#!/usr/bin/env bash

set -euo pipefail

# init_cloudnative_pg.sh
# Purpose:
# - Distribute administrator ed25519 key pair to CloudNative‑PG as a Kubernetes Secret for cert auth
# - Configure Kerberos (GSSAPI) using external Kerberos KDC
# - Patch CNPG cluster to enable TLS and GSSAPI where possible
#
# Usage:
#   ./init_cloudnative_pg.sh start|stop|status|restart
#   ./init_cloudnative_pg.sh initialize          # install CNPG, create cluster, configure secrets + Kerberos
#   ./init_cloudnative_pg.sh update|reload       # re-apply/patch
#
# Requirements:
# - init_openbao.sh has been run (OpenBao running in k8s)
# - $PROLE_HOME/env.sh or $HOME/.prole/env.sh defining PROLE_SERVICE
# - Optional: CNPG_MANIFEST_OVERRIDE to apply a recovery manifest instead of kustomize

# Initialize SCRIPT_DIR
SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)

# Load environment and config via prole_cfg.sh
# shellcheck disable=SC1090
source "$SCRIPT_DIR/prole_cfg.sh"

if [[ -z "${PROLE_SERVICE:-}" ]]; then
  echo "ERROR: PROLE_SERVICE is not defined. Provide PROLE_HOME/env.sh or ~/.prole/env.sh" >&2
  exit 1
fi

ACTION=${1:-}
CNPG_CLUSTER_NAME=${2:-${CNPG_CLUSTER_NAME:-prole-db}}
OPENBAO_NAME=${OPENBAO_NAME:-openbao}
REALM=${REALM:-PROLE.ORG}
DOMAIN=${DOMAIN:-prole.org}
KRB5_KDC=${KRB5_KDC:-}
KRB5_ADMIN=${KRB5_ADMIN:-}
CNPG_MANIFEST_OVERRIDE=${CNPG_MANIFEST_OVERRIDE:-}

# Support both PROLE_HOME/k8s and sibling k8s directory
if [[ -d "$SCRIPT_DIR/../k8s/prole" ]]; then
  CNPG_MANIFEST="$SCRIPT_DIR/../k8s/prole/prole-db.yaml"
elif [[ -n "${PROLE_HOME:-}" && -d "$PROLE_HOME/k8s/prole" ]]; then
  CNPG_MANIFEST="$PROLE_HOME/k8s/prole/prole-db.yaml"
else
  CNPG_MANIFEST="$SCRIPT_DIR/../k8s/prole/prole-db.yaml"
fi

SECRETS_DIR="$PROLE_SERVICE/secrets"
# Resolving CNPG admin keys. 
# We prefer names without algorithm suffixes to be more generic, matching install.py fallback strategy.
ADMIN_PRIV_ED25519="$SECRETS_DIR/admin_ed25519.key"
ADMIN_PUB_ED25519="$SECRETS_DIR/admin_ed25519.pub"
ADMIN_PRIV_GENERIC="$SECRETS_DIR/admin.key"
ADMIN_PUB_GENERIC="$SECRETS_DIR/admin.pub"
OPENBAO_TOKEN_FILE="$SECRETS_DIR/openbao-root-token"

ensure_tools() {
  for t in kubectl curl openssl base64 jq; do
    command -v "$t" >/dev/null || { echo "Missing required tool: $t" >&2; exit 1; }
  done
}

ensure_namespace() {
  if [[ -z "${NAMESPACE:-}" ]]; then
    echo "ERROR: NAMESPACE is empty. Check env.sh or conf/prole.cfg." >&2
    exit 1
  fi
  if ! kubectl get namespace "$NAMESPACE" >/dev/null 2>&1; then
    echo "Creating namespace '$NAMESPACE' ..."
    kubectl create namespace "$NAMESPACE" >/dev/null 2>&1 || true
  fi
}

ensure_cnpg_operator() {
  if kubectl get deployment -n cnpg-system cnpg-controller-manager >/dev/null 2>&1; then
    return 0
  fi

  local latest_version minor_version yaml_url
  latest_version=$(get_latest_cnpg_version)
  minor_version=$(echo "$latest_version" | cut -d. -f1,2)
  yaml_url="https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-${minor_version}/releases/cnpg-${latest_version}.yaml"

  echo "Installing CloudNative-PG operator version ${latest_version} ..."
  kubectl apply --server-side -f "$yaml_url"

  if kubectl get deployment -n cnpg-system cnpg-controller-manager >/dev/null 2>&1; then
    kubectl -n cnpg-system rollout status deploy/cnpg-controller-manager --timeout=120s || true
  fi
}

