#!/usr/bin/env bash
# ── GCP Bootstrap — run once after terraform apply ────────────────────────────
# Sets up secrets and credentials that Terraform can't create automatically.
#
# Prerequisites:
#   - GOOGLE_APPLICATION_CREDENTIALS or `gcloud auth application-default login`
#   - GCP project access
#   - Vault running (for reading existing secrets)
#   - terraform apply has run successfully (creates SA, secrets)
#
# Usage:
#   cd servers/gcp
#   terraform apply
#   bash bootstrap.sh

set -euo pipefail

PROJECT="neuron-785695"
VAULT_ADDR="${VAULT_ADDR:-https://vault.neuralplatform.ai}"

echo "==> Bootstrapping GCP secrets and CI credentials"

# ── 1. Populate Stripe secrets in GCP Secret Manager ─────────────────────────
echo "--> Pulling Stripe secrets from Vault..."
MARKETING_SECRETS=$(curl -sf \
  -H "X-Vault-Token: ${VAULT_TOKEN}" \
  "${VAULT_ADDR}/v1/secret/data/neuron-technologies/marketing")

populate_secret() {
  local secret_id="$1"
  local vault_key="$2"
  local value
  value=$(echo "${MARKETING_SECRETS}" | python3 -c "
import json,sys; d=json.load(sys.stdin)['data']['data']; print(d.get('${vault_key}',''))
")
  if [ -z "${value}" ]; then
    echo "  WARN: vault key '${vault_key}' not found — skipping ${secret_id}"
    return
  fi
  # Check if secret already has a version
  if gcloud secrets versions list "${secret_id}" --project="${PROJECT}" \
       --format="value(name)" 2>/dev/null | grep -q .; then
    echo "  SKIP: ${secret_id} already has a version"
  else
    echo "${value}" | gcloud secrets versions add "${secret_id}" \
      --project="${PROJECT}" \
      --data-file=-
    echo "  OK: ${secret_id}"
  fi
}

populate_secret "stripe-secret-key"        "stripe_secret_key"
populate_secret "stripe-webhook-secret"    "stripe_webhook_secret"
populate_secret "stripe-price-professional" "stripe_price_professional"
populate_secret "stripe-price-founding"    "stripe_price_founding"

# ── 2. License admin token ────────────────────────────────────────────────────
echo "--> Populating license-admin-token..."
LICENSE_TOKEN=$(curl -sf \
  -H "X-Vault-Token: ${VAULT_TOKEN}" \
  "${VAULT_ADDR}/v1/secret/data/neuron-technologies/marketing" \
  | python3 -c "import json,sys; print(json.load(sys.stdin)['data']['data'].get('license_admin_token',''))")
if [ -n "${LICENSE_TOKEN}" ]; then
  echo "${LICENSE_TOKEN}" | gcloud secrets versions add "license-admin-token" \
    --project="${PROJECT}" --data-file=- 2>/dev/null || echo "  SKIP: already exists"
  echo "  OK: license-admin-token"
fi

# ── 3. Create CI service account JSON key ────────────────────────────────────
CI_SA_EMAIL=$(terraform output -raw ci_pusher_email)
echo "--> Creating CI SA key for: ${CI_SA_EMAIL}"
KEY_FILE="/tmp/neuron-ci-pusher.json"
gcloud iam service-accounts keys create "${KEY_FILE}" \
  --iam-account="${CI_SA_EMAIL}" \
  --project="${PROJECT}"
echo "  SA key written to: ${KEY_FILE}"
echo ""
echo "  !! Add this as a Gitea secret GCP_SA_KEY in the neuron-technologies/neuron repo:"
echo "     tea secret set --repo neuron-technologies/neuron GCP_SA_KEY < ${KEY_FILE}"
echo "  Then delete the key file:"
echo "     rm ${KEY_FILE}"
echo ""

# ── 4. Summary ────────────────────────────────────────────────────────────────
echo "==> Bootstrap complete"
echo ""
echo "Next steps:"
echo "  1. Set Gitea secret: tea secret set --repo neuron-technologies/neuron GCP_SA_KEY < /tmp/neuron-ci-pusher.json"
echo "  2. Delete key file: rm /tmp/neuron-ci-pusher.json"
echo "  3. Point DNS at: $(terraform output -raw prod_lb_ip)"
echo "     A records (proxied=true in Cloudflare):"
echo "       neurontechnologies.ai → prod_lb_ip"
echo "       www.neurontechnologies.ai → prod_lb_ip"
echo "       api.neurontechnologies.ai → prod_lb_ip"
echo "       accounts.neurontechnologies.ai → prod_lb_ip"
echo "  4. Run a marketing CI build on main to push first image to GCP AR"
echo "  5. Check SSL cert provisioning: gcloud compute ssl-certificates list --project=${PROJECT}"