package gke

import (
	"context"
	"fmt"
	"time"

	"github.com/tidbcloud/infra-provider/pkg/cloud/gcp"
	"github.com/tidbcloud/infra-provider/pkg/deploy"
	"github.com/tidbcloud/infra-provider/pkg/util"
	"github.com/tidbcloud/infra-provider/regional-server/api/v1alpha1"
	"github.com/tidbcloud/infra-provider/regional-server/pkg/controllers/appbox/task"
)

const roleArtifactRegistryReader = "roles/artifactregistry.reader"

// ArtifactRegistryPolicy grant repository permissions to node SA at the project level,
// refer to https://cloud.google.com/artifact-registry/docs/access-control#grant
type ArtifactRegistryPolicy struct {
	*task.BaseTask
	gcpCli gcp.Client
}

func NewArtifactRegistryPolicy(ctx *task.Context, gcpCli gcp.Client) *ArtifactRegistryPolicy {
	return &ArtifactRegistryPolicy{
		BaseTask: &task.BaseTask{Context: ctx},
		gcpCli:   gcpCli,
	}
}

func (t *ArtifactRegistryPolicy) Name() string {
	return "ArtifactRegistryPolicy"
}

func (t *ArtifactRegistryPolicy) Create(ctx context.Context) deploy.Result {
	t.BeginAt = util.Pointer(time.Now())
	// do nothing for legacy data.
	if t.APPBox.Labels[v1alpha1.IsLegacyKey] == "true" {
		return deploy.Done()
	}
	centralProjectID := t.Config.ProviderConfig.AccountID
	saEmail := t.APPBox.Status.IAM.ServiceAccountEmail
	if saEmail == "" {
		return deploy.Error(fmt.Errorf("service account is empty"))
	}

	if err := t.gcpCli.ResourceManager().AddProjectPolicyBinding(
		ctx,
		centralProjectID,
		roleArtifactRegistryReader,
		serviceAccountPrefix+saEmail,
	); err != nil {
		return deploy.Error(err)
	}

	return deploy.Done()
}

func (t *ArtifactRegistryPolicy) Delete(ctx context.Context) deploy.Result {
	if t.APPBox.Status.IAM.ServiceAccountEmail == "" { // skip if service account is not created
		return deploy.Done()
	}
	saEmail := t.APPBox.Status.IAM.ServiceAccountEmail
	centralProjectID := t.Config.ProviderConfig.AccountID
	if err := t.gcpCli.ResourceManager().DelProjectPolicyBinding(
		ctx,
		centralProjectID,
		roleArtifactRegistryReader,
		serviceAccountPrefix+saEmail,
	); err != nil {
		return deploy.Error(err)
	}
	return deploy.Done()
}