#!/usr/bin/env bash
# Deploy one environment through explicit readiness boundaries.
#
# Kustomize stages are the deployment contract:
#   namespaces -> 00-platform -> 10-vault -> 20-secrets
#              -> 30-data -> MinIO credential provisioning -> 35-registry
#              -> 40-operations -> 50-apps
#
# `gitops/clusters/<env>/main/all` is deliberately not applied. It exists only for local
# render, schema, and policy validation because Kustomize cannot express CRD
# establishment, controller readiness, Vault initialization, or one-shot Job
# completion.

set -Eeuo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=../lib/common.sh
. "$SCRIPT_DIR/../lib/common.sh"

REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
GITOPS_ROOT="$REPO_ROOT/gitops"
TASKS_DIR="$SCRIPT_DIR/../tasks"
FIELD_MANAGER="project-infra-bootstrap"
NAMESPACE="mnt"
export REPO_ROOT

VSO_MANAGED_SECRETS=(
  identity-postgres-superuser
  keycloak-db
  keycloak-db-operator
  auth-server-db
  keycloak-bootstrap-admin
  keycloak-bootstrap-admin-operator
  keycloak-client-auth-server-ingress
  oauth2-proxy-secrets
  minio-tenant-env
  docker-registry-minio
  docker-registry-basic-auth
  docker-registry-pull-credentials
)

PRE_DATA_SECRETS=(
  identity-postgres-superuser
  keycloak-db
  keycloak-db-operator
  auth-server-db
  keycloak-bootstrap-admin
  keycloak-bootstrap-admin-operator
  keycloak-client-auth-server-ingress
  oauth2-proxy-secrets
  minio-tenant-env
  docker-registry-basic-auth
  docker-registry-pull-credentials
)

usage() {
  cat >&2 <<'EOF'
Usage: scripts/bin/bootstrap.sh <lab|staging|prod>

The selected overlay must exist. The repository currently ships `lab`.

Required:
  KUBE_CONTEXT_<ENV> or KUBE_CONTEXT  Expected kubectl context

Options:
  VAULT_KEYS_FILE=<path>      Vault init result. prod requires a path outside the repo
  RESET_STALE_SECRETS=yes     Delete VSO-managed Kubernetes Secrets before resync
  ALLOW_PROD_SECRET_RESET=yes Required with RESET_STALE_SECRETS=yes in prod
  SKIP_DIFF=yes               Skip kubectl diff (not recommended)
  CONFIRM=yes                 Approve each stage in non-interactive automation
EOF
  exit 1
}

render_entrypoint() {
  local entrypoint="$1"
  local output="$2"
  kubectl kustomize "$entrypoint" >"$output"
}

apply_entrypoint() {
  local label="$1"
  local entrypoint="$2"
  [[ -f "$entrypoint/kustomization.yaml" ]] \
    || die "Kustomize entrypoint 없음: $entrypoint"

  local tmpdir rendered rc=0
  tmpdir="$(mktemp -d -t project-infra-bootstrap.XXXXXX)"
  trap_cleanup_path "$tmpdir"
  rendered="$tmpdir/rendered.yaml"

  render_entrypoint "$entrypoint" "$rendered"
  log "[$label] render 완료: $(grep -c '^kind:' "$rendered") resources"

  if ! kubectl apply -f "$rendered" \
    --dry-run=server \
    --server-side \
    --field-manager="$FIELD_MANAGER" \
    >"$tmpdir/dry-run.out" 2>&1; then
    err "[$label] server-side dry-run 실패"
    sed 's/^/  /' "$tmpdir/dry-run.out" >&2
    die "$label 검증 실패"
  fi

  if [[ "${SKIP_DIFF:-}" == "yes" ]]; then
    warn "[$label] SKIP_DIFF=yes: diff 생략"
  else
    kubectl diff -f "$rendered" \
      --server-side \
      --field-manager="$FIELD_MANAGER" \
      >"$tmpdir/diff.out" 2>&1 || rc=$?
    case "$rc" in
      0)
        log "[$label] 변경 없음"
        ;;
      1)
        log "[$label] diff"
        sed 's/^/  /' "$tmpdir/diff.out" >&2
        ;;
      *)
        err "[$label] kubectl diff 실패 (exit=$rc)"
        sed 's/^/  /' "$tmpdir/diff.out" >&2
        die "$label diff 실패"
        ;;
    esac
  fi

