#!/usr/bin/env bash

set -euo pipefail

ROOT=$(cd $(dirname ${BASH_SOURCE[0]}) && pwd)
source ${ROOT}/lib.sh

remote_config=${CONFIG_PATH}
local_config=/tmp/base-config.yaml
bucket_name=${remote_config#s3://}
bucket_name=${bucket_name%%/*}
output_bucket_region=$(aws s3api get-bucket-location --bucket=$bucket_name --query="LocationConstraint" \
  --region=us-west-2 --output=text --no-cli-pager)
aws s3 cp ${remote_config} ${local_config} --region=$output_bucket_region

o11y_repo=tidbcloud/observability
git_ref="main"
region=$(yq '.region' "${local_config}")
logical_region_name=$(yq '.name' "${local_config}")
env=$(yq '.env' "${local_config}")
vendor=$(yq '.cloudProvider' "${local_config}")
jobId=$(yq '.jobId' "${local_config}")
output=$(yq '.outputPath' "${local_config}")
imageRegistry=$(yq '.jobOptions.o11yRegion.imageRegistry' "${local_config}")

clinic_url=$(yq '.jobOptions.o11yRegion.clinicUrl' "${local_config}")
byoc_tenant_id=$(yq '.jobOptions.o11yRegion.byocTenantID' "${local_config}")
clinic_secret_id=$(yq '.jobOptions.o11yRegion.clinicSecretID' "${local_config}")

o11y_eks_remote_output=$(yq '.jobOutput.o11y-eks' "${local_config}")
o11y_eks_local_output=/tmp/o11y-eks-output.yaml
aws s3 cp ${o11y_eks_remote_output} ${o11y_eks_local_output}  --region=$output_bucket_region
cluster=$(yq '.cluster_name' "${o11y_eks_local_output}")
clinic_private_dns=$(yq '.clinic_dns_entry' "${o11y_eks_local_output}")
account_id=$(yq -r -ojson '.aws.dataplaneAccounts.0' "${local_config}")
kubeconfig=$(yq '.kubeconfig' "${o11y_eks_local_output}")
mkdir ~/.kube
echo "$kubeconfig" > ~/.kube/config

hosted_zone_name=$(yq '.jobOptions.o11yRegion.dns.hostedZoneName // ""' "${local_config}")
if [ -z "$hosted_zone_name" ]; then
  if [ "$env" == "prod" ]; then
      hosted_zone_name="observability.tidbcloud.com"
  else
      hosted_zone_name="observability-$env.pingcap.cloud"
  fi
fi
echo "hosted_zone_name: $hosted_zone_name"


remote_iam_config=$(yq '.jobOutput.o11y-basic-iam' "${local_config}")
local_iam_config=/tmp/iam-config.yaml
aws s3 cp ${remote_iam_config} ${local_iam_config}  --region=$output_bucket_region
o11yRoleARN=$(yq '.vmbackup.roleArn' "${local_iam_config}")
resourceOwnerTag=$(yq '.jobOptions.resourceOwnerTag' "${local_config}")

vmclusterBucketName=o11y-${env}-shared-${logical_region_name}
lokiBucketName=loki-${env}-${logical_region_name}-o11y
nginxReadIngressClass="nginx-read"
nginxWriteIngressClass="nginx-write"

if ! aws --profile $account_id s3api head-bucket --bucket "$vmclusterBucketName" 2>/dev/null; then
    echo "o11y bucket $vmclusterBucketName does not exist, creating..."
    aws --profile $account_id s3 mb --region $region "s3://$vmclusterBucketName"
    aws --profile $account_id s3api put-bucket-tagging --bucket "${vmclusterBucketName}" --tagging "TagSet=[{Key=tidbcloud-auto-deploy-owner,Value=${resourceOwnerTag}}]" >/dev/null
    aws --profile $account_id s3api put-bucket-policy --bucket "$vmclusterBucketName" --policy '{
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "DenyInsecureConnections",
          "Effect": "Deny",
          "Principal": "*",
          "Action": "s3:*",
          "Resource": [
            "arn:aws:s3:::'"$vmclusterBucketName"'",
            "arn:aws:s3:::'"$vmclusterBucketName"'/*"
          ],
          "Condition": {
            "Bool": {
              "aws:SecureTransport": "false"
            }
          }
        }
      ]
    }'
    echo "o11y bucket $vmclusterBucketName created"
else
    echo "o11y bucket $vmclusterBucketName already exists"
fi

