#!/usr/bin/env bash
set -euo pipefail

EG334S_PROFILE="${EG334S_AWS_PROFILE:-}"
EG334S_ADMIN="${EG334S_ADMIN_CIDR:-}"

if [[ -z "$EG334S_PROFILE" ]]; then
  echo "ERROR: set EG334S_AWS_PROFILE to the school AWS CLI profile." >&2
  exit 2
fi
if [[ ! "$EG334S_ADMIN" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/32$ ]]; then
  echo "ERROR: EG334S_ADMIN_CIDR must be an explicit IPv4 /32." >&2
  exit 2
fi

EG334S_IDENTITY="$(AWS_PROFILE="$EG334S_PROFILE" aws sts get-caller-identity --output json)"
EG334S_ACCOUNT="$(printf '%s' "$EG334S_IDENTITY" | jq -r '.Account // empty')"
EG334S_ARN="$(printf '%s' "$EG334S_IDENTITY" | jq -r '.Arn // empty')"
if [[ -z "$EG334S_ACCOUNT" || -z "$EG334S_ARN" ]]; then
  echo "ERROR: authenticated identity is incomplete." >&2
  exit 3
fi

echo "Authenticated school candidate account: $EG334S_ACCOUNT"
echo "Caller: $EG334S_ARN"
echo "Administrator CIDR: $EG334S_ADMIN"
echo "Confirm this account ID before any deployment."

for EG334S_REGION in us-east-1 eu-west-1; do
  AWS_PROFILE="$EG334S_PROFILE" aws ec2 describe-vpcs \
    --region "$EG334S_REGION" \
    --max-results 5 \
    --query 'length(Vpcs)' \
    --output text >/dev/null
  AWS_PROFILE="$EG334S_PROFILE" aws cloudformation list-stacks \
    --region "$EG334S_REGION" \
    --stack-status-filter CREATE_COMPLETE UPDATE_COMPLETE \
    --query 'length(StackSummaries)' \
    --output text >/dev/null
  echo "PASS: read access in $EG334S_REGION"
done

for EG334S_TEMPLATE in \
  docs/iac/vpn1-onprem-us-east-1.yaml \
  docs/iac/vpn1-awspublic-eu-west-1.yaml \
  docs/iac/hub-alb-eu-west-1.yaml \
  docs/iac/hub-recovery-eu-west-1.yaml \
  docs/iac/video-evidence-distribution.yaml
do
  EG334S_REGION=eu-west-1
  if [[ "$EG334S_TEMPLATE" == *onprem* ]]; then
    EG334S_REGION=us-east-1
  elif [[ "$EG334S_TEMPLATE" == *video-evidence* ]]; then
    EG334S_REGION=us-east-1
  fi
  AWS_PROFILE="$EG334S_PROFILE" aws cloudformation validate-template \
    --region "$EG334S_REGION" \
    --template-body "file://$EG334S_TEMPLATE" >/dev/null
  echo "PASS: $EG334S_TEMPLATE"
done

echo "READ-ONLY PREFLIGHT PASSED. No resources were created or changed."