ensure_prole_stack_resources() {
  echo "Applying CloudNative-PG cluster and related resources ..."
  if [[ -n "$CNPG_MANIFEST_OVERRIDE" ]]; then
    if [[ ! -f "$CNPG_MANIFEST_OVERRIDE" ]]; then
      echo "ERROR: CNPG_MANIFEST_OVERRIDE not found: $CNPG_MANIFEST_OVERRIDE" >&2
      return 1
    fi
    local dir file
    dir="$SCRIPT_DIR/../k8s/prole"
    for file in "$dir"/*.yaml; do
      case "$(basename "$file")" in
        prole-db.yaml|kustomization.yaml)
          continue
          ;;
      esac
      kubectl apply -n "$NAMESPACE" -f "$file"
    done
    kubectl apply -n "$NAMESPACE" -f "$CNPG_MANIFEST_OVERRIDE"
  else
    local dir file
    dir="$SCRIPT_DIR/../k8s/prole"
    for file in "$dir"/*.yaml; do
      case "$(basename "$file")" in
        kustomization.yaml)
          continue
          ;;
      esac
      kubectl apply -n "$NAMESPACE" -f "$file"
    done
  fi

  # Ensure prole-index-html exists for prole deployment readiness probe
  if ! kubectl get configmap prole-index-html -n "$NAMESPACE" >/dev/null 2>&1; then
    echo "Creating prole-index-html configmap..."
    printf "<html><body><h1>Prole</h1></body></html>" > /tmp/index.html
    kubectl create configmap prole-index-html --from-file=/tmp/index.html -n "$NAMESPACE"
    rm /tmp/index.html
  fi

  # Ensure prole-nginx-tls exists (self-signed for dev)
  if ! kubectl get secret prole-nginx-tls -n "$NAMESPACE" >/dev/null 2>&1; then
    echo "Generating self-signed prole-nginx-tls for development..."
    openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
      -keyout /tmp/nginx-tls.key -out /tmp/nginx-tls.crt \
      -subj "/CN=prole.org" >/dev/null 2>&1
    kubectl create secret tls prole-nginx-tls --key /tmp/nginx-tls.key --cert /tmp/nginx-tls.crt -n "$NAMESPACE"
    rm /tmp/nginx-tls.key /tmp/nginx-tls.crt
  fi
}

wait_for_cnpg_pods() {
  local timeout=${1:-300}
  local start_time
  start_time=$(date +%s)

  while true; do
    if kubectl -n "$NAMESPACE" get cluster "$CNPG_CLUSTER_NAME" >/dev/null 2>&1; then
      if kubectl -n "$NAMESPACE" get pods -l "cnpg.io/cluster=$CNPG_CLUSTER_NAME" --no-headers 2>/dev/null | grep -q .; then
        if kubectl -n "$NAMESPACE" wait --for=condition=Ready pod -l "cnpg.io/cluster=$CNPG_CLUSTER_NAME" --timeout=60s >/dev/null 2>&1; then
          return 0
        fi
      fi
    fi

    if (( $(date +%s) - start_time > timeout )); then
      echo "ERROR: Timed out waiting for CNPG pods for cluster '$CNPG_CLUSTER_NAME' in namespace '$NAMESPACE'." >&2
      return 1
    fi
    echo "Waiting for CNPG pods for cluster '$CNPG_CLUSTER_NAME'..."
    sleep 3
  done
}

# Resolve OpenBao URL: prefer explicit env, then localhost port-forward, then cluster DNS
bao_service_url() {
  if [[ -n "${PROLE_OPENBAO_URL:-}" ]]; then
    echo "$PROLE_OPENBAO_URL"
    return 0
  fi
  # Prefer standard local port-forward managed by etc/init_port_forwards.sh
  if curl -sS "http://127.0.0.1:18200/v1/sys/health" >/dev/null 2>&1; then
    echo "http://127.0.0.1:18200"
    return 0
  fi
  echo "http://$OPENBAO_NAME.$NAMESPACE.svc.cluster.local:8200"
}

