"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.HttpsAlb = void 0;
const aws_cdk_lib_1 = require("aws-cdk-lib");
class HttpsAlb extends aws_cdk_lib_1.aws_elasticloadbalancingv2.ApplicationLoadBalancer {
    /**
     * Defines a public Application Load Balancer with an SSL listener that 404's by default,
     * and redirects all http traffic to https.
     *
     * @param scope The scope in which to define this construct
     * @param id The scoped construct ID. Must be unique amongst siblings. If
     * the ID includes a path separator (`/`), then it will be replaced by double
     * dash `--`.
     * @param props IHttpsAlbProps properties.
     */
    constructor(scope, id, props) {
        super(scope, id, props);
        // Set idle timeout if provided
        if (props.idleTimeout) {
            this.setAttribute('idle_timeout.timeout_seconds', props.idleTimeout.toSeconds().toString());
        }
        this.addHttpRedirect();
        const firstCertificate = props.certificateArns[0]; // added after certificateArns was deprecated from addListener.  
        // Add https listener that by default 404s until other rules are added.
        this.defaultListener = this.addListener('HttpsListener', {
            certificates: [aws_cdk_lib_1.aws_elasticloadbalancingv2.ListenerCertificate.fromArn(firstCertificate)],
            open: true,
            port: 443,
            protocol: aws_cdk_lib_1.aws_elasticloadbalancingv2.ApplicationProtocol.HTTPS,
            sslPolicy: aws_cdk_lib_1.aws_elasticloadbalancingv2.SslPolicy.TLS13_RES,
        });
        this.defaultListener.addAction('Default404', { action: aws_cdk_lib_1.aws_elasticloadbalancingv2.ListenerAction.fixedResponse(404) });
        // Adding an output of the dns name for convenience when looking at this
        // in the console/cli.
        new aws_cdk_lib_1.CfnOutput(scope, 'PublicLoadBalancerDNSName', {
            description: 'The DNS name of the load balancer',
            value: this.loadBalancerDnsName,
        });
    }
    addHttpRedirect() {
        // Add a listener to redirect http to https
        const httpListener = this.addListener('HttpListener', {
            open: true,
            port: 80,
            protocol: aws_cdk_lib_1.aws_elasticloadbalancingv2.ApplicationProtocol.HTTP,
        });
        // Ideally this can be removed, and the CfnListener below can be rewritten once
        // cdk adds support for adding a redirect rule as the default.
        // See https://github.com/aws/aws-cdk/issues/2563.
        httpListener.addAction('Default404', { action: aws_cdk_lib_1.aws_elasticloadbalancingv2.ListenerAction.fixedResponse(404) });
        const cfnHttpListener = httpListener.node.defaultChild;
        cfnHttpListener.defaultActions = [
            {
                redirectConfig: {
                    host: '#{host}',
                    path: '/#{path}',
                    port: '443',
                    protocol: 'HTTPS',
                    query: '#{query}',
                    statusCode: 'HTTP_301', // Should probably use 308 here at this point? ALB doesn't support this.
                },
                type: 'redirect',
            },
        ];
    }
}
exports.HttpsAlb = HttpsAlb;
