#!/usr/bin/env bash
set -euo pipefail

if [[ $# -ne 1 ]]; then
  printf 'usage: %s ARCHIVE_DIR\n' "$0" >&2
  exit 2
fi

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
GATEWAY="$ROOT/modules/sandbox/registry-gateway"
ARCHIVES="$(realpath "$1")"
KUBECTL="${KUBECTL:-kubectl}"
RUN_ROOT="${XDG_CACHE_HOME:-$HOME/.cache}/overdeck/platform-registry-deploy"
mkdir -p "$RUN_ROOT"

query="$ARCHIVES/platform-modules-query-react-0.1.0.tgz"
primitives="$ARCHIVES/platform-modules-ui-primitives-0.5.0.tgz"
tokens="$ARCHIVES/platform-modules-ui-tokens-0.2.0.tgz"
for archive in "$query" "$primitives" "$tokens"; do
  [[ -f "$archive" ]] || { printf 'missing genuine package archive: %s\n' "$archive" >&2; exit 1; }
done

printf '%s  %s\n' \
  2a2cfe724f7722ed87a092c7e99e1615946ba133928312ac968fc1c9d2f8dca9 "$query" \
  2f5a552cd9589a26336f01f62b05864c1c3b76f19c86f78b08aa45255dfd2443 "$primitives" \
  dc363a6d34043c94f57d2163df95adcd83ed3838ac7083f39c1f0f460f0a6a5e "$tokens" \
  | sha256sum --check --strict

content_hash="$({
  sha256sum "$GATEWAY/server.mjs" "$GATEWAY/admit-package.mjs"
  sha256sum "$query" "$primitives" "$tokens"
} | sha256sum | cut -c1-16)"
config_map="platform-registry-inputs-$content_hash"
rendered="$RUN_ROOT/runtime-$content_hash.yaml"
config_json="$RUN_ROOT/config-$content_hash.json"

printf '%s\n' '{"apiVersion":"v1","kind":"Namespace","metadata":{"name":"platform-registry","labels":{"pod-security.kubernetes.io/enforce":"restricted","pod-security.kubernetes.io/audit":"restricted","pod-security.kubernetes.io/warn":"restricted"}}}' \
  | "$KUBECTL" apply -f - >/dev/null

"$KUBECTL" -n overdeck-factory get secret overdeck-ghcr-pull -o json \
  | python3 -c 'import json,sys; data=json.load(sys.stdin); data["metadata"]={"name":"overdeck-ghcr-pull","namespace":"platform-registry"}; print(json.dumps(data, separators=(",", ":")))' \
  | "$KUBECTL" apply -f - >/dev/null

"$KUBECTL" -n platform-registry create configmap "$config_map" \
  --from-file=server.mjs="$GATEWAY/server.mjs" \
  --from-file=admit-package.mjs="$GATEWAY/admit-package.mjs" \
  --from-file=query-react.tgz="$query" \
  --from-file=ui-primitives.tgz="$primitives" \
  --from-file=ui-tokens.tgz="$tokens" \
  --dry-run=client -o json >"$config_json"
python3 - "$config_json" <<'PY'
import json
import sys
from pathlib import Path

path = Path(sys.argv[1])
data = json.loads(path.read_text())
data["immutable"] = True
data["metadata"]["labels"] = {"app.kubernetes.io/name": "platform-registry-gateway"}
path.write_text(json.dumps(data, separators=(",", ":")) + "\n")
PY
"$KUBECTL" apply -f "$config_json" >/dev/null

python3 - "$GATEWAY/runtime.yaml" "$rendered" "$config_map" <<'PY'
import sys
from pathlib import Path

source, destination, config_map = map(Path, sys.argv[1:])
text = source.read_text()
placeholder = "__INPUT_CONFIG_MAP__"
if text.count(placeholder) != 1:
    raise SystemExit(f"runtime template must contain exactly one {placeholder}")
destination.write_text(text.replace(placeholder, str(config_map)))
PY
"$KUBECTL" apply -f "$rendered"
"$KUBECTL" -n platform-registry rollout status deployment/platform-registry-gateway --timeout=120s
printf 'platform-registry-gateway: ready endpoint=http://100.101.104.41:4873 config=%s\n' "$config_map"