#!/usr/bin/env bash
# Deploy the AIMem workspace Pod to an OpenShift cluster and verify the
# FUSE mount end to end. Requires cluster-admin (to create the SCC) and a
# logged-in `oc` (oc login ...). Works on self-managed OpenShift/OKD,
# OpenShift Local (CRC, as kubeadmin), MicroShift, and ROSA after
# `rosa grant user cluster-admin`. It does NOT work on the free hosted
# Developer Sandbox -- see README.md.
#
# Required env:
#   AIMEM_BUCKET           bucket to mount
#   AIMEM_ENDPOINT         S3 endpoint reachable from the cluster
#   AIMEM_ACCESS_KEY       or AWS_ACCESS_KEY_ID
#   AIMEM_SECRET_KEY       or AWS_SECRET_ACCESS_KEY
# Optional env:
#   AIMEM_SESSION_TOKEN    or AWS_SESSION_TOKEN
#   NAMESPACE              (default: aimem)
#   AIMEM_IMAGE            (default: quay.io/minio/aistor/aimem:${AIMEM_VERSION:-latest})
#   AIMEM_VERSION          release tag used by the default AIMEM_IMAGE
#   AIMEM_COMMAND          shell command to run after mounting (default: sleep infinity)
#   AIMEM_AGENT            (default: auto)
#   AIMEM_REGION
#   AIMEM_PREFIX
#   AIMEM_LOCAL
#   AIMEM_ALLOW_OTHER
#   MOUNT_WAIT_SECS        (default: 60)
#   KEEP=0                 delete the pod after the smoke (default: keep it running)
#   CLEANUP=1              with KEEP=0, also delete SCC/RBAC/config on exit

set -euo pipefail

AIMEM_ACCESS_KEY="${AIMEM_ACCESS_KEY:-${AWS_ACCESS_KEY_ID:-}}"
AIMEM_SECRET_KEY="${AIMEM_SECRET_KEY:-${AWS_SECRET_ACCESS_KEY:-}}"
AIMEM_SESSION_TOKEN="${AIMEM_SESSION_TOKEN:-${AWS_SESSION_TOKEN:-}}"
AIMEM_VERSION="${AIMEM_VERSION:-latest}"
AIMEM_IMAGE="${AIMEM_IMAGE:-quay.io/minio/aistor/aimem:${AIMEM_VERSION}}"

: "${AIMEM_BUCKET:?AIMEM_BUCKET required}"
: "${AIMEM_ENDPOINT:?AIMEM_ENDPOINT required}"
: "${AIMEM_ACCESS_KEY:?AIMEM_ACCESS_KEY or AWS_ACCESS_KEY_ID required}"
: "${AIMEM_SECRET_KEY:?AIMEM_SECRET_KEY or AWS_SECRET_ACCESS_KEY required}"

HERE="$(cd "$(dirname "$0")" && pwd)"
POD=aimem-workspace
MOUNT_WAIT_SECS="${MOUNT_WAIT_SECS:-60}"

command -v oc >/dev/null 2>&1 || { echo "oc not found on PATH" >&2; exit 1; }

NAMESPACE="${NAMESPACE:-aimem}"
echo "==> namespace: ${NAMESPACE}"
oc get namespace "${NAMESPACE}" >/dev/null 2>&1 || oc create namespace "${NAMESPACE}"
oc project "${NAMESPACE}" >/dev/null 2>&1 \
    || oc config set-context --current --namespace="${NAMESPACE}" >/dev/null

echo "==> applying SCC (cluster-admin required)"
oc apply -f "${HERE}/scc.yaml"

echo "==> service account + SCC binding"
# Create the SA + grant it the SCC imperatively so this works in any
# namespace (rbac.yaml is the declarative equivalent, pinned to `aimem`).
oc create serviceaccount aimem -n "${NAMESPACE}" --dry-run=client -o yaml | oc apply -n "${NAMESPACE}" -f -
oc adm policy add-scc-to-user aimem-fuse-scc -z aimem -n "${NAMESPACE}" >/dev/null

echo "==> config + credentials"
# ConfigMap + Secret are created from the env passed at invocation time;
# the pod's envFrom pulls them into the container for aimem-workspace.
config_args=(
    --from-literal=AIMEM_BUCKET="${AIMEM_BUCKET}"
    --from-literal=AIMEM_ENDPOINT="${AIMEM_ENDPOINT}"
    --from-literal=AIMEM_AGENT="${AIMEM_AGENT:-auto}"
)
for key in AIMEM_REGION AIMEM_PREFIX AIMEM_LOCAL AIMEM_ALLOW_OTHER AIMEM_COMMAND; do
    value="${!key:-}"
    [[ -n "${value}" ]] && config_args+=(--from-literal="${key}=${value}")
done
oc create configmap aimem-config -n "${NAMESPACE}" \
    "${config_args[@]}" \
    --dry-run=client -o yaml | oc apply -n "${NAMESPACE}" -f -

