chore: add establishment order migrations and bucket (#1315)

* chore: add establishment order migrations and bucket

* fix: local migrations

Author: Marcel Mueller

infrastructure/api/ecs.tf

@@ -185,6 +185,14 @@ resource "aws_ecs_task_definition" "node_api_task" {
           name  = "DAM_RST_IMAGE_COLLECTION_ID"
           value = var.dam_config.dam_rst_image_collection_id
         },
+        {
+          name  = "ESTABLISHMENT_ORDER_DOCS_BUCKET"
+          value = aws_s3_bucket.establishment_order_docs.id
+        },
+        {
+          name  = "AWS_REGION"
+          value = var.aws_region
+        }
       ]
       portMappings = [
         {

infrastructure/api/iam.tf

@@ -93,6 +93,31 @@ resource "aws_iam_role_policy" "cloudwatch_metrics" {
   })
 }
 
+# IAM policy for S3 access to Establishment Order documents
+resource "aws_iam_role_policy" "s3_establishment_order_docs" {
+  name = "${var.app_name}_s3_establishment_order_docs"
+  role = aws_iam_role.app_container_role.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "s3:GetObject",
+          "s3:PutObject",
+          "s3:DeleteObject",
+          "s3:ListBucket"
+        ]
+        Resource = [
+          "arn:aws:s3:::rst-lza-establishment-order-docs-${var.target_env}",
+          "arn:aws:s3:::rst-lza-establishment-order-docs-${var.target_env}/*"
+        ]
+      }
+    ]
+  })
+}
+
 resource "aws_iam_role_policy" "app_container_cwlogs" {
   name = "${var.app_name}_container_cwlogs"
   role = aws_iam_role.app_container_role.id

infrastructure/api/s3.tf

@@ -0,0 +1,52 @@
+# S3 bucket for Establishment Order documents
+resource "aws_s3_bucket" "establishment_order_docs" {
+  bucket = "rst-lza-establishment-order-docs-${var.target_env}"
+}
+
+# Enable versioning for the bucket
+resource "aws_s3_bucket_versioning" "establishment_order_docs" {
+  bucket = aws_s3_bucket.establishment_order_docs.id
+
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+# Enable encryption for the bucket
+resource "aws_s3_bucket_server_side_encryption_configuration" "establishment_order_docs" {
+  bucket = aws_s3_bucket.establishment_order_docs.id
+
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm = "AES256"
+    }
+  }
+}
+
+# Block public access
+resource "aws_s3_bucket_public_access_block" "establishment_order_docs" {
+  bucket = aws_s3_bucket.establishment_order_docs.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+# Lifecycle policy - delete old versions after 30 days
+resource "aws_s3_bucket_lifecycle_configuration" "establishment_order_docs" {
+  bucket = aws_s3_bucket.establishment_order_docs.id
+
+  rule {
+    id     = "expire-old-versions"
+    status = "Enabled"
+
+    filter {
+      prefix = ""
+    }
+
+    noncurrent_version_expiration {
+      noncurrent_days = 30
+    }
+  }
+}

migrations/rst/sql/V1.1.39__recreation_establishment_order_docs.sql

@@ -0,0 +1,21 @@
+create table if not exists rst.recreation_establishment_order_docs
+(
+    s3_key          varchar primary key,
+    rec_resource_id varchar(10) references rst.recreation_resource,
+    title           varchar,
+    file_size       bigint,
+    extension       varchar
+);
+
+select upsert_timestamp_columns('rst', 'recreation_establishment_order_docs');
+
+select setup_temporal_table('rst', 'recreation_establishment_order_docs');
+
+comment on column rst.recreation_establishment_order_docs.s3_key is 'S3 object key (path) for the establishment order document';
+comment on column rst.recreation_establishment_order_docs.rec_resource_id is 'Recreation Resource ID';
+comment on column rst.recreation_establishment_order_docs.title is 'Title of the establishment order document';
+comment on column rst.recreation_establishment_order_docs.file_size is 'File size in bytes';
+comment on column rst.recreation_establishment_order_docs.extension is 'File extension (e.g., pdf)';
+
+create index if not exists idx_recreation_establishment_order_docs_rec_resource_id
+    on rst.recreation_establishment_order_docs(rec_resource_id);