#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"

ENV="${1:-}"
if [[ -z "$ENV" ]] || [[ ! "$ENV" =~ ^(dev|staging|prod)$ ]]; then
  echo "Usage: $0 <dev|staging|prod>"
  echo ""
  echo "Examples:"
  echo "  $0 dev      # Deploy development environment"
  echo "  $0 staging  # Deploy staging environment"
  echo "  $0 prod     # Deploy production environment"
  exit 1
fi

AWS_REGION="${AWS_REGION:-us-east-1}"
IMAGE_TAG="${IMAGE_TAG:-$(git -C "$REPO_ROOT" rev-parse --short HEAD)}"
TFVARS_FILE="$SCRIPT_DIR/environments/${ENV}.tfvars"

OLD_ACCOUNT_ID="${OLD_ACCOUNT_ID:-487575298759}"
NEW_ACCOUNT_ID="${NEW_ACCOUNT_ID:-604175033442}"

if [[ ! -f "$TFVARS_FILE" ]]; then
  echo "Error: $TFVARS_FILE not found. Create it first."
  exit 1
fi

echo "=========================================="
echo "  Deploying: ${ENV}"
echo "  Region:    ${AWS_REGION}"
echo "  Image tag: ${IMAGE_TAG}"
echo "=========================================="

echo "==> Exporting AWS credentials for Terraform..."
eval "$(aws configure export-credentials --format env 2>/dev/null)" || true

echo "==> Resolving AWS account..."
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
ECR_REPO="${ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com"

if [[ "$ENV" == "dev" ]]; then
  EXPECTED_ACCOUNT_ID="$OLD_ACCOUNT_ID"
  BACKEND_BUCKET="${TF_BACKEND_BUCKET_DEV:-${TF_BACKEND_BUCKET_NONPROD:-${TF_BACKEND_BUCKET:-}}}"
else
  EXPECTED_ACCOUNT_ID="$NEW_ACCOUNT_ID"
  BACKEND_BUCKET="${TF_BACKEND_BUCKET_NEW_ACCOUNT:-${TF_BACKEND_BUCKET_PROD:-${TF_BACKEND_BUCKET:-}}}"
fi

BACKEND_KEY="${TF_BACKEND_KEY:-infra/terraform.tfstate}"
BACKEND_REGION="${TF_BACKEND_REGION:-us-east-1}"
BACKEND_USE_LOCKFILE="${TF_BACKEND_USE_LOCKFILE:-true}"

if [[ "$ACCOUNT_ID" != "$EXPECTED_ACCOUNT_ID" ]]; then
  echo "Error: Account mismatch for ${ENV}. Expected ${EXPECTED_ACCOUNT_ID}, got ${ACCOUNT_ID}."
  exit 1
fi

if [[ -z "$BACKEND_BUCKET" ]]; then
  echo "Error: Terraform backend bucket is not set."
  echo "Set TF_BACKEND_BUCKET_PROD (for prod) or TF_BACKEND_BUCKET_NONPROD (for dev/staging)."
  exit 1
fi

# This script deploys the PingCAP tenant image variant. Keep the tenant choice
# in deployment inputs so generic Terraform defaults remain brand-neutral.
export TF_VAR_tenant_overlay_dir="${TF_VAR_tenant_overlay_dir:-/app/backend/internal/controlplane/tenants/pingcap}"
export TF_VAR_apply_tenant_overlay="${TF_VAR_apply_tenant_overlay:-1}"

echo "==> Selecting Terraform workspace: ${ENV}..."
cd "$SCRIPT_DIR"
terraform init -input=false \
  -backend-config="bucket=${BACKEND_BUCKET}" \
  -backend-config="key=${BACKEND_KEY}" \
  -backend-config="region=${BACKEND_REGION}" \
  -backend-config="encrypt=true" \
  -backend-config="use_lockfile=${BACKEND_USE_LOCKFILE}"
terraform workspace select "$ENV" || terraform workspace new "$ENV"

# For new environments, run terraform apply first to create infrastructure (ECR, VPC, etc.)
# Use a placeholder image tag — ECS service won't start until a real image is pushed.
ECR_REPO_NAME=$(terraform output -raw ecr_repository_url 2>/dev/null) || ECR_REPO_NAME=""
if [[ -z "$ECR_REPO_NAME" || "$ECR_REPO_NAME" == *"Warning"* ]]; then
  echo "==> First deploy for ${ENV}: creating infrastructure..."
  terraform apply \
    -var-file="environments/${ENV}.tfvars" \
    -var "image_tag=initial" \
    -input=false \
    -auto-approve

  ECR_REPO_NAME=$(terraform output -raw ecr_repository_url)
  echo "==> Infrastructure created. ECR repo: ${ECR_REPO_NAME}"
fi

echo "==> Building backend Docker image (tag: ${IMAGE_TAG}, platform: linux/amd64)..."
docker build \
  --platform linux/amd64 \
  -f "$SCRIPT_DIR/backend.pingcap.Dockerfile" \
  -t "nexuscrm-backend:${IMAGE_TAG}" \
  "$REPO_ROOT"

echo "==> Logging in to ECR..."
aws ecr get-login-password --region "$AWS_REGION" | \
  docker login --username AWS --password-stdin "$ECR_REPO"

echo "==> Tagging and pushing image..."
docker tag "nexuscrm-backend:${IMAGE_TAG}" "${ECR_REPO_NAME}:${IMAGE_TAG}"
docker push "${ECR_REPO_NAME}:${IMAGE_TAG}"

echo "==> Running terraform apply (workspace: ${ENV})..."
terraform apply \
  -var-file="environments/${ENV}.tfvars" \
  -var "image_tag=${IMAGE_TAG}" \
  -input=false \
  -auto-approve

CLOUDFRONT_DOMAIN=$(terraform output -raw cloudfront_domain)

echo "==> Building frontend (backend via CloudFront: ${CLOUDFRONT_DOMAIN})..."
cd "$REPO_ROOT/frontend"
REACT_APP_BACKEND_URL="https://${CLOUDFRONT_DOMAIN}" \
REACT_APP_FRONTEND_URL="https://${CLOUDFRONT_DOMAIN}" \
NODE_ENV=production \
npx vite build

BUCKET=$(cd "$SCRIPT_DIR" && terraform output -raw frontend_bucket_name)
DISTRIBUTION_ID=$(cd "$SCRIPT_DIR" && terraform output -raw cloudfront_distribution_id)

echo "==> Syncing frontend to S3 (bucket: ${BUCKET})..."
aws s3 sync dist/ "s3://${BUCKET}" --delete

echo "==> Invalidating CloudFront cache..."
aws cloudfront create-invalidation \
  --distribution-id "$DISTRIBUTION_ID" \
  --paths "/*" \
  --query 'Invalidation.Id' --output text

echo ""
echo "=========================================="
echo "  Deploy complete! (${ENV})"
echo "  Backend:  http://$(cd "$SCRIPT_DIR" && terraform output -raw alb_dns_name)"
echo "  Frontend: https://${CLOUDFRONT_DOMAIN}"
echo "=========================================="