#!/usr/bin/env bash
# 03-teardown.sh — Safely remove all deployed resources
# WARNING: Destructive. Requires explicit confirmation.
# Source .env before running: source .env
set -euo pipefail

: "${PROJECT_ID:?Set PROJECT_ID}"
: "${REGION:?Set REGION}"
: "${CLOUD_RUN_SERVICE:?Set CLOUD_RUN_SERVICE}"
: "${ARTIFACT_REPO:?Set ARTIFACT_REPO}"
: "${AGENT_SA:?Set AGENT_SA}"

echo "=== 03: TEARDOWN for project ${PROJECT_ID} ==="
echo ""
echo "WARNING: This will delete Cloud Run services, Artifact Registry images,"
echo "         and Service Account IAM bindings."
echo "         GCS buckets and RAG corpora will NOT be deleted (to prevent data loss)."
echo ""
read -rp "Type 'DELETE' to confirm teardown: " CONFIRM
if [[ "${CONFIRM}" != "DELETE" ]]; then
  echo "Teardown cancelled."
  exit 0
fi

bash "$(dirname "$0")/00-authcheck.sh"

# 1. Delete Cloud Run service
if gcloud run services describe "${CLOUD_RUN_SERVICE}" \
    --region="${REGION}" &>/dev/null; then
  gcloud run services delete "${CLOUD_RUN_SERVICE}" \
    --region="${REGION}" --quiet
  echo "✓ Deleted Cloud Run service: ${CLOUD_RUN_SERVICE}"
fi

# 2. Delete Agent Runtime instances (if any)
AGENTS=$(gcloud ai agent-engines list \
  --project="${PROJECT_ID}" --region="${REGION}" \
  --format="value(name)" 2>/dev/null || echo "")
if [ -n "$AGENTS" ]; then
  while IFS= read -r AGENT_NAME; do
    gcloud ai agent-engines delete "$AGENT_NAME" \
      --project="${PROJECT_ID}" --region="${REGION}" --quiet
    echo "✓ Deleted agent runtime: $AGENT_NAME"
  done <<< "$AGENTS"
fi

# 3. Delete container images from Artifact Registry
gcloud artifacts docker images delete \
  "${REGION}-docker.pkg.dev/${PROJECT_ID}/${ARTIFACT_REPO}/${CLOUD_RUN_SERVICE}" \
  --delete-tags --quiet 2>/dev/null || echo "  (no images found)"
echo "✓ Artifact Registry images cleaned"

# 4. Remove IAM bindings
ROLES=(
  roles/aiplatform.user
  roles/run.invoker
  roles/secretmanager.secretAccessor
  roles/cloudtrace.agent
  roles/logging.logWriter
  roles/monitoring.metricWriter
  roles/storage.objectAdmin
)
for ROLE in "${ROLES[@]}"; do
  gcloud projects remove-iam-policy-binding "${PROJECT_ID}" \
    --member="serviceAccount:${AGENT_SA}" \
    --role="${ROLE}" --quiet 2>/dev/null || true
done
echo "✓ IAM bindings removed"

echo ""
echo "=== 03: Teardown COMPLETE ==="
echo "NOTE: GCS buckets and RAG corpora were NOT deleted. Remove manually if needed."