#!/bin/bash

# AWS Infrastructure Setup for VIMS
# Creates S3 bucket, ECR repository, and basic IAM roles

set -e

REGION="eu-north-1"
PROJECT="vims"
ENVIRONMENT="production"

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

echo -e "${GREEN}🚀 VIMS AWS Setup${NC}"
echo "=================="

# Check AWS CLI
if ! command -v aws &> /dev/null; then
    echo -e "${RED}AWS CLI not found. Please install it first.${NC}"
    exit 1
fi

# Check AWS credentials
if ! aws sts get-caller-identity > /dev/null 2>&1; then
    echo -e "${RED}AWS credentials not configured. Run 'aws configure' first.${NC}"
    exit 1
fi

ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
echo -e "${GREEN}✓ AWS account: ${ACCOUNT_ID}${NC}"

# Create S3 bucket for images
echo -e "${YELLOW}Creating S3 bucket...${NC}"
BUCKET_NAME="${PROJECT}-images-${ACCOUNT_ID}"
aws s3 mb "s3://${BUCKET_NAME}" --region ${REGION} 2>/dev/null || true
aws s3api put-bucket-versioning \
    --bucket ${BUCKET_NAME} \
    --versioning-configuration Status=Enabled

echo -e "${GREEN}✓ S3 bucket: ${BUCKET_NAME}${NC}"

# Create ECR repository
echo -e "${YELLOW}Creating ECR repository...${NC}"
aws ecr create-repository \
    --repository-name ${PROJECT} \
    --region ${REGION} 2>/dev/null || true

ECR_URI="${ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com/${PROJECT}"
echo -e "${GREEN}✓ ECR repository: ${ECR_URI}${NC}"

# Create IAM role for ECS tasks
echo -e "${YELLOW}Creating IAM role...${NC}"
cat > /tmp/vims-trust-policy.json <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ecs-tasks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF

aws iam create-role \
    --role-name ${PROJECT}-task-role \
    --assume-role-policy-document file:///tmp/vims-trust-policy.json 2>/dev/null || true

# Attach policies
aws iam attach-role-policy \
    --role-name ${PROJECT}-task-role \
    --policy-arn arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy 2>/dev/null || true

echo -e "${GREEN}✓ IAM role: ${PROJECT}-task-role${NC}"

# Create CloudWatch log group
echo -e "${YELLOW}Creating CloudWatch log group...${NC}"
aws logs create-log-group \
    --log-group-name /ecs/${PROJECT} \
    --region ${REGION} 2>/dev/null || true

echo -e "${GREEN}✓ CloudWatch log group: /ecs/${PROJECT}${NC}"

# Save configuration
echo -e "${YELLOW}Saving configuration...${NC}"
cat > .env.aws <<EOF
# AWS Configuration
AWS_REGION=${REGION}
AWS_ACCOUNT_ID=${ACCOUNT_ID}
S3_BUCKET=${BUCKET_NAME}
ECR_URI=${ECR_URI}
ECS_CLUSTER=${PROJECT}
ECS_SERVICE=${PROJECT}-api
EOF

echo -e "${GREEN}✓ Configuration saved to .env.aws${NC}"

echo ""
echo -e "${GREEN}🎉 AWS setup complete!${NC}"
echo ""
echo "Next steps:"
echo "1. Build and push Docker image:"
echo "   aws ecr get-login-password | docker login --username AWS --password-stdin ${ECR_URI}"
echo "   docker build -t ${PROJECT} ."
echo "   docker tag ${PROJECT}:latest ${ECR_URI}:latest"
echo "   docker push ${ECR_URI}:latest"
echo ""
echo "2. Deploy to ECS:"
echo "   ./scripts/deploy-aws.sh"