  confirm "[$label] env=$ENV_NAME context='$KUBE_CONTEXT_LOCKED' 에 적용합니까?" \
    || die "사용자 취소"

  kubectl apply -f "$rendered" \
    --server-side \
    --field-manager="$FIELD_MANAGER"
}

precheck_namespaces() {
  local phase
  ns_exists "$NAMESPACE" || return 0
  phase="$(ns_phase "$NAMESPACE")"
  [[ "$phase" != "Terminating" ]] \
    || die "namespace '$NAMESPACE' 가 Terminating 상태입니다. teardown 복구를 먼저 완료하세요."
}

wait_platform_ready() {
  log "cert-manager CRD / controller 준비 대기"
  retry 30 2 kubectl wait --for=condition=Established --timeout=10s \
    crd/certificates.cert-manager.io \
    crd/clusterissuers.cert-manager.io
  kubectl -n cert-manager rollout status deployment/cert-manager --timeout=300s
  kubectl -n cert-manager rollout status deployment/cert-manager-webhook --timeout=300s
  kubectl -n cert-manager rollout status deployment/cert-manager-cainjector --timeout=300s

  log "Keycloak Operator 준비 대기"
  retry 30 2 kubectl wait --for=condition=Established --timeout=10s \
    crd/keycloaks.k8s.keycloak.org \
    crd/keycloakrealmimports.k8s.keycloak.org
  kubectl -n "$NAMESPACE" rollout status deployment/keycloak-operator --timeout=300s
}

install_helm_operators() {
  log "MinIO Operator 설치"
  ENV_NAME="$ENV_NAME" bash "$TASKS_DIR/minio-operator-install.sh"

  log "Vault Secrets Operator 설치"
  ENV_NAME="$ENV_NAME" bash "$TASKS_DIR/vso-install.sh"
}

wait_vault_running() {
  log "Vault 초기화 전 pod/vault-0 Running 대기"
  retry 3 10 kubectl -n "$NAMESPACE" wait \
    --for=jsonpath='{.status.phase}'=Running \
    pod/vault-0 \
    --timeout=120s
}

initialize_and_seed_vault() {
  log "Vault 초기화 / unseal / Kubernetes auth 구성"
  ENV_NAME="$ENV_NAME" bash "$TASKS_DIR/vault-init.sh"

  log "애플리케이션 Secret seed"
  ENV_NAME="$ENV_NAME" bash "$TASKS_DIR/vault-seed-apps.sh"
}

reset_stale_secrets_if_requested() {
  [[ "${RESET_STALE_SECRETS:-}" == "yes" ]] || return 0

  if [[ "$ENV_NAME" == "prod" && "${ALLOW_PROD_SECRET_RESET:-}" != "yes" ]]; then
    die "prod Secret 재생성은 ALLOW_PROD_SECRET_RESET=yes 가 추가로 필요합니다."
  fi

  warn "RESET_STALE_SECRETS=yes: VSO destination Secret 재생성"
  local secret_name
  for secret_name in "${VSO_MANAGED_SECRETS[@]}"; do
    kubectl -n "$NAMESPACE" delete secret "$secret_name" --ignore-not-found
  done
}

pre_data_secrets_ready() {
  local secret_name
  for secret_name in "${PRE_DATA_SECRETS[@]}"; do
    kubectl -n "$NAMESPACE" get secret "$secret_name" >/dev/null 2>&1 || return 1
  done
}

wait_secrets_ready() {
  log "30-data 선행 VSO destination Secret 생성 대기"
  retry 90 2 pre_data_secrets_ready
}

wait_data_ready() {
  log "PostgreSQL 준비 대기"
  kubectl -n "$NAMESPACE" rollout status statefulset/identity-postgres --timeout=600s