fetch_admin_keys_and_db_pass_from_bao_or_local() {
  local token url
  if [[ -f "$OPENBAO_TOKEN_FILE" ]]; then
    token=$(cat "$OPENBAO_TOKEN_FILE")
  else
    token=""
  fi
  url=$(bao_service_url)
  if [[ -n "$token" ]]; then
    echo "Attempting to read admin key pair from OpenBao kv/prole/admin ..."
    if curl -sS -H "X-Vault-Token: $token" "$url/v1/kv/data/prole/admin" | jq -e '.data.data' >/dev/null 2>&1; then
      local priv_b64 pub_b64
      priv_b64=$(curl -sS -H "X-Vault-Token: $token" "$url/v1/kv/data/prole/admin" | jq -r '.data.data.admin_private_key_b64')
      pub_b64=$(curl -sS -H "X-Vault-Token: $token" "$url/v1/kv/data/prole/admin" | jq -r '.data.data.admin_public_key_b64')
      # Use a temporary file to determine where to save based on existing legacy or generic preference
      local target_priv="$ADMIN_PRIV_GENERIC"
      local target_pub="$ADMIN_PUB_GENERIC"
      
      # If legacy keys exist, we might want to overwrite them too for compatibility
      printf "%s" "$priv_b64" | base64 -d >"$target_priv"
      printf "%s" "$pub_b64" | base64 -d >"$target_pub"
      chmod 0600 "$target_priv"
      
      # Mirror to legacy path if it was expected by other scripts
      cp "$target_priv" "$ADMIN_PRIV_ED25519" 2>/dev/null || true
      cp "$target_pub" "$ADMIN_PUB_ED25519" 2>/dev/null || true
    fi

    echo "Attempting to read database password from OpenBao kv/prole/db ..."
    if curl -sS -H "X-Vault-Token: $token" "$url/v1/kv/data/prole/db" | jq -e '.data.data' >/dev/null 2>&1; then
      local db_pass
      db_pass=$(curl -sS -H "X-Vault-Token: $token" "$url/v1/kv/data/prole/db" | jq -r '.data.data.password')
      if [[ -n "$db_pass" ]]; then
        echo "Updating database user secret 'prole-db-user' from OpenBao ..."
        kubectl create secret generic prole-db-user -n "$NAMESPACE" \
          --from-literal=username=prole \
          --from-literal=password="$db_pass" \
          --dry-run=client -o yaml | kubectl apply -f -

        echo "Updating database superuser secret 'prole-db-superuser' from OpenBao ..."
        kubectl create secret generic prole-db-superuser -n "$NAMESPACE" \
          --from-literal=username=postgres \
          --from-literal=password="$db_pass" \
          --dry-run=client -o yaml | kubectl apply -f -
      fi
    fi
  fi

  if [[ -f "$ADMIN_PRIV_GENERIC" && -f "$ADMIN_PUB_GENERIC" ]]; then
    echo "Using local admin key pair at $SECRETS_DIR"
    return 0
  fi
  if [[ -f "$ADMIN_PRIV_ED25519" && -f "$ADMIN_PUB_ED25519" ]]; then
    echo "Using local legacy admin key pair at $SECRETS_DIR"
    # Link or copy to generic for consistent use below
    cp "$ADMIN_PRIV_ED25519" "$ADMIN_PRIV_GENERIC"
    cp "$ADMIN_PUB_ED25519" "$ADMIN_PUB_GENERIC"
    return 0
  fi
  echo "ERROR: Could not obtain admin key pair from OpenBao and no local files found." >&2
  exit 1
}

apply_cnpg_admin_secret() {
  echo "Creating/updating Secret cnpg-admin-key ..."
  kubectl create secret generic cnpg-admin-key -n "$NAMESPACE" \
    --from-file=admin.key="$ADMIN_PRIV_GENERIC" \
    --from-file=admin.pub="$ADMIN_PUB_GENERIC" \
    --dry-run=client -o yaml | kubectl apply -f -
}

generate_tls_if_missing() {
  local ca_secret_name="${CNPG_CLUSTER_NAME}-ca"
  if kubectl -n "$NAMESPACE" get secret "$ca_secret_name" >/dev/null 2>&1; then
    echo "CA secret $ca_secret_name already exists; skipping generation."
    return 0
  fi
  echo "Generating self-signed CA (RSA 4096) for CNPG ..."
  local TMPD
  TMPD=$(mktemp -d)
  openssl genrsa -out "$TMPD/ca.key" 4096
  openssl req -x509 -new -key "$TMPD/ca.key" -out "$TMPD/ca.crt" -days 3650 -subj "/CN=Prole CNPG CA"
  kubectl -n "$NAMESPACE" create secret generic "$ca_secret_name" \
    --from-file=ca.crt="$TMPD/ca.crt" \
    --from-file=ca.key="$TMPD/ca.key" \
    --dry-run=client -o yaml | kubectl apply -f -
  rm -rf "$TMPD"
}