cred_args=(
    --from-literal=AIMEM_ACCESS_KEY="${AIMEM_ACCESS_KEY}"
    --from-literal=AIMEM_SECRET_KEY="${AIMEM_SECRET_KEY}"
    --from-literal=AWS_ACCESS_KEY_ID="${AIMEM_ACCESS_KEY}"
    --from-literal=AWS_SECRET_ACCESS_KEY="${AIMEM_SECRET_KEY}"
)
if [[ -n "${AIMEM_SESSION_TOKEN:-}" ]]; then
    cred_args+=(
        --from-literal=AIMEM_SESSION_TOKEN="${AIMEM_SESSION_TOKEN}"
        --from-literal=AWS_SESSION_TOKEN="${AIMEM_SESSION_TOKEN}"
    )
fi
oc create secret generic aimem-credentials -n "${NAMESPACE}" \
    "${cred_args[@]}" \
    --dry-run=client -o yaml | oc apply -n "${NAMESPACE}" -f -

cleanup() {
    [[ "${KEEP:-1}" == "1" ]] && return
    oc delete pod "${POD}" -n "${NAMESPACE}" --ignore-not-found >/dev/null 2>&1 || true
    if [[ "${CLEANUP:-}" == "1" ]]; then
        oc adm policy remove-scc-from-user aimem-fuse-scc -z aimem -n "${NAMESPACE}" >/dev/null 2>&1 || true
        oc delete serviceaccount aimem -n "${NAMESPACE}" --ignore-not-found >/dev/null 2>&1 || true
        oc delete configmap aimem-config secret aimem-credentials -n "${NAMESPACE}" --ignore-not-found >/dev/null 2>&1 || true
        oc delete -f "${HERE}/scc.yaml" --ignore-not-found >/dev/null 2>&1 || true
    fi
}
trap cleanup EXIT

echo "==> deploying pod (image: ${AIMEM_IMAGE})"
oc delete pod "${POD}" -n "${NAMESPACE}" --ignore-not-found >/dev/null 2>&1 || true
image_escaped="${AIMEM_IMAGE//\\/\\\\}"
image_escaped="${image_escaped//&/\\&}"
sed "s|image: quay.io/minio/aistor/aimem:latest|image: ${image_escaped}|" "${HERE}/aimem-workspace.yaml" \
    | oc apply -n "${NAMESPACE}" -f -

echo "==> waiting for pod Ready (${MOUNT_WAIT_SECS}s)"
if ! oc wait --for=condition=Ready "pod/${POD}" -n "${NAMESPACE}" --timeout="${MOUNT_WAIT_SECS}s"; then
    echo "ERROR: pod did not become Ready" >&2
    oc describe pod "${POD}" -n "${NAMESPACE}" >&2 || true
    oc logs "${POD}" -n "${NAMESPACE}" >&2 || true
    exit 1
fi

echo "==> waiting for the /workspace FUSE mount"
# The pod reports Ready as soon as the container is running; the entrypoint
# may still be bringing the mount up, so poll for it before asserting.
for _ in $(seq 1 "${MOUNT_WAIT_SECS}"); do
    if oc exec "${POD}" -n "${NAMESPACE}" -- mountpoint -q /workspace 2>/dev/null; then break; fi
    sleep 1
done

echo "==> verifying mount + installed skill"
oc exec "${POD}" -n "${NAMESPACE}" -- bash -c '
    set -e
    mountpoint -q /workspace
    for d in "$HOME/.agents/skills/aimem" "$HOME/.claude/skills/aimem"; do
        { test -f "$d/SKILL.md" && test -s "$d/SKILL.md"; } || { echo "missing $d/SKILL.md" >&2; exit 1; }
        grep -q "^name: aimem$" "$d/SKILL.md" || { echo "bad frontmatter $d/SKILL.md" >&2; exit 1; }
        for r in navigation workspace memory metadata annotations; do
            { test -f "$d/references/$r.md" && test -s "$d/references/$r.md"; } || { echo "missing $d/references/$r.md" >&2; exit 1; }
        done
    done
    printf "hello from openshift\n" > /workspace/from-openshift.txt
    cat /workspace/from-openshift.txt
'
echo "==> OPENSHIFT SMOKE OK"