#!/usr/bin/env bash

set -x
set -euo pipefail

remote_config=${CONFIG_PATH}
local_config=/tmp/base-config.yaml
bucket_name=${remote_config#s3://}
bucket_name=${bucket_name%%/*}
output_bucket_region=$(aws s3api get-bucket-location --bucket=$bucket_name --query="LocationConstraint" \
  --region=us-west-2 --output=text --no-cli-pager)
aws s3 cp ${remote_config} ${local_config} --region=$output_bucket_region

region=$(yq '.region' "${local_config}")
cluster_name=$(yq '.k8s.name' "${local_config}")
enable_rds=$(yq '.jobOptions.o11y.enableRDS // false' "${local_config}")
stack_name="auto-deploy-${cluster_name}-rds"
secret_name="${cluster_name}-rds-credentials"

echo "region: $region"
echo "cluster_name: $cluster_name"
echo "enable_rds: $enable_rds"

if [[ "$enable_rds" != "true" ]]; then
	echo "RDS deployment is disabled, skipping finalizer..."
	exit 0
fi

if ! aws cloudformation describe-stacks --region "$region" --stack-name "$stack_name" >/dev/null 2>&1; then
	echo "RDS stack $stack_name does not exist, skipping deletion."
	exit 0
fi

db_instance_identifier=$(aws rds describe-db-instances \
	--region "$region" \
	--query "DBInstances[?DBInstanceIdentifier=='${cluster_name}'].DBInstanceIdentifier | [0]" \
	--output text)

if [[ -n "$db_instance_identifier" && "$db_instance_identifier" != "None" ]]; then
	aws rds modify-db-instance \
		--region "$region" \
		--db-instance-identifier "$db_instance_identifier" \
		--no-deletion-protection \
		--apply-immediately
	aws rds wait db-instance-available \
		--region "$region" \
		--db-instance-identifier "$db_instance_identifier"
fi

if aws secretsmanager describe-secret --region "$region" --secret-id "$secret_name" >/dev/null 2>&1; then
	aws secretsmanager delete-secret \
		--region "$region" \
		--secret-id "$secret_name" \
		--force-delete-without-recovery
fi

aws cloudformation delete-stack \
	--region "$region" \
	--stack-name "$stack_name"
aws cloudformation wait stack-delete-complete \
	--region "$region" \
	--stack-name "$stack_name"