# Resolve latest CNPG version from GitHub if possible, fallback to a sensible default.
get_latest_cnpg_version() {
  local version
  version=$(curl -s "https://api.github.com/repos/cloudnative-pg/cloudnative-pg/releases/latest" | jq -r '.tag_name' | sed 's/^v//' || echo "")
  if [[ -z "$version" || "$version" == "null" ]]; then
    echo "1.27.0"
  else
    echo "$version"
  fi
}

initialize() {
  ensure_tools
  ensure_namespace
  ensure_cnpg_operator
  echo "Using namespace: $NAMESPACE"
  
  # Ensure port-forward is running for OpenBao (dependency)
  echo "Ensuring port-forward for OpenBao is active ..."
  "$SCRIPT_DIR/init_port_forwards.sh" restart openbao &
  sleep 2

  fetch_admin_keys_and_db_pass_from_bao_or_local
  apply_cnpg_admin_secret

  ensure_prole_stack_resources

  if ! wait_for_cnpg_pods 300; then
    return 1
  fi

  if [[ -x "$SCRIPT_DIR/init_kerberos.sh" ]]; then
    echo "Configuring Kerberos for CNPG pods ..."
    if ! "$SCRIPT_DIR/init_kerberos.sh" initialize; then
      echo "WARN: Kerberos initialization did not complete successfully."
    fi
  else
    echo "WARN: init_kerberos.sh not found; skipping Kerberos configuration."
  fi

  # Ensure port-forward is running for Postgres (local access)
  echo "Ensuring port-forward for Postgres is active ..."
  "$SCRIPT_DIR/init_port_forwards.sh" restart postgres &
  sleep 2

  echo "Initialization complete for CNPG + Kerberos + cert artifacts."
}

update_reload() {
  initialize
}

case "$ACTION" in
  recreate)
    ensure_tools
    "$0" delete "$CNPG_CLUSTER_NAME"
    "$0" create "$CNPG_CLUSTER_NAME"
    ;;
  create)
    ensure_tools
    ensure_namespace
    initialize
    ;;
  delete)
    ensure_tools
    echo "Deleting all resources for '$CNPG_CLUSTER_NAME' ..."
    kubectl delete -n "$NAMESPACE" -k "$SCRIPT_DIR/../k8s/prole" --ignore-not-found
    ;;
  start)
    ensure_tools
    ensure_namespace
    ensure_cnpg_operator
    if [[ ! -f "$CNPG_MANIFEST" ]]; then
      echo "ERROR: CNPG manifest not found at $CNPG_MANIFEST" >&2
      exit 1
    fi
    echo "Starting CloudNative-PG cluster from $CNPG_MANIFEST in namespace $NAMESPACE..."
    kubectl apply -n "$NAMESPACE" -f "$CNPG_MANIFEST"
    ;;
  stop)
    ensure_tools
    if [[ ! -f "$CNPG_MANIFEST" ]]; then
      echo "ERROR: CNPG manifest not found at $CNPG_MANIFEST" >&2
      exit 1
    fi
    echo "Stopping CloudNative-PG cluster using $CNPG_MANIFEST ..."
    kubectl delete -f "$CNPG_MANIFEST" --ignore-not-found
    ;;
  status)
    ensure_tools
    echo "--- CloudNative-PG Cluster Status ($CNPG_CLUSTER_NAME) ---"
    if kubectl -n "$NAMESPACE" get cluster "$CNPG_CLUSTER_NAME" >/dev/null 2>&1; then
      kubectl -n "$NAMESPACE" get cluster "$CNPG_CLUSTER_NAME"
      echo ""
      echo "CNPG Plugin Status:"
      if kubectl cnpg version >/dev/null 2>&1; then
        kubectl cnpg status "$CNPG_CLUSTER_NAME" -n "$NAMESPACE"
      else
        echo "Note: 'kubectl cnpg' plugin not found; skipping detailed status."
      fi
    else
      echo "Cluster '$CNPG_CLUSTER_NAME' not found in namespace '$NAMESPACE'."
    fi
    ;;
  restart)
    ensure_tools
    "$0" stop
    "$0" start
    ;;
  initialize)
    if ! initialize; then
      exit 1
    fi
    ;;
  update|reload)
    if ! update_reload; then
      exit 1
    fi
    ;;
  *)
    echo "Usage: $0 {create|delete|recreate|start|stop|status|restart|initialize|update|reload} [dbname]" >&2
    exit 2
    ;;
esac