package k8s

import (
	"context"

	"github.com/aws/aws-sdk-go-v2/aws"
	"github.com/aws/aws-sdk-go-v2/config"
	"github.com/aws/aws-sdk-go-v2/credentials/stscreds"
	"github.com/aws/aws-sdk-go-v2/service/sts"
	"github.com/pingcap/errors"

	eksv1alpha1 "github.com/tidbcloud/eks-provider/api/v1alpha1"
	cloudv1 "github.com/tidbcloud/infra-api/api/v1"
)

func NetworkAWSConfig(
	ctx context.Context,
	network *cloudv1.Network,
) (*aws.Config, error) {
	spec, err := eksv1alpha1.EKSNetworkSpecForNetwork(network)
	if err != nil {
		return nil, err
	}

	cfg, err := config.LoadDefaultConfig(ctx)
	if err != nil {
		return nil, errors.Annotate(err, "failed to load default config")
	}

	stsSvc := sts.NewFromConfig(cfg)
	creds := stscreds.NewAssumeRoleProvider(stsSvc, spec.AssumeRoleArn, func(opts *stscreds.AssumeRoleOptions) {
		if spec.AssumeExternalId != "" {
			opts.ExternalID = aws.String(spec.AssumeExternalId)
		}
	})

	cfg.Credentials = aws.NewCredentialsCache(creds)

	return &cfg, nil
}