#!/usr/bin/env bash

set -euo pipefail

ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
source "${ROOT}/lib.sh"

remote_config=${CONFIG_PATH}
local_config=/tmp/base-config.yaml
bucket_name=${remote_config#s3://}
bucket_name=${bucket_name%%/*}
output_bucket_region=$(aws s3api get-bucket-location --bucket=$bucket_name --query="LocationConstraint" \
  --region=us-west-2 --output=text --no-cli-pager)
aws s3 cp ${remote_config} ${local_config}  --region=$output_bucket_region

o11y_repo=tidbcloud/observability
git_ref="main"
region=$(yq '.region' "${local_config}")
logical_region_name=$(yq '.name' "${local_config}")
env=$(yq '.env' "${local_config}")
vendor=$(yq '.cloudProvider' "${local_config}")
cluster=$(yq '.k8s.name' "${local_config}")
jobId=$(yq '.jobId' "${local_config}")
account=$(yq '.aws.controlplaneAccount' "${local_config}")
imageRegistry=$(yq '.imageRegistry' "${local_config}")
enable_rds=$(yq '.jobOptions.o11y.enableRDS // false' "${local_config}")

hosted_zone_name="observability-$env.pingcap.cloud"
if [ "$env" == "prod" ]; then
    hosted_zone_name="observability.tidbcloud.com"
fi
echo "hosted_zone_name: $hosted_zone_name"

rds_secret_arn=""
if [[ $enable_rds == "true" ]]; then
	echo "getting secret ARN for RDS..."
	remote_rds_config=$(yq '.jobOutput.basic-rds // ""' "${local_config}")
	local_rds_config=/tmp/basic-rds-config.yaml
	if [[ -n "$remote_rds_config" && "$remote_rds_config" != "null" ]]; then
		aws s3 cp "${remote_rds_config}" "${local_rds_config}" --region="$output_bucket_region"
		rds_secret_arn=$(yq '.rds.secretArn // ""' "${local_rds_config}")
	fi
fi

echo "enable_rds: $enable_rds"
echo "rds_secret_arn: $rds_secret_arn"

# remote_iam_config=$(yq '.jobOutput.iam' "${local_config}")
# local_iam_config=/tmp/iam-config.yaml
# aws s3 cp ${remote_iam_config} ${local_iam_config}
# awsIrsaRoleArn=$(yq '.certManager.roleArn' "${local_iam_config}")
regionalServerRoleARN="arn:aws:iam::${account}:role/regional-server-${cluster}"
diagBucketName=o11y-${env}-shared-${logical_region_name}

oidcValue=$(yq '.k8s.oidcIssuer' "${local_config}" | sed -E 's/^\s*.*:\/\///g')
oidcARN=arn:aws:iam::${account}:oidc-provider/${oidcValue}
zone=$(yq '.jobOptions.o11y.zone' "$local_config")
zone_suffix=${zone#$region}

LBOutputs=$(aws cloudformation describe-stacks \
  --stack-name auto-deploy-${cluster}-ingress \
  --query 'Stacks[0].Outputs' \
  --output json)
certificateARN=$(echo $LBOutputs | jq -r '.[] | select(.OutputKey=="RsCertificateArn") | .OutputValue')
wafACLARN=$(echo $LBOutputs | jq -r '.[] | select(.OutputKey=="RsWebAclArn") | .OutputValue')

endpointServiceID=$(aws cloudformation describe-stacks \
    --stack-name auto-deploy-${cluster}-vpc-endpoint-service \
    --query 'Stacks[0].Outputs[?OutputKey==`VpcEndpointServiceId`].OutputValue' \
    --output text)

endpointServiceDNSName="prometheus-endpoint-$zone_suffix.$hosted_zone_name"
dataplaneAssumeRole="${env}-${logical_region_name}-dp4o11yrs"

nginxReadIngressClass="nginx-read"
nginxWriteIngressClass="nginx-write"

args=$(cat <<EOF
{
  "regionalServerRoleARN": "$regionalServerRoleARN",
  "diagBucketName": "$diagBucketName",
  "oidcARN": "$oidcARN",
  "oidcValue": "$oidcValue",
  "zone": "$zone",
  "endpointServiceID": "$endpointServiceID",
  "certificateARN": "$certificateARN",
  "wafACLARN": "$wafACLARN",
  "nginxReadIngressClass": "$nginxReadIngressClass",
  "nginxWriteIngressClass": "$nginxWriteIngressClass",
  "endpointServiceDNSName": "$endpointServiceDNSName",
  "dataplaneAssumeRole" : "$dataplaneAssumeRole",
  "enableRDS": $enable_rds,
  "rdsSecretARN": "$rds_secret_arn",
  "imageRegistry": "$imageRegistry",
  "account": "$account",
  "hostedZoneName": "$hosted_zone_name"
}
EOF
)
echo "args: $args"

common_params="-f vendor=${vendor} -f region=${region} -f logicalRegionName=${logical_region_name} -f env=${env} -f cluster=${cluster} -f jobId=${jobId}"
# Create pull request by invoking new-region workflow.
gh workflow run new-region-regional-server.yaml --repo ${o11y_repo} --ref ${git_ref} ${common_params} -f args="${args}"
wait_workflow_run_to_merge new-region-regional-server.yaml ${o11y_repo}
if [[ $? -eq 1 ]]; then
    exit 1
fi

gh workflow run regional-server-cd.yaml --repo ${o11y_repo} --ref ${git_ref} -f env=${env} -f region=${logical_region_name} -f vendor=${vendor} -f git-ref=${git_ref}

# Wait services ready
declare -A ss
ss["deploy/regionalserver -n observability"]="false"
ss["deploy/data-server -n observability"]="false"

wait_for_services_ready ss
if [[ $? -eq 1 ]]; then
    echo "Services are not ready"
    exit 1
fi