#!/usr/bin/env bash
set -euo pipefail

ROOT=$(cd $(dirname "${BASH_SOURCE[0]}") && pwd)
source "${ROOT}/../lib.sh"

remote_config=${CONFIG_PATH}
local_config=/tmp/base-config.yaml

output_bucket_endpoint=$(get_oss_bucket_endpoint "$remote_config")
aliyun oss cp "${remote_config}" "${local_config}" --endpoint=$output_bucket_endpoint -f

cloud=$(yq '.cloudProvider' "${local_config}")
env=$(yq '.env' "${local_config}")
region=$(yq '.region' "${local_config}")
logicalRegionName=$(yq '.name' "${local_config}")
cluster=$(yq '.k8s.name' "${local_config}")
controlplane_account=$(yq '.alicloud.controlplaneAccount' "${local_config}")
dataplane_accounts_json=$(yq -ojson '.alicloud.dataplaneAccounts' "${local_config}" | jq -c '.')
dataplane_accounts=$(yq -ojson '.alicloud.dataplaneAccounts' "${local_config}" | jq -r '.[]')
is_byoc=$(yq '.jobOptions.isByoc // "false"' "${local_config}")
job_id=$(yq '.jobId' "${local_config}")
remote_output=$(yq '.outputPath' "${local_config}")
local_output=/tmp/output.yaml
resourceOwnerTag=$(yq '.jobOptions.resourceOwnerTag' "${local_config}")
oidc_issuer=$(yq '.k8s.oidcIssuer' "${local_config}")

remote_aws_iam_config=$(yq '.jobOutput.aws-iam' "${local_config}")
local_aws_iam_config=/tmp/iam-config.yaml
aliyun oss cp ${remote_aws_iam_config} ${local_aws_iam_config} --endpoint=$output_bucket_endpoint -f
oidc_arn=$(yq '.oidcArn' "${local_aws_iam_config}")

# login to AWS
export AWS_REGION=us-east-1
id_token=$(curl -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" "${ACTIONS_ID_TOKEN_REQUEST_URL}" | jq -r '.value')
role=$(yq '.jobOptions.awsAccountRole' "${local_config}")
resp=$(aws sts assume-role-with-web-identity --web-identity-token "${id_token}" \
  --role-arn "${role}" \
  --role-session-name "alicloud-iam-${env}-${logicalRegionName}")
export AWS_ACCESS_KEY_ID=$(echo $resp | jq -r '.Credentials.AccessKeyId')
export AWS_SECRET_ACCESS_KEY=$(echo $resp | jq -r '.Credentials.SecretAccessKey')
export AWS_SESSION_TOKEN=$(echo $resp | jq -r '.Credentials.SessionToken')
aws_account_id=$(aws sts get-caller-identity --query "Account" --output text --no-cli-pager)

# load terraform config
tf_oss_bucket=$(yq '.terraformStateBucket' "${local_config}")
tf_oss_region=$(get_oss_bucket_region "oss://${tf_oss_bucket}")

tf_common_config="-backend-config=bucket=${tf_oss_bucket} -backend-config=region=${tf_oss_region}"
tf_directory="${ROOT}/../aws-tf"

module_path="crossplane-aws-provider/controlplane"
cd "${tf_directory}/${module_path}"
tf_state_prefix="${env}/${module_path}"
tf_state_key="${controlplane_account}-${logicalRegionName}-tfstate.json"
terraform init -reconfigure ${tf_common_config} -backend-config="prefix=${tf_state_prefix}" -backend-config="key=${tf_state_key}"
terraform destroy -auto-approve -var="oidc_arn=${oidc_arn}" \
  -var="env=${env}" \
  -var="logical_region_name=${logicalRegionName}" \
  -var="auto_deploy_owner_tag=${resourceOwnerTag}"

module_path="oidc-provider"
cd "${tf_directory}/${module_path}"
tf_state_prefix="${env}/${module_path}"
tf_state_key="${controlplane_account}-${env}-${logicalRegionName}-tfstate.json"
terraform init -reconfigure ${tf_common_config} -backend-config="prefix=${tf_state_prefix}" -backend-config="key=${tf_state_key}"
terraform destroy -auto-approve -var="oidc_isser=${oidc_issuer}" \
    -var="auto_deploy_owner_tag=${resourceOwnerTag}"