#!/usr/bin/env bash

set -x
set -euo pipefail

ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
source "${ROOT}/../lib.sh"

remote_config=${CONFIG_PATH}
local_config=/tmp/base-config.yaml
bucket_name=${remote_config#s3://}
bucket_name=${bucket_name%%/*}
output_bucket_region=$(aws s3api get-bucket-location --bucket=$bucket_name --query="LocationConstraint" \
  --region=us-west-2 --output=text --no-cli-pager)
aws s3 cp ${remote_config} ${local_config}  --region=$output_bucket_region

local_output=/tmp/output.yaml
remote_output=$(yq '.outputPath' "${local_config}")
cloud_provider=$(yq '.cloudProvider' "${local_config}")
region=$(yq '.region' "${local_config}")
logical_region_name=$(yq '.name' "${local_config}")
env=$(yq '.env' "${local_config}")
cluster_name=$(yq '.k8s.name' "${local_config}")
account_id=$(yq '.aws.controlplaneAccount' "${local_config}")
enable_rds=$(yq '.jobOptions.o11y.enableRDS // false' "${local_config}")
db_instance_class=$(yq '.jobOptions.o11y.RDSInstanceClass // "db.t4g.large"' "${local_config}")
rds_whitelist_cidr="35.155.73.60/32"

#common variables
echo "cloud_provider: $cloud_provider"
echo "region: $region"
echo "logical_region_name: $logical_region_name"
echo "env: $env"
echo "cluster_name: $cluster_name"
echo "account_id: $account_id"
echo "enable_rds: $enable_rds"
echo "db_instance_class: $db_instance_class"

if [[ "$enable_rds" != "true" ]]; then
	echo "RDS deployment is disabled, skipping..."
	exit 0
fi

vpc_id=$(aws eks describe-cluster \
	--name $cluster_name \
	--region $region \
	--query "cluster.resourcesVpcConfig.vpcId" \
	--output text)
echo "vpc_id: $vpc_id"

# Get subnet IDs from EKS cluster
subnet_ids=$(aws eks describe-cluster \
	--name $cluster_name \
	--region $region \
	--query "cluster.resourcesVpcConfig.subnetIds" \
	--output text | tr '\t' ',')
echo "subnet_ids: $subnet_ids"

# Get EKS cluster security group ID
eks_cluster_sg_id=$(aws eks describe-cluster \
	--name $cluster_name \
	--region $region \
	--query "cluster.resourcesVpcConfig.clusterSecurityGroupId" \
	--output text)
echo "eks_cluster_sg_id: $eks_cluster_sg_id"

# RDS configuration
# Sanitize db_name to match MySQL database name requirements: [a-zA-Z][a-zA-Z0-9]*
# Remove hyphens and other special characters, ensure it starts with a letter
db_instance_name="${cluster_name}"
db_name="kubestore"
# Ensure it starts with a letter
if [[ ! "$db_name" =~ ^[a-zA-Z] ]]; then
	db_name="db${db_name}"
fi

echo "db_instance_name: $db_instance_name"
echo "db_name: $db_name"

# Generate secure password
db_username="admin"
db_password=$(openssl rand -base64 32 | tr -d "/@\"'\\" | head -c 32)
echo "db_username: $db_username"
echo "rds_whitelist_cidr: $rds_whitelist_cidr"

# Deploy RDS using CloudFormation
echo "Deploying RDS instance..."
# Use raw name for instance identifier (allows hyphens), sanitized name for database name
aws cloudformation deploy \
	--region $region \
	--stack-name auto-deploy-$db_instance_name-rds \
	--template-file $ROOT/aws/cloudformation/rds.yaml \
	--parameter-overrides \
	DBName=$db_name \
	DBInstanceIdentifier=$db_instance_name \
	DBInstanceClass=$db_instance_class \
	DBUsername=$db_username \
	DBPassword=$db_password \
	WhitelistedCIDR=$rds_whitelist_cidr \
	VpcId=$vpc_id \
	SubnetIds=$subnet_ids \
	EKSClusterSecurityGroupId=$eks_cluster_sg_id

# Get RDS endpoint and port from CloudFormation outputs
db_endpoint=$(aws cloudformation describe-stacks \
	--region $region \
	--stack-name auto-deploy-$db_instance_name-rds \
	--query "Stacks[0].Outputs[?OutputKey=='DBInstanceEndpoint'].OutputValue" \
	--output text)

db_port=$(aws cloudformation describe-stacks \
	--region $region \
	--stack-name auto-deploy-$db_instance_name-rds \
	--query "Stacks[0].Outputs[?OutputKey=='DBInstancePort'].OutputValue" \
	--output text)

echo "db_endpoint: $db_endpoint"
echo "db_port: $db_port"

# Create secret in AWS Secrets Manager
secret_name="${db_instance_name}-rds-credentials"
secret_value=$(
	cat <<EOF
{
  "host": "${db_endpoint}",
  "port": ${db_port},
  "username": "${db_username}",
  "password": "${db_password}",
  "dbname": "${db_name}"
}
EOF
)

echo "Creating secret in Secrets Manager..."
# Check if secret already exists
if aws secretsmanager describe-secret --secret-id $secret_name --region $region >/dev/null 2>&1; then
	echo "Secret $secret_name already exists, updating..."
	aws secretsmanager update-secret \
		--region $region \
		--secret-id $secret_name \
		--secret-string "$secret_value"
else
	echo "Creating new secret $secret_name..."
	aws secretsmanager create-secret \
		--region $region \
		--name $secret_name \
		--description "RDS credentials for ${db_name}" \
		--secret-string "$secret_value" \
		--tags Key=Environment,Value=$env Key=Region,Value=$region Key=ClusterName,Value=$cluster_name
fi

secret_arn=$(aws secretsmanager describe-secret \
	--region $region \
	--secret-id $secret_name \
	--query "ARN" \
	--output text)

echo "secret_arn: $secret_arn"

# Write output to config file
cat <<EOF >"${local_output}"
rds:
  endpoint: ${db_endpoint}
  port: ${db_port}
  dbname: ${db_name}
  username: ${db_username}
  secretArn: ${secret_arn}
  secretName: ${secret_name}
EOF

# echo "Write output to S3..."
aws s3 cp "${local_output}" "${remote_output}" --region=$output_bucket_region

echo "RDS deployment completed successfully!"