#!/bin/bash

set -euo pipefail

WORKSPACE=$(unset CDPATH && cd $(dirname "${BASH_SOURCE[0]}") && pwd)
DRHOUSE_DIR=$(cd "$WORKSPACE/.." && pwd)
CHARTS="$DRHOUSE_DIR/../charts"

VENDOR=${1:-"aws"}
ENV=${2:-"dev"}
REGION=${3:-""}
LOGICAL_REGION=${4:-"$REGION"}
BYOC_ENABLED=${5:-"false"}

NAMESPACE=observability
RELEASE_NAME=o11yapi
# Must match charts/o11yapi fullname (release + chart name).
STS_NAME="${RELEASE_NAME}-o11y-diagnosis-query"

if [ -z "$VENDOR" ] || [ -z "$ENV" ] || [ -z "$REGION" ] || [ -z "$LOGICAL_REGION" ]; then
  echo "Error: Missing required arguments."
  echo "Usage: $0 <vendor> <env> <region> <logical_region> [isByoc]"
  exit 1
fi

kubectl create namespace observability --dry-run=client -o yaml | kubectl apply -f -

# Ensure JWT_SECRET is available for local JWT verification.
# Kubernetes Secret is namespace-scoped, so we create it in the same namespace
# where o11yapi/diagnosis-query runs (default: `observability`).
SECRET_AUTHSERVER_JWT="${SECRET_AUTHSERVER_JWT:-}"
if [ -n "${SECRET_AUTHSERVER_JWT}" ]; then
  kubectl -n observability create secret generic auth-server-jwt \
    --from-literal=JWT_SECRET="${SECRET_AUTHSERVER_JWT}" \
    --dry-run=client -o yaml | kubectl apply -f -
else
  echo "Warning: SECRET_AUTHSERVER_JWT is empty; JWT auth may fail."
fi

# Base config (vendor/region/env/bucket/image repo...) stays shared with diagnosis-query.
VALUES_FILE="$DRHOUSE_DIR/diagnosis-query/envs/${ENV}-${VENDOR}-${LOGICAL_REGION}/values.yaml"
TAG_FILE="$DRHOUSE_DIR/diagnosis-query/image-tag.yaml"
# Global o11yapi sizing overrides (replicaCount / resources / persistence).
DEFAULTS_FILE="$WORKSPACE/defaults.yaml"
# Optional per-region overrides for o11yapi only.
REGION_VALUES_FILE="$WORKSPACE/envs/${ENV}-${VENDOR}-${LOGICAL_REGION}/values.yaml"

if [ ! -f "$VALUES_FILE" ]; then
  echo "Error: values file not found: $VALUES_FILE"
  exit 1
fi
if [ ! -f "$TAG_FILE" ]; then
  echo "Error: image tag file not found: $TAG_FILE"
  exit 1
fi
if [ ! -f "$DEFAULTS_FILE" ]; then
  echo "Error: o11yapi defaults file not found: $DEFAULTS_FILE"
  exit 1
fi

HELM_ARGS=(
  -f "$VALUES_FILE"
  -f "$TAG_FILE"
  -f "$DEFAULTS_FILE"
)

if [ -f "$REGION_VALUES_FILE" ]; then
  echo "using o11yapi region overrides: $REGION_VALUES_FILE"
  HELM_ARGS+=(-f "$REGION_VALUES_FILE")
fi

# Helm 4: --force-conflicts only works with server-side apply.
# Existing o11yapi releases may still be client-side apply (auto keeps CSA);
# force --server-side=true so we can reclaim kubectl-edit-owned fields.
HELM_SSA_ARGS=()
if helm upgrade --help 2>&1 | grep -q -- '--force-conflicts' && \
   helm upgrade --help 2>&1 | grep -q -- '--server-side'; then
  HELM_SSA_ARGS+=(--server-side=true --force-conflicts)
fi

upgrade_o11yapi() {
  helm upgrade -i --create-namespace --debug \
    "${HELM_SSA_ARGS[@]}" \
    -n "$NAMESPACE" \
    "${HELM_ARGS[@]}" \
    --set o11yAuth.enabled=true \
    "$RELEASE_NAME" "$CHARTS/o11yapi"
}

echo "start upgrading o11yapi (independent diagnosis-query with JWT auth)"
if ! upgrade_o11yapi; then
  # SSA --force-conflicts can rewrite StatefulSet immutable fields
  # (volumeClaimTemplates / selector / serviceName). K8s rejects that.
  # Orphan-delete the STS so Helm can recreate it; Pods and PVCs are kept.
  echo "helm upgrade failed; orphan-deleting StatefulSet ${STS_NAME} (Pods/PVCs kept) and retrying"
  kubectl -n "$NAMESPACE" delete statefulset "$STS_NAME" --cascade=orphan --wait=true || true
  upgrade_o11yapi
fi
echo "end upgrading o11yapi"