#!/usr/bin/env bash
set -euo pipefail

ROOT=$(cd $(dirname "${BASH_SOURCE[0]}") && pwd)
source "${ROOT}/lib.sh"

# load config
remote_config=${CONFIG_PATH}
local_config=/tmp/config.yaml
download_blob "${remote_config}" "${local_config}"

region=$(yq '.region' "${local_config}")
logical_region_name=$(yq '.name' "${local_config}")
env=$(yq '.env' "${local_config}")
controlplane_subscription=$(yq '.azure.controlplaneSubscriptionId' "${local_config}")
dataplane_subscriptions=$(yq -ojson '.azure.dataplaneSubscriptions' "${local_config}" | jq -r '.[]')
job_id=$(yq '.jobId' "${local_config}")
remote_output=$(yq '.outputPath' "${local_config}")
local_output=/tmp/output.yaml

# login to AWS
export AWS_REGION=us-west-2
id_token=$(curl -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" "${ACTIONS_ID_TOKEN_REQUEST_URL}" | jq -r '.value')
role=$(yq '.jobOptions.awsAccountRole' "${local_config}")
resp=$(aws sts assume-role-with-web-identity --web-identity-token "${id_token}" \
  --role-arn "${role}" \
  --role-session-name "azure-iam-${env}-${logical_region_name}")
export AWS_ACCESS_KEY_ID=$(echo $resp | jq -r '.Credentials.AccessKeyId')
export AWS_SECRET_ACCESS_KEY=$(echo $resp | jq -r '.Credentials.SecretAccessKey')
export AWS_SESSION_TOKEN=$(echo $resp | jq -r '.Credentials.SessionToken')
aws_account_id=$(aws sts get-caller-identity --query "Account" --output text --no-cli-pager)
echo "Login to AWS with account ${aws_account_id}"

# get keyvault name
remote_regional_resource_output=$(yq '.jobOutput.regional-resource' "${local_config}")
local_regional_resource_output=/tmp/regional-resource-output.yaml
download_blob "${remote_regional_resource_output}" "${local_regional_resource_output}"
keyvault_name=$(yq '.keyVault.name' "${local_regional_resource_output}")

deploy_tenant_id=$(yq '.azure.controlplaneTenantId' "${local_config}")
deploy_client_id=$(yq '.azure.controlplaneClientId' "${local_config}")
azureLogin $deploy_tenant_id $deploy_client_id

# copy secrets from AWS to Azure
IFS="," read -ra secret_names <<< $(yq '.jobOptions.initKeyVault.awsSecrets | join(",")' "${local_config}")
aws_region=$(yq '.jobOptions.initKeyVault.awsRegion' "${local_config}")
for secret_name in "${secret_names[@]}"; do
  secret_value=$(aws secretsmanager get-secret-value --secret-id "${secret_name}" \
    --query SecretString --region "${aws_region}" --output text)
  
  az keyvault secret set --vault-name "${keyvault_name}" \
    --name "${secret_name}" --value "${secret_value}" > /dev/null # don't display secret
  echo "copied secret ${secret_name}"
done