if ! aws --profile $account_id s3api head-bucket --bucket "$lokiBucketName" 2>/dev/null; then
    echo "loki bucket $lokiBucketName does not exist, creating..."
    aws --profile $account_id s3 mb --region $region "s3://$lokiBucketName"
    aws --profile $account_id s3api put-bucket-tagging --bucket "${lokiBucketName}" --tagging "TagSet=[{Key=tidbcloud-auto-deploy-owner,Value=${resourceOwnerTag}}]" >/dev/null
    aws --profile $account_id s3api put-bucket-policy --bucket "$lokiBucketName" --policy '{
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "DenyInsecureConnections",
          "Effect": "Deny",
          "Principal": "*",
          "Action": "s3:*",
          "Resource": [
            "arn:aws:s3:::'"$lokiBucketName"'",
            "arn:aws:s3:::'"$lokiBucketName"'/*"
          ],
          "Condition": {
            "Bool": {
              "aws:SecureTransport": "false"
            }
          }
        }
      ]
    }'
    echo "loki bucket $lokiBucketName created"
    aws --profile=${account_id} s3api put-bucket-lifecycle-configuration --bucket "$lokiBucketName" \
        --lifecycle-configuration file://$ROOT/lifecycle.json
    echo "Lifecycle configuration for loki bucket $lokiBucketName set"
else
    echo "loki bucket $lokiBucketName already exists"
fi


# Get clinic credentials
# read client secret using aws cli from aws secret manager
secret_string=$(aws secretsmanager get-secret-value --secret-id ${clinic_secret_id} --query SecretString --region us-west-2 --output text)
clinic_user_name=$(echo ${secret_string} | jq -r .clinicUserName)
clinic_password=$(echo ${secret_string} | jq -r .clinicPassword)
basic_auth_token=$(echo -n "${clinic_user_name}:${clinic_password}" | base64)

clinic_response=$(curl -s --location "${clinic_url}/api/byoc/v1/orgs/${byoc_tenant_id}/token" \
  --header "Authorization: Basic ${basic_auth_token}" \
  --header 'Content-Type: application/json')

am_user_name=$(echo "$clinic_response" | jq -r '.username')
am_password=$(echo "$clinic_response" | jq -r '.password')

if [[ -z "$am_user_name" || -z "$am_password" ]]; then
  echo "Failed to get alertmanager credentials"
  exit 1
fi

args=$(cat <<EOF
{
  "vmclusterBucketName": "$vmclusterBucketName",
  "vmclusterRoleARN": "$o11yRoleARN",
  "lokiBucketName": "$lokiBucketName",
  "lokiRoleARN": "$o11yRoleARN",
  "nginxReadIngressClass": "$nginxReadIngressClass",
  "nginxWriteIngressClass": "$nginxWriteIngressClass",
  "imageRegistry": "$imageRegistry",
  "hostedZoneName": "$hosted_zone_name",
  "clinicPrivateDNS": "$clinic_private_dns",
  "alertmanagerUserName": "$am_user_name",
  "alertmanagerPassword": "$am_password",
  "byoc": true
}
EOF
)
echo "args: $args"

common_params="-f vendor=${vendor} -f region=${region} -f logicalRegionName=${logical_region_name} -f env=${env} -f cluster=${cluster} -f jobId=${jobId}"
# Create pull request by invoking new-region workflow.
gh workflow run new-region-dataplane.yaml --repo ${o11y_repo} --ref ${git_ref} ${common_params} -f args="${args}"
wait_workflow_run_to_merge new-region-dataplane.yaml ${o11y_repo}
if [[ $? -eq 1 ]]; then
    echo "Workflow failed"
    exit 1
fi

# Deploy application services by invoking infra-cd workflow
gh workflow run dataplane-cd.yaml --repo ${o11y_repo} --ref ${git_ref} -f env=${env} -f region=${logical_region_name} -f vendor=${vendor} -f git-ref=${git_ref} -f aws-role-arn="arn:aws:iam::${account_id}:role/auto-deploy-cli"

# Wait services ready
declare -A ss
ss["sts/vmstorage-vmcluster -n observability"]="false"
ss["sts/vmselect-vmcluster -n observability"]="false"
ss["deploy/vminsert-vmcluster -n observability"]="false"
# TODO(mornyx): remove this when Loki is ready
# Do not check Loki yet, as the new Loki CD has not been merged yet
# ss["sts/loki-ha-write -n observability"]="false"
# ss["deploy/loki-ha-read -n observability"]="false"
ss["sts/alertmanager-alert-regional -n default"]="false"
# ss["deploy/sli-reporter -n sli-reporter"]="false"

wait_for_services_ready ss
if [[ $? -eq 1 ]]; then
    echo "Services are not ready"
    exit 1
fi