@description('Service Bus namespace resource ID')
param serviceBusNamespaceId string
@description('Key Vault URI')
param keyVaultUri string
@description('Key Vault name for KV reference syntax')
param keyVaultName string

resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' existing = {
  name: storageAccountName
}

// Consumption plan Y1: pay-per-execution, elastic scale, zero idle cost
resource appServicePlan 'Microsoft.Web/serverfarms@2023-01-01' = {
  name: 'asp-oms-integration-${environment}'
  location: location
  sku: { name: 'Y1', tier: 'Dynamic' }
  kind: 'functionapp'
  properties: { reserved: false }
  tags: tags
}

resource functionApp 'Microsoft.Web/sites@2023-01-01' = {
  name: 'func-oms-integration-${environment}'
  location: location
  kind: 'functionapp'
  identity: { type: 'SystemAssigned' }
  properties: {
    serverFarmId: appServicePlan.id
    httpsOnly: true
    siteConfig: {
      netFrameworkVersion: 'v8.0'
      use32BitWorkerProcess: false
      ftpsState: 'Disabled'
      minTlsVersion: '1.2'
      appSettings: [
        { name: 'FUNCTIONS_EXTENSION_VERSION', value: '~4' }
        { name: 'FUNCTIONS_WORKER_RUNTIME', value: 'dotnet-isolated' }
        { name: 'AzureWebJobsStorage', value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.name};AccountKey=${storageAccount.listKeys().keys[0].value}' }
        { name: 'APPLICATIONINSIGHTS_CONNECTION_STRING', value: appInsightsConnectionString }
        // Service Bus — Managed Identity (no connection string)
        { name: 'ServiceBusConnection__fullyQualifiedNamespace', value: '${serviceBusNamespaceName}.servicebus.windows.net' }
        { name: 'ServiceBusTopicName', value: 'oms-orders-topic' }
        { name: 'ServiceBusSubscriptionName', value: 'oms-d365-subscription' }
        // Cosmos DB — Managed Identity
        { name: 'CosmosDbEndpoint', value: cosmosDbEndpoint }
        { name: 'CosmosDbDatabaseName', value: 'oms-integration-db' }
        { name: 'CosmosDbContainerName', value: 'oms-orders' }
        // Blob Storage
        { name: 'BlobStorageEndpoint', value: 'https://${storageAccountName}.blob.core.windows.net' }
        { name: 'BlobContainerName', value: 'oms-d365-payloads' }
        // Key Vault References — secrets never appear in plain text
        { name: 'D365BaseUrl', value: '@Microsoft.KeyVault(VaultName=${keyVaultName};SecretName=D365-Base-Url)' }
        { name: 'D365ClientId', value: '@Microsoft.KeyVault(VaultName=${keyVaultName};SecretName=D365-Client-Id)' }
        { name: 'D365ClientSecret', value: '@Microsoft.KeyVault(VaultName=${keyVaultName};SecretName=D365-Client-Secret)' }
        { name: 'Environment', value: environment }
        { name: 'WEBSITE_RUN_FROM_PACKAGE', value: '1' }
      ]
    }
  }
  tags: tags
}

output functionAppName string = functionApp.name
output functionAppId string = functionApp.id
output principalId string = functionApp.identity.principalId
output defaultHostname string = functionApp.properties.defaultHostName

@description('Deployment environment')
param environment string
@description('Azure region')
param location string
@description('Resource tags')
param tags object
@description('Storage account name (required by Logic App Standard)')
param storageAccountName string
@description('Storage account resource ID')
param storageAccountId string
@description('Application Insights connection string')
param appInsightsConnectionString string
@description('Key Vault URI')
param keyVaultUri string
@description('Key Vault name')
param keyVaultName string

resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' existing = {
  name: storageAccountName
}

// Logic App Standard REQUIRES a dedicated ASP (not Consumption)
// WS1 = 1 vCore, 3.5 GB RAM — suitable for our delivery workflow
resource logicAppPlan 'Microsoft.Web/serverfarms@2023-01-01' = {
  name: 'asp-la-oms-integration-${environment}'
  location: location
  sku: { name: 'WS1', tier: 'WorkflowStandard' }
  kind: 'windows'
  properties: {
    targetWorkerCount: environment == 'prod' ? 2 : 1
    maximumElasticWorkerCount: environment == 'prod' ? 4 : 2
  }
  tags: tags
}