  log "MinIO Tenant 준비 대기"
  retry 24 5 kubectl -n "$NAMESPACE" wait --for=condition=Ready \
    pod -l v1.min.io/tenant=minio --timeout=20s

  log "Keycloak 준비 대기"
  retry 24 5 kubectl -n "$NAMESPACE" wait --for=condition=Ready \
    pod -l app.kubernetes.io/instance=keycloak --timeout=20s
}

provision_registry() {
  log "docker-registry용 MinIO bucket / access key 구성"
  ENV_NAME="$ENV_NAME" bash "$TASKS_DIR/minio-provision-registry.sh"

  apply_entrypoint "35-registry" "$CLUSTER_ROOT/stages/35-registry"

  log "docker-registry MinIO credential Secret 생성 대기"
  retry 90 2 kubectl -n "$NAMESPACE" get secret docker-registry-minio
  log "docker-registry 준비 대기"
  kubectl -n "$NAMESPACE" rollout status deployment/docker-registry --timeout=300s
}

wait_operations_complete() {
  log "Flyway migration 완료 대기"
  kubectl -n "$NAMESPACE" wait --for=condition=Complete \
    job/auth-server-migrate-0-1-0 --timeout=1800s

  log "Keycloak realm import 완료 대기"
  kubectl -n "$NAMESPACE" wait --for=condition=Done \
    keycloakrealmimport/platform-realm-v1 --timeout=600s
}

wait_apps_ready() {
  kubectl -n "$NAMESPACE" rollout status deployment/auth-server --timeout=600s
  kubectl -n "$NAMESPACE" rollout status deployment/oauth2-proxy --timeout=300s
}

summary() {
  log "============================================"
  log "  $ENV_NAME staged bootstrap 완료"
  log "============================================"
  log "Vault init material: ${VAULT_KEYS_FILE:-$REPO_ROOT/vault-init-keys.json}"
  log "이 파일은 Git에서 제외되지만 평문입니다. 오프라인 보관소로 이동하세요."
  log "검증: kubectl -n $NAMESPACE get pods,jobs,vaultstaticsecrets"
}

main() {
  ENV_NAME="${1:-}"
  case "$ENV_NAME" in
    lab | staging | prod) ;;
    *) usage ;;
  esac

  CLUSTER_ROOT="$GITOPS_ROOT/clusters/$ENV_NAME/main"
  NAMESPACE_ENTRYPOINT="$CLUSTER_ROOT/namespaces"
  [[ -f "$CLUSTER_ROOT/all/kustomization.yaml" ]] \
    || die "클러스터 entrypoint가 없습니다: $CLUSTER_ROOT"

  require_cmd kubectl helm jq openssl mc curl
  require_kube_context "$ENV_NAME"
  precheck_namespaces

  log "Project-Infra staged bootstrap: env=$ENV_NAME context=$KUBE_CONTEXT_LOCKED"

  # Namespace first: a server-side dry-run cannot create a Namespace and
  # validate namespaced resources against it in the same request.
  apply_entrypoint "namespaces" "$NAMESPACE_ENTRYPOINT"
  apply_entrypoint "00-platform" "$CLUSTER_ROOT/stages/00-platform"
  wait_platform_ready
  install_helm_operators

  apply_entrypoint "10-vault" "$CLUSTER_ROOT/stages/10-vault"
  wait_vault_running
  initialize_and_seed_vault

  reset_stale_secrets_if_requested
  apply_entrypoint "20-secrets" "$CLUSTER_ROOT/stages/20-secrets"
  wait_secrets_ready

  apply_entrypoint "30-data" "$CLUSTER_ROOT/stages/30-data"
  wait_data_ready
  provision_registry

  apply_entrypoint "40-operations" "$CLUSTER_ROOT/stages/40-operations"
  wait_operations_complete

  apply_entrypoint "50-apps" "$CLUSTER_ROOT/stages/50-apps"
  wait_apps_ready
  summary
}

if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
  main "$@"
fi