#!/bin/bash
# 01-setupenv.sh — Enable APIs, create staging bucket with lifecycle, SA, billing budget
# Run in: local VS Code terminal OR Cloud Shell
# Source .env before running: source .env

set -euo pipefail

: "${PROJECT_ID:?Set PROJECT_ID in .env}"
: "${REGION:?Set REGION in .env}"
: "${BILLING_ACCOUNT_ID:?Set BILLING_ACCOUNT_ID in .env}"
: "${AGENT_SA:?Set AGENT_SA in .env}"

BUCKET_NAME="gs://${PROJECT_ID}-agent-staging"
BUDGET_NAME="OSVauco-Agent-Budget-500USD"

echo "=== 01: Environment Setup for ${PROJECT_ID} ==="

# 0. Auth check
bash "$(dirname "$0")/00-authcheck.sh"

# 1. Enable required APIs (idempotent)
echo "Enabling required APIs..."
gcloud services enable \
  aiplatform.googleapis.com \
  storage.googleapis.com \
  cloudbilling.googleapis.com \
  cloudresourcemanager.googleapis.com \
  iam.googleapis.com \
  run.googleapis.com \
  artifactregistry.googleapis.com \
  cloudbuild.googleapis.com \
  secretmanager.googleapis.com \
  monitoring.googleapis.com \
  logging.googleapis.com \
  cloudtrace.googleapis.com \
  --project="$PROJECT_ID" --quiet
echo "✓ APIs enabled."

# 2. Create staging bucket (idempotent)
if gcloud storage ls "$BUCKET_NAME" >/dev/null 2>&1; then
  echo "✓ Staging bucket $BUCKET_NAME already exists."
else
  gcloud storage buckets create "$BUCKET_NAME" \
    --location="$REGION" --project="$PROJECT_ID" --quiet
  echo "✓ Bucket created: $BUCKET_NAME"
fi

# 3. Apply lifecycle rule (auto-delete objects >7 days)
cat > /tmp/lifecycle.json << 'EOF'
{"rule":[{"action":{"type":"Delete"},"condition":{"age":7}}]}
EOF
gcloud storage buckets update "$BUCKET_NAME" --lifecycle-file=/tmp/lifecycle.json --quiet
echo "✓ Lifecycle rule applied (delete after 7 days)."

# 4. Service account (idempotent)
SA_NAME=$(echo "$AGENT_SA" | cut -d'@' -f1)
if ! gcloud iam service-accounts describe "$AGENT_SA" --project="$PROJECT_ID" >/dev/null 2>&1; then
  gcloud iam service-accounts create "$SA_NAME" \
    --display-name="OSVauco Agent Runner SA" --project="$PROJECT_ID" --quiet
  echo "✓ Service account created: $AGENT_SA"
fi

for ROLE in \
  roles/aiplatform.user \
  roles/storage.objectAdmin \
  roles/logging.logWriter \
  roles/cloudtrace.agent \
  roles/monitoring.metricWriter \
  roles/secretmanager.secretAccessor \
  roles/run.invoker; do
  gcloud projects add-iam-policy-binding "$PROJECT_ID" \
    --member="serviceAccount:${AGENT_SA}" --role="$ROLE" --quiet
done
echo "✓ IAM bindings configured."

# 5. Billing budget alert (idempotent check by display name)
EXISTING=$(gcloud billing budgets list \
  --billing-account="${BILLING_ACCOUNT_ID}" \
  --filter="displayName=${BUDGET_NAME}" \
  --format="value(name)" 2>/dev/null | head -1 || true)

if [[ -z "${EXISTING}" ]]; then
  gcloud billing budgets create \
    --billing-account="${BILLING_ACCOUNT_ID}" \
    --display-name="${BUDGET_NAME}" \
    --budget-amount=500USD \
    --threshold-rule=percent=0.5 \
    --threshold-rule=percent=0.8 \
    --threshold-rule=percent=1.0
  echo "✓ Budget alert created"
else
  echo "✓ Budget alert already exists"
fi

echo ""
echo "=== 01: Environment setup COMPLETE ==="