resource logicApp 'Microsoft.Web/sites@2023-01-01' = {
  name: 'la-oms-d365-delivery-${environment}'
  location: location
  kind: 'functionapp,workflowapp'
  identity: { type: 'SystemAssigned' }
  properties: {
    serverFarmId: logicAppPlan.id
    httpsOnly: true
    siteConfig: {
      use32BitWorkerProcess: false
      ftpsState: 'Disabled'
      minTlsVersion: '1.2'
      appSettings: [
        { name: 'APP_KIND', value: 'workflowApp' }
        { name: 'FUNCTIONS_EXTENSION_VERSION', value: '~4' }
        { name: 'FUNCTIONS_WORKER_RUNTIME', value: 'node' }
        { name: 'WEBSITE_NODE_DEFAULT_VERSION', value: '~18' }
        { name: 'AzureWebJobsStorage', value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.name};AccountKey=${storageAccount.listKeys().keys[0].value}' }
        { name: 'APPLICATIONINSIGHTS_CONNECTION_STRING', value: appInsightsConnectionString }
        { name: 'BlobStorageEndpoint', value: 'https://${storageAccountName}.blob.core.windows.net' }
        { name: 'BlobStagingContainer', value: 'oms-d365-payloads' }
        { name: 'D365BaseUrl', value: '@Microsoft.KeyVault(VaultName=${keyVaultName};SecretName=D365-Base-Url)' }
        { name: 'D365ClientId', value: '@Microsoft.KeyVault(VaultName=${keyVaultName};SecretName=D365-Client-Id)' }
        { name: 'D365ClientSecret', value: '@Microsoft.KeyVault(VaultName=${keyVaultName};SecretName=D365-Client-Secret)' }
        { name: 'Environment', value: environment }
        { name: 'WEBSITE_RUN_FROM_PACKAGE', value: '1' }
      ]
    }
  }
  tags: tags
}

output logicAppName string = logicApp.name
output logicAppId string = logicApp.id
output principalId string = logicApp.identity.principalId
output defaultHostname string = logicApp.properties.defaultHostName

@description('Deployment environment')
param environment string
@description('Azure region')
param location string
@description('Resource tags')
param tags object
@description('Service Bus topic resource ID (event destination)')
param serviceBusTopicId string
@description('Service Bus namespace resource ID (for RBAC)')
param serviceBusNamespaceId string

// CloudEvents 1.0 schema enforces structured, validated payload format
// Prevents arbitrary unstructured JSON from being published
resource eventGridTopic 'Microsoft.EventGrid/topics@2023-12-15-preview' = {
  name: 'egt-oms-events-${environment}'
  location: location
  identity: { type: 'SystemAssigned' }   // Needed for delivery to Service Bus
  properties: {
    inputSchema: 'CloudEventSchemaV1_0'
    publicNetworkAccess: environment == 'prod' ? 'Disabled' : 'Enabled'
    disableLocalAuth: false
  }
  tags: tags
}

// Event Grid MI needs Azure Service Bus Data Sender role to forward events
resource egToSbRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(serviceBusNamespaceId, eventGridTopic.id, 'sb-data-sender')
  scope: resourceGroup()
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '69a216fc-b8fb-44d8-bc22-1f3c2cd27a39')
    principalId: eventGridTopic.identity.principalId
    principalType: 'ServicePrincipal'
  }
}

// Filter: only route OMS.Order.Created and OMS.Order.Updated events
resource eventSubscription 'Microsoft.EventGrid/topics/eventSubscriptions@2023-12-15-preview' = {
  parent: eventGridTopic
  name: 'oms-to-servicebus-subscription'
  properties: {
    destination: {
      endpointType: 'ServiceBusTopic'
      properties: { resourceId: serviceBusTopicId }
    }
    filter: {
      includedEventTypes: ['OMS.Order.Created', 'OMS.Order.Updated']
      enableAdvancedFilteringOnArrays: true
    }
    eventDeliverySchema: 'CloudEventSchemaV1_0'
    retryPolicy: { maxDeliveryAttempts: 30, eventTimeToLiveInMinutes: 1440 }
  }
  dependsOn: [egToSbRole]
}

output topicEndpoint string = eventGridTopic.properties.endpoint
output topicId string = eventGridTopic.id
output topicName string = eventGridTopic.name
output principalId string = eventGridTopic.identity.principalId

@description('Deployment environment')
param environment string
@description('Azure region')
param location string
@description('Resource tags')
param tags object
@description('AAD Tenant ID for Key Vault')
param tenantId string

