#!/usr/bin/env bash

set -euo pipefail

ROOT=$(cd $(dirname "${BASH_SOURCE[0]}") && pwd)
source ${ROOT}/../lib.sh

remote_config=${CONFIG_PATH}
local_config=/tmp/config.yaml
download_blob "${remote_config}" "${local_config}"

o11y_repo=tidbcloud/observability
git_ref="main"
region=$(yq '.region' "${local_config}")
logical_region_name=$(yq '.name' "${local_config}")
env=$(yq '.env' "${local_config}")
vendor=$(yq '.cloudProvider' "${local_config}")
jobId=$(yq '.jobId' "${local_config}")

# login to AWS
export AWS_REGION=us-west-2
id_token=$(curl -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" "${ACTIONS_ID_TOKEN_REQUEST_URL}" | jq -r '.value')
role=$(yq '.jobOptions.awsAccountRole' "${local_config}")
resp=$(aws sts assume-role-with-web-identity --web-identity-token "${id_token}" \
  --role-arn "${role}" \
  --role-session-name "azure-iam-${env}-${logical_region_name}")
export AWS_ACCESS_KEY_ID=$(echo $resp | jq -r '.Credentials.AccessKeyId')
export AWS_SECRET_ACCESS_KEY=$(echo $resp | jq -r '.Credentials.SecretAccessKey')
export AWS_SESSION_TOKEN=$(echo $resp | jq -r '.Credentials.SessionToken')
aws_account_id=$(aws sts get-caller-identity --query "Account" --output text --no-cli-pager)
echo "Login to AWS with account ${aws_account_id}"

remote_dms_config=$(yq '.jobOutput.basic-dms' "${local_config}")
local_dms_config=/tmp/dms-config.yaml
download_blob "${remote_dms_config}" "${local_dms_config}"

alarm_name=$(yq '.cloudwatchAlarmName' "${local_dms_config}")
dms_role_arn=$(yq '."dmsRoleArn"' "${local_dms_config}")
oidc_provider_arn=$(yq '."oidcProviderArn"' "${local_dms_config}")

# Delete CloudWatch Alarm if exists
if aws cloudwatch describe-alarms --alarm-names "$alarm_name" &> /dev/null; then
    aws cloudwatch delete-alarms --alarm-names "$alarm_name"
fi

# Delete IAM Role if exists
if aws iam get-role --role-name "${dms_role_arn}" &> /dev/null; then
    aws iam delete-role --role-name "${dms_role_arn}"
fi

# Delete OIDC Provider if exists
if aws iam get-open-id-connect-provider --open-id-connect-provider-arn "$oidc_provider_arn" &> /dev/null; then
    aws iam delete-open-id-connect-provider --open-id-connect-provider-arn "$oidc_provider_arn"
fi