#!/bin/bash
# bootstrap.sh — OSVauco VM bootstrap
# Kjøres på ny VM eller etter serverbytte
# Bruk: source .env && bash scripts/bootstrap.sh

set -euo pipefail

PROJECT_ID="${PROJECT_ID:-propane-will-491900-m5}"
REGION="${REGION:-us-central1}"
ARTIFACT_REPO="${ARTIFACT_REPO:-osvauco-repo}"
CLOUD_RUN_SERVICE="${CLOUD_RUN_SERVICE:-osvauco-agent}"
CLOUD_RUN_URL="https://osvauco-agent-357036551735.us-central1.run.app"

echo ""
echo "╔══════════════════════════════════════════════════╗"
echo "║     OSVauco VM Bootstrap                        ║"
echo "║     Prosjekt: $PROJECT_ID     ║"
echo "╚══════════════════════════════════════════════════╝"
echo ""

# ── Steg 1: Auth-sjekk ─────────────────────────────────────
echo "[1/4] Auth-sjekk..."
bash infrastructure/00-authcheck.sh

# ── Steg 2: Sjekk at osvauco-base finnes i Artifact Registry ─
echo ""
echo "[2/4] Sjekker base Docker-image..."

BASE_IMAGE="${REGION}-docker.pkg.dev/${PROJECT_ID}/${ARTIFACT_REPO}/osvauco-base"

if gcloud artifacts docker images describe "${BASE_IMAGE}:latest" \
     --project="$PROJECT_ID" >/dev/null 2>&1; then
  echo "  ✅ osvauco-base:latest finnes — hopper over bygg"
else
  echo "  ⚠️  osvauco-base:latest mangler — bygger nå (~5-10 min)..."
  gcloud builds submit \
    --config=cloudbuild.base.yaml \
    --project="$PROJECT_ID" \
    .
  echo "  ✅ osvauco-base bygget og pushet"
fi

# ── Steg 3: Sjekk IAM-bindinger for CI/CD ──────────────────
echo ""
echo "[3/4] Sjekker IAM-bindinger for CI/CD..."

PROJECT_NUMBER=$(gcloud projects describe "$PROJECT_ID" --format="value(projectNumber)")
CB_SA="${PROJECT_NUMBER}@cloudbuild.gserviceaccount.com"
AGENT_SA="osvauco-agent-sa@${PROJECT_ID}.iam.gserviceaccount.com"

# Cloud Build SA → iam.serviceAccountUser på agent-SA
gcloud iam service-accounts add-iam-policy-binding "$AGENT_SA" \
  --member="serviceAccount:${CB_SA}" \
  --role="roles/iam.serviceAccountUser" \
  --project="$PROJECT_ID" \
  --quiet 2>/dev/null && echo "  ✅ Cloud Build SA har actAs på agent-SA" || echo "  ℹ️  Cloud Build SA binding allerede på plass"

# Agent SA → iam.serviceAccountUser på seg selv
gcloud iam service-accounts add-iam-policy-binding "$AGENT_SA" \
  --member="serviceAccount:${AGENT_SA}" \
  --role="roles/iam.serviceAccountUser" \
  --project="$PROJECT_ID" \
  --quiet 2>/dev/null && echo "  ✅ Agent SA har actAs på seg selv" || echo "  ℹ️  Self-binding allerede på plass"

# ── Steg 4: Test at Cloud Run-agenten svarer ───────────────
echo ""
echo "[4/4] Tester Cloud Run-agenten..."

TOKEN=$(gcloud auth print-identity-token 2>/dev/null || echo "")

if [[ -z "$TOKEN" ]]; then
  echo "  ⚠️  Kan ikke hente identity token — er du logget inn med gcloud auth login?"
else
  HTTP_CODE=$(curl -s -o /tmp/osvauco-test.json -w "%{http_code}" \
    -X POST \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d '{"user_id":"bootstrap","session_id":"boot-1","message":"Hei"}' \
    "${CLOUD_RUN_URL}/run")

  if [[ "$HTTP_CODE" == "200" ]]; then
    echo "  ✅ Agent svarer (HTTP 200)"
    cat /tmp/osvauco-test.json | python3 -m json.tool 2>/dev/null | head -5
  else
    echo "  ⚠️  Agent svarte HTTP $HTTP_CODE"
    cat /tmp/osvauco-test.json
    echo ""
    echo "  Vanlige årsaker:"
    echo "  - gemini-2.0-flash: kjør 'gcloud run services update ...' med ORCHESTRATOR_MODEL=gemini-2.0-flash-001"
    echo "  - 403: ny revisjon ikke deployet ennå — vent 2 min og prøv igjen"
  fi
fi

echo ""
echo "╔══════════════════════════════════════════════════╗"
echo "║  Bootstrap ferdig!                              ║"
echo "║  Husk: bash infrastructure/03-teardown.sh       ║"
echo "║  ...hver kveld for å unngå 24/7-fakturering     ║"
echo "╚══════════════════════════════════════════════════╝"
echo ""