import * as cdk from 'aws-cdk-lib';
import * as ecr from 'aws-cdk-lib/aws-ecr';
import * as iam from 'aws-cdk-lib/aws-iam';
import { Construct } from 'constructs';

export class EcrStack extends cdk.Stack {
  public readonly repository: ecr.IRepository;

  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // If the repository already exists, CDK will adopt it.
    // We set a RETAIN policy to prevent accidental deletion.
    const repository = new ecr.Repository(this, 'SunoEcrRepository', {
      repositoryName: 'studio-api',
      removalPolicy: cdk.RemovalPolicy.RETAIN,
    });

    // Grant pull access to the staging account's ECS Task Execution Role
    repository.addToResourcePolicy(new iam.PolicyStatement({
      effect: iam.Effect.ALLOW,
      principals: [new iam.ArnPrincipal(`arn:aws:iam::590183763515:role/BackendInfraStack-StudioApiFargateServiceExecutionR-E8D5K1TAb5Ez`), new iam.ArnPrincipal(`arn:aws:iam::734185074900:role/BackendInfraStack-StudioApiFargateServiceExecutionR-AQepb9Ux9HWm`)],
      actions: [
        "ecr:BatchCheckLayerAvailability",
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer",
      ],
    }));

    this.repository = repository;
  }
}