#!/usr/bin/env bash
set -euo pipefail

REPO_ROOT=$(unset CDPATH && cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)
TMPDIR=$(mktemp -d)
trap 'rm -rf "$TMPDIR"' EXIT

mkdir -p \
  "$TMPDIR/deployments/infra-v2/kube-prometheus-stack" \
  "$TMPDIR/deployments/infra-v2/kube-prometheus-stack/variants" \
  "$TMPDIR/deployments/charts"

cp "$REPO_ROOT/deployments/infra-v2/kube-prometheus-stack/deploy-new-region.sh" \
  "$TMPDIR/deployments/infra-v2/kube-prometheus-stack/deploy-new-region.sh"
cp "$REPO_ROOT/deployments/infra-v2/kube-prometheus-stack/variants/prod-aws-byoc-values-tmpl.yaml" \
  "$TMPDIR/deployments/infra-v2/kube-prometheus-stack/variants/prod-aws-byoc-values-tmpl.yaml"
cp "$REPO_ROOT/deployments/infra-v2/kube-prometheus-stack/variants/staging-aws-byoc-values-tmpl.yaml" \
  "$TMPDIR/deployments/infra-v2/kube-prometheus-stack/variants/staging-aws-byoc-values-tmpl.yaml"
cp "$REPO_ROOT/deployments/infra-v2/kube-prometheus-stack/variants/dev-azure-byoc-values-tmpl.yaml" \
  "$TMPDIR/deployments/infra-v2/kube-prometheus-stack/variants/dev-azure-byoc-values-tmpl.yaml"
cp -R "$REPO_ROOT/deployments/charts/kube-prometheus-stack" \
  "$TMPDIR/deployments/charts/"

cat >"$TMPDIR/input.json" <<'EOF'
{
  "alertmanagerRoleArn": "arn:aws:iam::123456789012:role/o11y-control-plane",
  "nginxReadIngressClass": "nginx-read",
  "hostedZoneName": "cs-o11y-byoc.cloudtidb-test.com",
  "imageRegistry": "123456789012.dkr.ecr.us-west-2.amazonaws.com",
  "clinicPrivateDNS": "vpce-0303bd09f9bfa7b90.example.amazonaws.com",
  "clinicSecretName": "clinic-alert-proxy-basic-auth",
  "tenantID": "1372813089208281461",
  "byoc": true
}
EOF

jq -c . "$TMPDIR/input.json" | jq -R . >"$TMPDIR/workflow-input.json"

bash "$TMPDIR/deployments/infra-v2/kube-prometheus-stack/deploy-new-region.sh" \
  aws prod us-east-1 us-east-1-na-test o11y-prod-us-east-1-na-test "$TMPDIR/workflow-input.json"

values="$TMPDIR/deployments/infra-v2/kube-prometheus-stack/envs/prod/regional-aws-us-east-1-na-test.yaml"
test -f "$values"
! grep -q 'TMPL_' "$values"
! grep -q 'basic_auth:' "$values"
test "$(yq eval '(.alertmanager.config.route // {}) | length' "$values")" = "0"
test "$(yq eval '(.alertmanager.config.receivers // []) | length' "$values")" = "0"
test "$(yq eval '(.alertmanager.config.inhibit_rules // []) | length' "$values")" = "0"
test "$(yq eval '.alertmanager.alertmanagerSpec.alertmanagerConfiguration.name' "$values")" = "observability-alertmanager-config"

rendered="$TMPDIR/rendered.yaml"
helm template self-monitoring "$TMPDIR/deployments/charts/kube-prometheus-stack" \
  -n self-monitoring \
  -f "$values" >"$rendered"

test "$(yq eval 'select(.kind == "Alertmanager" and .metadata.name == "self-monitoring-kube-prome-alertmanager") | .spec.alertmanagerConfiguration.name' "$rendered")" = "observability-alertmanager-config"
test "$(yq eval 'select(.kind == "Alertmanager" and .metadata.name == "self-monitoring-kube-prome-alertmanager") | .spec.alertmanagerConfigSelector' "$rendered")" = "null"
test "$(yq eval 'select(.kind == "AlertmanagerConfig" and .metadata.name == "observability-alertmanager-config") | .metadata.namespace' "$rendered")" = "self-monitoring"
test "$(yq eval 'select(.kind == "AlertmanagerConfig" and .metadata.name == "observability-alertmanager-config") | .metadata.labels.alertmanagerConfig' "$rendered")" = "self-alert-config"
test "$(yq eval 'select(.kind == "AlertmanagerConfig" and .metadata.name == "observability-alertmanager-config") | .spec.inhibitRules | length' "$rendered")" = "3"
test "$(yq eval 'select(.kind == "AlertmanagerConfig" and .metadata.name == "observability-alertmanager-config") | .spec.route.receiver' "$rendered")" = "null"
test "$(yq eval 'select(.kind == "AlertmanagerConfig" and .metadata.name == "observability-alertmanager-config") | .spec.route.routes[0].receiver' "$rendered")" = "null"
test "$(yq eval 'select(.kind == "AlertmanagerConfig" and .metadata.name == "observability-alertmanager-config") | .spec.route.routes[1].receiver' "$rendered")" = "dms"
test "$(yq eval 'select(.kind == "AlertmanagerConfig" and .metadata.name == "observability-alertmanager-config") | .spec.route.routes[2].receiver' "$rendered")" = "dms"
test "$(yq eval 'select(.kind == "AlertmanagerConfig" and .metadata.name == "observability-alertmanager-config") | .spec.route.routes[3].receiver' "$rendered")" = "pingcap"
test "$(yq eval 'select(.kind == "AlertmanagerConfig" and .metadata.name == "observability-alertmanager-config") | .spec.route.routes[3].routes[0].receiver' "$rendered")" = "pingcap-warning"
test "$(yq eval 'select(.kind == "AlertmanagerConfig" and .metadata.name == "observability-alertmanager-config") | .spec.route.routes[3].routes[1].receiver' "$rendered")" = "pingcap-major"
test "$(yq eval 'select(.kind == "AlertmanagerConfig" and .metadata.name == "observability-alertmanager-config") | .spec.receivers[0].name' "$rendered")" = "null"
test "$(yq eval 'select(.kind == "AlertmanagerConfig" and .metadata.name == "observability-alertmanager-config") | .spec.receivers[1].name' "$rendered")" = "dms"
test "$(yq eval 'select(.kind == "AlertmanagerConfig" and .metadata.name == "observability-alertmanager-config") | .spec.receivers[2].webhookConfigs[0].httpConfig.basicAuth.username.name' "$rendered")" = "clinic-alert-proxy-basic-auth"
test "$(yq eval 'select(.kind == "AlertmanagerConfig" and .metadata.name == "observability-alertmanager-config") | .spec.receivers[2].webhookConfigs[0].httpConfig.basicAuth.password.name' "$rendered")" = "clinic-alert-proxy-basic-auth"

