#!/usr/bin/env bash

ROOT=$(cd $(dirname "${BASH_SOURCE[0]}") && pwd)
source "${ROOT}/lib.sh"

remote_config=${CONFIG_PATH}
local_config=/tmp/base-config.yaml

bucket_name=${remote_config#s3://}
bucket_name=${bucket_name%%/*}
output_bucket_region=$(aws s3api get-bucket-location --bucket=$bucket_name --query="LocationConstraint" \
  --region=us-west-2 --output=text --no-cli-pager)
aws s3 cp "${remote_config}" "${local_config}" --region=$output_bucket_region

argocd_repo=tidbcloud/app-delivery
region=$(yq '.region' "${local_config}")
logicalRegionName=$(yq '.name' "${local_config}")
env=$(yq '.env' "${local_config}")
cloud=$(yq '.cloudProvider' "${local_config}")
cluster=$(yq '.k8s.name' "${local_config}")
jobId=$(yq '.jobId' "${local_config}")
output=$(yq '.outputPath' "${local_config}")

publicly_accessible=$(yq '.jobOptions.ng-service.rds.publicly_accessible // "true"' "${local_config}")
rds_port=$(yq '.jobOptions.ng-service.rds.port' "${local_config}")
rds_host=$(yq '.jobOptions.ng-service.rds.host' "${local_config}")
rcfg_arn=$(yq '.jobOptions.ng-service.rds.rcfg_arn // ""' "${local_config}")
proxy_service=$(yq '.jobOptions.ng-service.rds.proxy_service // ""' "${local_config}")
proxy_name=$(yq '.jobOptions.ng-service.rds.proxy_name // ""' "${local_config}")

if [[ "$publicly_accessible" == "true" ]]; then
  echo "===================== configure rds security group ====================="
  rds_name="${rds_host%%.cluster*}"
  tag_key="rds"
  sg_name1="rds-${rds_name}-sg"
  sg_name2="${rds_name}-sg"
  ips=$(yq -ojson '.k8s.publicIps | map(. + "/32")' "$local_config")

  # 1. Find VPC by RDS tag
  vpc_id=$(aws ec2 describe-vpcs \
    --filters "Name=tag:${tag_key},Values=${rds_name}" \
    --query "Vpcs[0].VpcId" \
    --output text)

  if [[ "$vpc_id" == "None" ]]; then
    echo "❌ VPC not found (tag:${tag_key}=${rds_name})"
    exit 1
  fi
  echo "✅ Found VPC: $vpc_id"

  # 2. Find Security Group by name
  sg_id=$(aws ec2 describe-security-groups \
    --filters "Name=vpc-id,Values=${vpc_id}" "Name=group-name,Values=${sg_name1}" \
    --query "SecurityGroups[0].GroupId" \
    --output text)

  if [[ "$sg_id" == "None" ]]; then
    sg_id=$(aws ec2 describe-security-groups \
    --filters "Name=vpc-id,Values=${vpc_id}" "Name=group-name,Values=${sg_name2}" \
    --query "SecurityGroups[0].GroupId" \
    --output text)
  fi
  if [[ "$sg_id" == "None" ]]; then
    echo "❌ not found Security Group (name:${sg_name1} or name:${sg_name2})"
    exit 1
  fi
  echo "✅ Found Security Group: $sg_id"

