#!/bin/bash
# 05-cloudrun-deploy.sh — Deploy ADK agent to Cloud Run using `adk deploy cloud_run`
# Run in: local VS Code terminal OR Cloud Shell
# Requires: ADK installed (pip install google-adk), gcloud CLI
# Source .env before running: source .env

set -euo pipefail

: "${PROJECT_ID:?Set PROJECT_ID}"
: "${REGION:?Set REGION}"
: "${CLOUD_RUN_SERVICE:?Set CLOUD_RUN_SERVICE}"
: "${AGENT_SA:?Set AGENT_SA}"

APP_NAME="oavauco_root"
AGENT_PATH="agents/core-logic"

echo "=== 05: Cloud Run Deploy via ADK CLI ==="

bash "$(dirname "$0")/00-authcheck.sh"

gcloud services enable \
  run.googleapis.com \
  artifactregistry.googleapis.com \
  cloudbuild.googleapis.com \
  --project="${PROJECT_ID}" --quiet

# Grant compute SA permission to use Cloud Build
PROJECT_NUMBER=$(gcloud projects describe "${PROJECT_ID}" --format="value(projectNumber)")
COMPUTE_SA="${PROJECT_NUMBER}-compute@developer.gserviceaccount.com"

gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
  --member="serviceAccount:${COMPUTE_SA}" \
  --role="roles/cloudbuild.builds.builder" --quiet
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
  --member="serviceAccount:${COMPUTE_SA}" \
  --role="roles/secretmanager.secretAccessor" --quiet
echo "✓ IAM bindings for Cloud Build SA applied"

export GOOGLE_CLOUD_PROJECT="${PROJECT_ID}"
export GOOGLE_CLOUD_LOCATION="${REGION}"
export GOOGLE_GENAI_USE_VERTEXAI="True"

# Deploy via ADK CLI
# --with_ui includes the ADK dev UI (remove for API-only production deployments)
# --no-allow-unauthenticated requires an identity token to call the service
echo "Deploying ${CLOUD_RUN_SERVICE} to Cloud Run in ${REGION}..."
adk deploy cloud_run \
  --project="${PROJECT_ID}" \
  --region="${REGION}" \
  --service_name="${CLOUD_RUN_SERVICE}" \
  --app_name="${APP_NAME}" \
  "${AGENT_PATH}" \
  -- --no-allow-unauthenticated

echo ""
echo "=== 05: Cloud Run Deploy COMPLETE ==="
SERVICE_URL=$(gcloud run services describe "${CLOUD_RUN_SERVICE}" \
  --region="${REGION}" --project="${PROJECT_ID}" \
  --format="value(status.url)" 2>/dev/null || echo "(pending)")
echo "  Service URL: ${SERVICE_URL}"
echo ""
echo "  To call (authenticated):"
echo "    TOKEN=\$(gcloud auth print-identity-token)"
echo "    curl -H \"Authorization: Bearer \$TOKEN\" -H 'Content-Type: application/json' \\"
echo "         -d '{\"message\": \"Hello\"}' ${SERVICE_URL}/run"
echo ""
echo "  COST NOTE: Cloud Run scales to 0. No idle cost."
echo "  Delete with: gcloud run services delete ${CLOUD_RUN_SERVICE} --region=${REGION} --quiet"