#!/usr/bin/env bash
# 12-rag-integration.sh — Koble Vertex AI RAG corpus til Cloud Run-agenten
#
# Hva scriptet gjør:
#   1. Lagrer RAG_CORPUS_NAME som Secret Manager-secret ("RAG_CORPUS")
#   2. Gir Cloud Run service account tilgang til secret
#   3. Gir AGENT_SA roles/aiplatform.user (RAG retrieval)
#   4. Oppdaterer Cloud Run-tjenesten med RAG_CORPUS env-var via Secret Manager
#   5. Kjører smoke-test mot /run endepunktet
#
# Forutsetter at 07-rag-setup.sh er kjørt og .env inneholder:
#   RAG_CORPUS_NAME, RAG_REGION, CLOUD_RUN_SERVICE, AGENT_SA
#
# Idempotent — trygt å kjøre flere ganger
# Source .env før kjøring: source .env

set -euo pipefail

: "${PROJECT_ID:?Set PROJECT_ID}"
: "${REGION:?Set REGION}"
: "${RAG_CORPUS_NAME:?Set RAG_CORPUS_NAME (kjør 07-rag-setup.sh først)}"
: "${CLOUD_RUN_SERVICE:?Set CLOUD_RUN_SERVICE}"
: "${AGENT_SA:?Set AGENT_SA}"

echo "=== 12: RAG Integration — kobler corpus til Cloud Run ==="
echo "    Project        : ${PROJECT_ID}"
echo "    Region         : ${REGION}"
echo "    Cloud Run      : ${CLOUD_RUN_SERVICE}"
echo "    Corpus         : ${RAG_CORPUS_NAME}"
echo ""

bash "$(dirname "$0")/00-authcheck.sh"

# ── 1. Secret Manager: lagre RAG_CORPUS_NAME som secret "RAG_CORPUS" ──────────
SECRET_NAME="RAG_CORPUS"

if gcloud secrets describe "${SECRET_NAME}" \
  --project="${PROJECT_ID}" &>/dev/null; then
  echo "  Secret finnes — oppdaterer verdi..."
  echo -n "${RAG_CORPUS_NAME}" | \
    gcloud secrets versions add "${SECRET_NAME}" \
      --data-file=- \
      --project="${PROJECT_ID}"
else
  echo "  Oppretter secret '${SECRET_NAME}'..."
  echo -n "${RAG_CORPUS_NAME}" | \
    gcloud secrets create "${SECRET_NAME}" \
      --data-file=- \
      --replication-policy=automatic \
      --project="${PROJECT_ID}"
fi
echo "✓ Secret '${SECRET_NAME}' oppdatert"

# ── 2. IAM: gi AGENT_SA tilgang til secret ────────────────────────────────────
gcloud secrets add-iam-policy-binding "${SECRET_NAME}" \
  --member="serviceAccount:${AGENT_SA}" \
  --role="roles/secretmanager.secretAccessor" \
  --project="${PROJECT_ID}" \
  --quiet
echo "✓ IAM: ${AGENT_SA} kan lese secret '${SECRET_NAME}'"

# ── 3. IAM: gi AGENT_SA Vertex AI RAG-tilgang ─────────────────────────────────
# roles/aiplatform.user dekker både import og retrieval
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
  --member="serviceAccount:${AGENT_SA}" \
  --role="roles/aiplatform.user" \
  --quiet
echo "✓ IAM: ${AGENT_SA} har roles/aiplatform.user"

# ── 4. Cloud Run: inject RAG_CORPUS via Secret Manager ────────────────────────
# agent.py leser os.environ["RAG_CORPUS"] — secret monteres direkte som env-var
echo "  Oppdaterer Cloud Run-tjenesten med RAG_CORPUS secret..."
gcloud run services update "${CLOUD_RUN_SERVICE}" \
  --region="${REGION}" \
  --project="${PROJECT_ID}" \
  --update-secrets="RAG_CORPUS=${SECRET_NAME}:latest" \
  --quiet
echo "✓ Cloud Run: RAG_CORPUS montert fra Secret Manager"

# ── 5. Hent Cloud Run URL og verifiser RAG-svar ───────────────────────────────
SERVICE_URL=$(gcloud run services describe "${CLOUD_RUN_SERVICE}" \
  --region="${REGION}" \
  --project="${PROJECT_ID}" \
  --format='value(status.url)' 2>/dev/null || echo '')

if [[ -z "${SERVICE_URL}" ]]; then
  echo "  ADVARSEL: Kunne ikke hente Cloud Run URL — hopper over smoke-test"
else
  echo "  Cloud Run URL: ${SERVICE_URL}"
  echo "  Kjører RAG smoke-test mot /run..."
  TOKEN=$(gcloud auth print-identity-token 2>/dev/null || gcloud auth print-access-token)

  HTTP_STATUS=$(curl -s -o /tmp/rag_smoke.json -w "%{http_code}" \
    -X POST "${SERVICE_URL}/run" \
    -H "Authorization: Bearer ${TOKEN}" \
    -H "Content-Type: application/json" \
    -d '{"message": "Hva er OSVauco MASTERPLAN?"}' \
    --max-time 30 || echo '000')

  if [[ "${HTTP_STATUS}" == "200" ]]; then
    echo "✓ Smoke-test OK (HTTP 200)"
    python3 -c "
import json
with open('/tmp/rag_smoke.json') as f:
    d = json.load(f)
resp = d.get('response') or d.get('output') or d.get('text') or str(d)
print('  Svar (truncated):', str(resp)[:300])
" 2>/dev/null || cat /tmp/rag_smoke.json | head -5
  else
    echo "  ADVARSEL: Smoke-test returnerte HTTP ${HTTP_STATUS}"
    cat /tmp/rag_smoke.json 2>/dev/null || true
    echo ""
    echo "  Tips: sjekk Cloud Run logs for detaljer:"
    echo "    gcloud run services logs read ${CLOUD_RUN_SERVICE} --region=${REGION} --limit=20"
  fi
fi

echo ""
echo "=== 12: RAG Integration COMPLETE ==="
echo "    Corpus   : ${RAG_CORPUS_NAME}"
echo "    Secret   : ${SECRET_NAME} (Secret Manager)"
echo "    Agent    : ${CLOUD_RUN_SERVICE} @ ${SERVICE_URL:-ukjent}"
echo ""
echo "    Verifiser manuelt:"
echo "      RAG corpus  : https://console.cloud.google.com/vertex-ai/rag?project=${PROJECT_ID}"
echo "      Cloud Run   : https://console.cloud.google.com/run/detail/${REGION}/${CLOUD_RUN_SERVICE}/logs?project=${PROJECT_ID}"
echo ""