#!/usr/bin/env bash
set -euo pipefail

REPO_ROOT=$(unset CDPATH && cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)
TMPDIR=$(mktemp -d)
trap 'rm -rf "$TMPDIR"' EXIT

mkdir -p \
  "$TMPDIR/deployments/dataplane/alertmanager" \
  "$TMPDIR/deployments/dataplane/alertmanager/variants"

cp "$REPO_ROOT/deployments/dataplane/alertmanager/deploy-new-region.sh" \
  "$TMPDIR/deployments/dataplane/alertmanager/deploy-new-region.sh"
cp "$REPO_ROOT/deployments/dataplane/alertmanager/variants/aws-byoc-values-tmpl.yaml" \
  "$TMPDIR/deployments/dataplane/alertmanager/variants/aws-byoc-values-tmpl.yaml"
cp "$REPO_ROOT/deployments/dataplane/alertmanager/variants/azure-byoc-values-tmpl.yaml" \
  "$TMPDIR/deployments/dataplane/alertmanager/variants/azure-byoc-values-tmpl.yaml"

cat >"$TMPDIR/input.json" <<'EOF'
{
  "nginxReadIngressClass": "nginx-read",
  "clinicPrivateDNS": "vpce-0303bd09f9bfa7b90.example.amazonaws.com",
  "clinicSecretName": "clinic-alert-proxy-basic-auth",
  "imageRegistry": "123456789012.dkr.ecr.us-west-2.amazonaws.com",
  "byoc": true
}
EOF

jq -c . "$TMPDIR/input.json" | jq -R . >"$TMPDIR/workflow-input.json"

bash "$TMPDIR/deployments/dataplane/alertmanager/deploy-new-region.sh" \
  aws prod us-east-1 us-east-1-na-test o11y-prod-us-east-1-na-test "$TMPDIR/workflow-input.json"

values="$TMPDIR/deployments/dataplane/alertmanager/envs/prod-aws-us-east-1-na-test/values.yaml"
test -f "$values"
! grep -q 'TMPL_' "$values"
test "$(yq eval '.alertmanager.receivers[1].webhookConfigs[0].httpConfig.basicAuth.username.name' "$values")" = "clinic-alert-proxy-basic-auth"
test "$(yq eval '.alertmanager.receivers[1].webhookConfigs[0].httpConfig.basicAuth.password.name' "$values")" = "clinic-alert-proxy-basic-auth"
test "$(yq eval '.alertmanager.extraSecret // "null"' "$values")" = "null"

cat >"$TMPDIR/missing-secret-input.json" <<'EOF'
{
  "nginxReadIngressClass": "nginx-read",
  "clinicPrivateDNS": "vpce-0303bd09f9bfa7b90.example.amazonaws.com",
  "imageRegistry": "123456789012.dkr.ecr.us-west-2.amazonaws.com",
  "byoc": true
}
EOF

jq -c . "$TMPDIR/missing-secret-input.json" | jq -R . >"$TMPDIR/missing-secret-workflow-input.json"

if bash "$TMPDIR/deployments/dataplane/alertmanager/deploy-new-region.sh" \
  aws prod us-east-1 us-east-1-secret-missing o11y-prod-us-east-1-secret-missing "$TMPDIR/missing-secret-workflow-input.json" \
  >"$TMPDIR/missing-secret.stdout" 2>"$TMPDIR/missing-secret.stderr"; then
  echo "expected deploy-new-region.sh to fail when byoc=true and clinicSecretName is missing" >&2
  exit 1
fi

grep -q 'clinicSecretName is required when byoc=true' "$TMPDIR/missing-secret.stderr"

cat >"$TMPDIR/azure-input.json" <<'EOF'
{
  "nginxReadIngressClass": "nginx-read",
  "imageRegistry": "tidbbyocdev.azurecr.io",
  "byoc": true
}
EOF

jq -c . "$TMPDIR/azure-input.json" | jq -R . >"$TMPDIR/azure-workflow-input.json"

bash "$TMPDIR/deployments/dataplane/alertmanager/deploy-new-region.sh" \
  azure prod japaneast jpeast-byoc-wkly o11y-prod-jpeast-byoc-wkly "$TMPDIR/azure-workflow-input.json"

azure_values="$TMPDIR/deployments/dataplane/alertmanager/envs/prod-azure-jpeast-byoc-wkly/values.yaml"
test -f "$azure_values"
! grep -q 'TMPL_' "$azure_values"