cat >"$TMPDIR/missing-secret-input.json" <<'EOF'
{
  "alertmanagerRoleArn": "arn:aws:iam::123456789012:role/o11y-control-plane",
  "nginxReadIngressClass": "nginx-read",
  "hostedZoneName": "cs-o11y-byoc.cloudtidb-test.com",
  "imageRegistry": "123456789012.dkr.ecr.us-west-2.amazonaws.com",
  "clinicPrivateDNS": "vpce-0303bd09f9bfa7b90.example.amazonaws.com",
  "tenantID": "1372813089208281461",
  "byoc": true
}
EOF

jq -c . "$TMPDIR/missing-secret-input.json" | jq -R . >"$TMPDIR/missing-secret-workflow-input.json"

if bash "$TMPDIR/deployments/infra-v2/kube-prometheus-stack/deploy-new-region.sh" \
  aws prod us-east-1 us-east-1-secret-missing o11y-prod-us-east-1-secret-missing "$TMPDIR/missing-secret-workflow-input.json" \
  >"$TMPDIR/missing-secret.stdout" 2>"$TMPDIR/missing-secret.stderr"; then
  echo "expected deploy-new-region.sh to fail when byoc=true and clinicSecretName is missing" >&2
  exit 1
fi

grep -q 'clinicSecretName is required when byoc=true' "$TMPDIR/missing-secret.stderr"

cat >"$TMPDIR/staging-input.json" <<'EOF'
{
  "alertmanagerRoleArn": "arn:aws:iam::123456789012:role/o11y-control-plane",
  "nginxReadIngressClass": "nginx-read",
  "hostedZoneName": "byoc-dev.pingcap.cloud",
  "imageRegistry": "123456789012.dkr.ecr.us-west-2.amazonaws.com",
  "clinicPrivateDNS": "vpce-0303bd09f9bfa7b90.example.amazonaws.com",
  "clinicSecretName": "clinic-alert-proxy-basic-auth",
  "tenantID": "2130533",
  "byoc": true
}
EOF

jq -c . "$TMPDIR/staging-input.json" | jq -R . >"$TMPDIR/staging-workflow-input.json"

bash "$TMPDIR/deployments/infra-v2/kube-prometheus-stack/deploy-new-region.sh" \
  aws staging us-west-2 usw2-byoc-wkly o11y-staging-usw2-byoc-wkly "$TMPDIR/staging-workflow-input.json"

staging_values="$TMPDIR/deployments/infra-v2/kube-prometheus-stack/envs/staging/regional-aws-usw2-byoc-wkly.yaml"
test -f "$staging_values"
! grep -q 'TMPL_' "$staging_values"
test "$(yq eval '.alertmanager.alertmanagerSpec.containers[0].args[6]' "$staging_values")" = "--metric-dimensions=\"environment=staging\""

cat >"$TMPDIR/azure-input.json" <<'EOF'
{
  "alertmanagerRoleArn": "arn:aws:iam::557537366020:role/rg-tidbcloud-test0603-o11y-infra-dms",
  "nginxReadIngressClass": "nginx-read",
  "hostedZoneName": "o11y.byoctest02.dev.azure.tidbcloud.com",
  "imageRegistry": "tidbbyocdev.azurecr.io",
  "tenantID": "2130533",
  "byoc": true
}
EOF

jq -c . "$TMPDIR/azure-input.json" | jq -R . >"$TMPDIR/azure-workflow-input.json"

bash "$TMPDIR/deployments/infra-v2/kube-prometheus-stack/deploy-new-region.sh" \
  azure dev japaneast jpeast-byoc-wkly o11y-dev-jpeast-byoc-wkly "$TMPDIR/azure-workflow-input.json"

azure_values="$TMPDIR/deployments/infra-v2/kube-prometheus-stack/envs/dev/regional-azure-jpeast-byoc-wkly.yaml"
test -f "$azure_values"
! grep -q 'TMPL_' "$azure_values"