##
#!/usr/bin/env bash

remote_config=${CONFIG_PATH}
local_config=/tmp/base-config.yaml

bucket_name=${remote_config#s3://}
bucket_name=${bucket_name%%/*}
output_bucket_region=$(aws s3api get-bucket-location --bucket=$bucket_name --query="LocationConstraint" \
  --region=us-west-2 --output=text --no-cli-pager)
aws s3 cp "${remote_config}" "${local_config}" --region=$output_bucket_region

disabled=$(yq '.jobOptions.dpProvider.disabled' "${local_config}")
if [[ $disabled == "true" ]]; then
  echo "job is disabled, exit"
  exit 0
fi

env=$(yq '.env' "${local_config}")
cloud=$(yq '.cloudProvider' "${local_config}")
region=$(yq '.region' "${local_config}")
job_id=$(yq '.jogId' "${local_config}")

# 1. sync application secrets to new region
# if [[ $cloud == "aws" && $region != "us-west-2" ]]; then
#   # the main secret is created in us-west-2, we need to replicate to the new region
#   infra_api_server_key=$(yq '.jobOptions.dpProvider.secretManager.infraAPIServerKey' "${local_config}")
#   api_gateway_key=$(yq '.jobOptions.dpProvider.secretManager.apiGatewayKey' "${local_config}")
#   echo "infra_api_server_key: $infra_api_server_key"
#   echo "api_gateway_key: $api_gateway_key"
#   aws secretsmanager replicate-secret-to-regions --secret-id "${infra_api_server_key}" --add-replica-regions Region="${region}" --region=us-west-2
#   aws secretsmanager replicate-secret-to-regions --secret-id "${api_gateway_key}" --add-replica-regions Region="${region}" --region=us-west-2
# fi

# 2. append the regional control plane outbound ips to global api gateway inner WAF ip set
waf_ip_set_name=$(yq '.jobOptions.dpProvider.wafIpSetName' "${local_config}")
echo "waf_ip_set_name: \"$waf_ip_set_name\""
if [[ ! -z $waf_ip_set_name ]]; then
  outbound_ips=$(yq -ojson '.k8s.publicIps | map(. + "/32")' "${local_config}")
  waf_ip_set_id=$(aws wafv2 list-ip-sets --scope REGIONAL --region us-west-2 | jq -r ".IPSets[] | select(.Name==\"${waf_ip_set_name}\") | .Id")
  waf_retry_num=0
  waf_max_retry_num=5
  while true; do
    waf_ip_set_json=$(aws wafv2 get-ip-set --scope REGIONAL --region us-west-2 --name "${waf_ip_set_name}" --id "${waf_ip_set_id}")
    waf_ip_set_addrs=$(echo "${waf_ip_set_json}" | jq -r '.IPSet.Addresses')
    waf_ip_set_lock_token=$(echo "${waf_ip_set_json}" | jq -r '.LockToken')
    update_waf_ip_set_addrs=$(echo "${waf_ip_set_addrs}" | jq ". += ${outbound_ips}" | jq -r '.[]' | tr '\n' ' ')
    aws wafv2 update-ip-set --scope REGIONAL --region us-west-2 --name "${waf_ip_set_name}" --id "${waf_ip_set_id}" --lock-token "${waf_ip_set_lock_token}" --addresses ${update_waf_ip_set_addrs}
    if [[ $? == 0 ]]; then
      echo "update ip set ${waf_ip_set_name} successfully"
      break
    fi
    echo "update ip set ${waf_ip_set_name} failed, retrying"
    waf_retry_num=$((waf_retry_num + 1))
    if [[ ${waf_retry_num} -ge ${waf_max_retry_num} ]]; then
      echo "retry updating ip set timeout"
      exit 1
    else
      sleep 5
    fi
  done
fi