  # 3. Check if the IP already exists in the ingress rules
  cirds=$(aws ec2 describe-security-groups \
    --group-ids "$sg_id" \
    --query "SecurityGroups[0].IpPermissions[].IpRanges[].CidrIp" \
    --output json)
  for ip in $(echo "${ips}" | jq -r '.[]'); do
    exists=$(echo "$cirds" | jq "index(\"${ip}\") != null")
    if $exists; then
      echo "➖ Remove $ip into $sg_id ingress"
      aws ec2 revoke-security-group-ingress \
        --group-id $sg_id \
        --protocol tcp \
        --port ${rds_port} \
        --cidr $ip
      echo "✅ Remove ingress rules"
    fi
  done
  exit 0
fi

vpc_id=$(aws eks describe-cluster \
  --name $cluster \
  --query "cluster.resourcesVpcConfig.vpcId" \
  --output text)
echo "found vpc: $vpc_id"

echo "remove vpc endpoint"
endpoint_id=""
if [[ -n "$rcfg_arn" ]]; then
  endpoint_id=$(aws ec2 describe-vpc-endpoints \
    --filters "Name=vpc-id,Values=$vpc_id" \
    --query "VpcEndpoints[?ResourceConfigurationArn=='${rcfg_arn}'].VpcEndpointId" \
    --output text)
elif [[ -n "$proxy_service" ]]; then
  endpoint_id=$(aws ec2 describe-vpc-endpoints \
    --filters "Name=vpc-id,Values=$vpc_id" \
    --query "VpcEndpoints[?ServiceName=='${proxy_service}'].VpcEndpointId" \
    --output text)
fi
if [ -n "$endpoint_id" ]; then
  echo "vpc endpoint ${endpoint_id} found, trying to remove"
  aws ec2 delete-vpc-endpoints --vpc-endpoint-ids $endpoint_id
  while aws ec2 describe-vpc-endpoints --vpc-endpoint-ids $endpoint_id 2>/dev/null; do
    echo "waiting for vpc endpoint to be removed..."
    sleep 10
  done
fi

echo "remove security group"
sg_name=${cluster}-rds-privatelink
security_group_id=$(aws ec2 describe-security-groups \
  --filters "Name=vpc-id,Values=$vpc_id" "Name=group-name,Values=$sg_name" \
  --query "SecurityGroups[0].GroupId" \
  --output text)
if [ "$security_group_id" != "None" ]; then
  echo "sg ${sg_name}($security_group_id) found, trying to remove"
  aws ec2 delete-security-group --group-id=$security_group_id
  while aws ec2 describe-security-groups --group-ids $security_group_id 2>/dev/null; do
    echo "waiting for security group to be removed..."
    sleep 10
  done
fi

if [[ -n "$proxy_name" ]]; then
  cluster_service_secret_name="${env}-${logicalRegionName}-rds-cluster-service-pawssword"
  config_center_secret_name="${env}-${logicalRegionName}-rds-config-center-pawssword"

  new_secret_names=(
      $cluster_service_secret_name
      $config_center_secret_name
  )
  current_auth=$(aws rds describe-db-proxies \
    --db-proxy-name "$proxy_name" \
    --query "DBProxies[0].Auth" \
    --output json)
  echo "🔍 Current auth: $current_auth"

  current_secret_arns=$(echo "$current_auth" | jq -r '.[].SecretArn')
  merged_auth=$current_auth

  updated=false
  for secret_name in "${new_secret_names[@]}"; do
    secret_arn=$(aws secretsmanager describe-secret \
      --secret-id "$secret_name" \
      --query "ARN" \
      --output text)

    if [[ -z "$secret_arn" ]]; then
      echo "✔ Secret $secret_name not found"
    elif echo "$current_secret_arns" | grep -q "$secret_arn"; then
      echo "➖ Remove secret: $secret_name ($secret_arn)"
      merged_auth=$(echo "$merged_auth" | jq --arg arn "$secret_arn" '[.[] | select(.SecretArn != $arn)]')
      updated=true
    else
      echo "✔ Secret $secret_name ($secret_arn) already removed"
    fi
  done
  echo "📝 Final merged auth: $merged_auth"

  if $updated; then
    aws rds modify-db-proxy \
      --db-proxy-name "$proxy_name" \
      --auth "$merged_auth"
    echo "✅ Proxy $proxy_name updated"
  else
    echo "✔ No changes needed for proxy $proxy_name."
  fi
fi