// RBAC model preferred over access policies:
//   - Standard Azure RBAC = consistent with other resources
//   - No 16-policy limit (RBAC is unlimited)
//   - Can scope permissions to individual secrets
//   - Works seamlessly with Managed Identity
resource keyVault 'Microsoft.KeyVault/vaults@2023-07-01' = {
  name: 'kv-oms-integration-${environment}'
  location: location
  properties: {
    tenantId: tenantId
    sku: { name: 'standard', family: 'A' }
    enableRbacAuthorization: true          // RBAC model — not access policies
    enableSoftDelete: true
    softDeleteRetentionInDays: 90
    enablePurgeProtection: environment == 'prod' ? true : false
    publicNetworkAccess: environment == 'prod' ? 'Disabled' : 'Enabled'
    networkAcls: {
      defaultAction: environment == 'prod' ? 'Deny' : 'Allow'
      bypass: 'AzureServices'
    }
  }
  tags: tags
}

output keyVaultUri string = keyVault.properties.vaultUri
output keyVaultName string = keyVault.name
output keyVaultId string = keyVault.id

@description('Deployment environment')
param environment string
@description('Azure region')
param location string
@description('Resource tags')
param tags object

// Log Analytics Workspace: required for workspace-based Application Insights
// Classic (non-workspace) Application Insights is deprecated since 2024
resource logAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
  name: 'law-oms-integration-${environment}'
  location: location
  properties: {
    sku: { name: 'PerGB2018' }
    retentionInDays: environment == 'prod' ? 90 : 30
    features: { enableLogAccessUsingOnlyResourcePermissions: true }
  }
  tags: tags
}

// Workspace-based Application Insights: logs stored in Log Analytics
// Enables unified KQL querying across all Azure resources
resource appInsights 'Microsoft.Insights/components@2020-02-02' = {
  name: 'appi-oms-integration-${environment}'
  location: location
  kind: 'web'
  properties: {
    Application_Type: 'web'
    WorkspaceResourceId: logAnalyticsWorkspace.id
    RetentionInDays: environment == 'prod' ? 90 : 30
    // Sampling: 50% in prod reduces ingestion cost while maintaining statistical accuracy
    // 100% in dev/uat ensures full visibility during testing
    SamplingPercentage: environment == 'prod' ? 50 : 100
    DisableIpMasking: false      // GDPR compliance: mask client IPs
  }
  tags: tags
}

// Use connectionString (not instrumentationKey) — instrumentationKey is deprecated
output connectionString string = appInsights.properties.ConnectionString
output instrumentationKey string = appInsights.properties.InstrumentationKey
output appInsightsName string = appInsights.name
output appInsightsId string = appInsights.id
output logAnalyticsWorkspaceId string = logAnalyticsWorkspace.id

using '../main.bicep'

// Development environment — cost-optimised, public access enabled for developer tooling
param environment = 'dev'
param location = 'westeurope'
param tags = {
  project:     'oms-d365-integration'
  environment: 'dev'
  costCenter:  'IT-DEV-001'
  managedBy:   'bicep'
  team:        'azure-integration'
  deployedBy:  'ci-cd-pipeline'
  owner:       'integration-team@company.com'
}

using '../main.bicep'

// UAT environment — mirrors prod config where possible for test parity
// Public access still enabled (no private endpoints) to reduce test friction
param environment = 'uat'
param location = 'westeurope'
param tags = {
  project:          'oms-d365-integration'
  environment:      'uat'
  costCenter:       'IT-UAT-001'
  managedBy:        'bicep'
  team:             'azure-integration'
  deployedBy:       'ci-cd-pipeline'
  owner:            'integration-team@company.com'
  testEnvironment:  'true'
  dataClassification: 'non-production'
}

using '../main.bicep'

// PRODUCTION — full security hardening, zone-redundant, private endpoints
// Requires: manual approval gate in CI/CD pipeline before apply
// Requires: deployment during off-peak window (00:00–04:00 UTC)
param environment = 'prod'
param location = 'westeurope'
param tags = {
  project:           'oms-d365-integration'
  environment:       'prod'
  costCenter:        'IT-PROD-001'
  managedBy:         'bicep'
  team:              'azure-integration'
  deployedBy:        'ci-cd-pipeline'
  owner:             'integration-team@company.com'
  slaTarget:         '99.9'
  dataClassification: 'confidential'
  complianceScope:   'SOC2'
  businessUnit:      'supply-chain'
  criticalityLevel:  'high'
}