#!/usr/bin/env bash
# =============================================================================
# OPAX.SH — Authoritative OSVauco OPAX Environment Bootstrapper
#
# Idempotent script to set up the OPAX operator environment.
# Can be sourced multiple times without side-effects.
#
# Usage: source ~/OSVauco/scripts/opax.sh
# Alias: opax
# =============================================================================

# --- General Setup ---
# Exit on error, unset variable, or pipe failure.
# set -euo pipefail  # REMOVED: kills shell when sourced

# --- Pre-computation and Environment ---
OSVAUCO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
export GOOGLE_CLOUD_PROJECT="propane-will-491900-m5"
export GOOGLE_CLOUD_LOCATION="us-central1"
export GEMINI_MODEL="gemini-2.5-pro"

# --- UI Colors and Icons ---
# Use tput for wider compatibility, with fallbacks.
GREEN="$(tput setaf 2 || echo -e '\033[0;32m')"
RED="$(tput setaf 1 || echo -e '\033[0;31m')"
YELLOW="$(tput setaf 3 || echo -e '\033[1;33m')"
CYAN="$(tput setaf 6 || echo -e '\033[0;36m')"
WHITE="$(tput setaf 7 || echo -e '\033[1;37m')"
DIM="$(tput dim || echo -e '\033[2m')"
BOLD="$(tput bold || echo -e '\033[1m')"
NC="$(tput sgr0 || echo -e '\033[0m')" # No Color

# Checkmarks
OK="✅"
FAIL="❌"

# Internal state to prevent re-printing banner on multiple sources
if [[ -z "${OPAX_LOADED-}" ]]; then
    # --- Banner Display ---
    clear
    printf "${CYAN}"
    echo "   ___  _____      _   _  ___  _   _  ___  _____  "
    echo "  / _ \|  ___|    | | | |/ _ \| | | |/ __||  _  | "
    echo " | | | | |___     | | | / /_\ \ | | | |   | | | | "
    echo " | | | |___  |    | | | |  _  | | | | |   | | | | "
    echo " | |_| |___| |    \ \_/ / | | | |_| | |__ \ \_/ / "
    echo "  \___/\____/      \___/\_| |_/\___/ \___| \___/  "
    printf "${NC}"
    printf "${DIM}  -------------------------------------------------${NC}
"
    printf "  ${CYAN}OPAX${NC} ${DIM}Operator Platform  //  ${GOOGLE_CLOUD_PROJECT}${NC}
"
    printf "${DIM}  -------------------------------------------------${NC}

"

    # --- Health & Auth Checks ---
    printf "${BOLD}${WHITE}  Preflight Checks...${NC}
"

    # Helper function for checks
    run_check() {
        local description="$1"
        local command_to_run="$2"
        local error_message="$3"
        local is_critical="${4:-false}" # Default to not critical

        printf "  %-35s" "$description"
        if eval "$command_to_run" &>/dev/null; then
            printf "${GREEN}${OK}${NC}
"
        else
            printf "${RED}${FAIL}${NC}
"
            if [[ "$is_critical" == "true" ]]; then
                printf "
  ${RED}${BOLD}CRITICAL FAILURE:${NC} ${error_message}
"
                printf "  ${YELLOW}Aborting OPAX startup.${NC}

"
                # Clean up and exit the subshell this script is running in
                return 1
            else
                printf "    ${YELLOW}Warning:${NC} ${error_message}
"
            fi
        fi
    }

    # 1. Critical: gcloud authentication
    run_check "gcloud user authenticated" 
              "gcloud auth list --filter=status:ACTIVE --format='value(account)' | grep -q .@" 
              "Not logged into gcloud. Run 'gcloud auth login'." 
              true

    # 2. Critical: Application Default Credentials (ADC)
    run_check "Application Default Credentials (ADC)" 
              "gcloud auth application-default print-access-token --quiet" 
              "ADC not configured. Run 'gcloud auth application-default login'." 
              true

    # 3. Critical: gcloud project configuration
    run_check "gcloud project set to '$GOOGLE_CLOUD_PROJECT'" 
              "[[ \$(gcloud config get-value project) == '$GOOGLE_CLOUD_PROJECT' ]]" 
              "Wrong project. Run 'gcloud config set project $GOOGLE_CLOUD_PROJECT'." 
              true
    
    # 4. Critical: GitHub remote connectivity
    run_check "GitHub remote reachable" 
              "git ls-remote --exit-code origin >/dev/null 2>&1" 
              "Cannot connect to git remote 'origin'." 
              true

    # 5. Non-critical: Secret Manager access
    run_check "Secret Manager access (test read)" 
              "gcloud secrets versions access latest --secret=github-token --project=$GOOGLE_CLOUD_PROJECT >/dev/null" 
              "Could not access secrets. Check IAM permissions for Secret Manager."

    # 6. Non-critical: Git repository is clean
    run_check "Git status is clean" 
              "git diff --quiet && git diff --cached --quiet" 
              "You have uncommitted changes in your repository."
              
    # 7. Non-critical: Cloud Run service health
    SERVICE_URL=$(gcloud run services describe opax-mcp-core --region "$GOOGLE_CLOUD_LOCATION" --project "$GOOGLE_CLOUD_PROJECT" --format="value(status.url)" 2>/dev/null || echo "")
    if [[ -n "$SERVICE_URL" ]]; then
        run_check "Cloud Run service 'opax-mcp-core' healthy" 
                  "curl -s -f -H "Authorization: Bearer \$(gcloud auth print-identity-token)" "${SERVICE_URL}/health"" 
                  "The 'opax-mcp-core' service is not responding correctly."
    else
        printf "  %-35s" "Cloud Run service 'opax-mcp-core' healthy"
        printf "${YELLOW}SKIP${NC}
"
        printf "    ${DIM}Warning: Service 'opax-mcp-core' not found or URL could not be retrieved.${NC}
"
    fi

    printf "
${GREEN}All critical checks passed. OPAX environment is ready.${NC}

"
fi


# --- Set Environment ---
# Ensure we are in the project directory
cd "$OSVAUCO_DIR" || return

# Set a custom, identifiable prompt
export PS1="\[${GREEN}\]┌──(${CYAN}OPAX:${BOLD}\w${NC})\[${NC}\]
\[${GREEN}\]└─▪\[${NC}\] "

# --- Finalization ---
# Mark as loaded to prevent re-running the banner and checks
export OPAX_LOADED=true

# Display quick commands only on the first load in a session
if [[ -z "${OPAX_COMMANDS_SHOWN-}" ]]; then
    printf "${BOLD}${WHITE}QUICK COMMANDS${NC}
"
    printf "  ${GREEN}%-15s${NC} %s
" "opax" "Reload this environment script"
    printf "  ${GREEN}%-15s${NC} %s
" "cost-audit" "Run cost analysis"
    printf "  ${GREEN}%-15s${NC} %s
" "smoke-test" "Run API smoke tests"
    printf "  ${GREEN}%-15s${NC} %s
" "g" "Start the Gemini CLI"
    printf "
"
    export OPAX_COMMANDS_SHOWN=true
fi