#!/bin/bash
# scripts/validate-n8n-deployment.sh
# Validate n8n deployment and SCCM automation setup

set -euo pipefail

echo "=========================================="
echo "n8n Deployment Validation"
echo "=========================================="
echo ""

# Colors for output
GREEN='\033[0;32m'
RED='\033[0;31m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

validate_step() {
    local step_name=$1
    local command=$2
    
    echo -n "Checking $step_name... "
    
    if eval "$command" &>/dev/null; then
        echo -e "${GREEN}✓ PASS${NC}"
        return 0
    else
        echo -e "${RED}✗ FAIL${NC}"
        return 1
    fi
}

validate_step_with_output() {
    local step_name=$1
    local command=$2
    
    echo "Checking $step_name..."
    
    if output=$(eval "$command" 2>&1); then
        echo -e "${GREEN}✓ PASS${NC}"
        echo "$output"
        return 0
    else
        echo -e "${RED}✗ FAIL${NC}"
        echo "$output"
        return 1
    fi
}

# Track failures
FAILURES=0

# 1. Check namespace exists
if ! validate_step "n8n namespace exists" "kubectl get namespace n8n"; then
    ((FAILURES++))
    echo -e "${YELLOW}  → Run: helmfile -l name=n8n apply${NC}"
fi

# 2. Check external secrets
echo ""
echo "Checking External Secrets..."
if kubectl get namespace n8n &>/dev/null; then
    if ! validate_step "  PostgreSQL secret" "kubectl get externalsecret -n n8n n8n-postgresql"; then
        ((FAILURES++))
        echo -e "${YELLOW}    → Run: kubectl apply -f kubernetes/apps/n8n/external-secret.yaml${NC}"
    fi
    
    if ! validate_step "  Config secret" "kubectl get externalsecret -n n8n n8n-config"; then
        ((FAILURES++))
        echo -e "${YELLOW}    → Run: kubectl apply -f kubernetes/apps/n8n/external-secret.yaml${NC}"
    fi
    
    # Check if secrets are synced
    if ! validate_step "  PostgreSQL secret synced" "kubectl get secret -n n8n n8n-postgresql-secret"; then
        ((FAILURES++))
        echo -e "${YELLOW}    → Ensure Vault has secrets. Run: ./scripts/init-n8n-secrets.sh${NC}"
    fi
    
    if ! validate_step "  Config secret synced" "kubectl get secret -n n8n n8n-config-secret"; then
        ((FAILURES++))
        echo -e "${YELLOW}    → Ensure Vault has secrets. Run: ./scripts/init-n8n-secrets.sh${NC}"
    fi
fi

# 3. Check PostgreSQL deployment
echo ""
echo "Checking PostgreSQL..."
if ! validate_step "  PostgreSQL StatefulSet" "kubectl get statefulset -n n8n n8n-postgresql"; then
    ((FAILURES++))
fi

if kubectl get statefulset -n n8n n8n-postgresql &>/dev/null; then
    if ! validate_step "  PostgreSQL pod ready" "kubectl wait --for=condition=ready pod -n n8n -l app.kubernetes.io/name=postgresql --timeout=10s"; then
        ((FAILURES++))
        echo -e "${YELLOW}    → Check: kubectl logs -n n8n n8n-postgresql-0${NC}"
    fi
fi

# 4. Check n8n deployment
echo ""
echo "Checking n8n deployment..."
if ! validate_step "  n8n deployment exists" "kubectl get deployment -n n8n n8n"; then
    ((FAILURES++))
else
    if ! validate_step "  n8n pod ready" "kubectl wait --for=condition=ready pod -n n8n -l app.kubernetes.io/name=n8n --timeout=10s"; then
        ((FAILURES++))
        echo -e "${YELLOW}    → Check: kubectl logs -n n8n deployment/n8n${NC}"
    fi
fi

# 5. Check service
echo ""
if ! validate_step "n8n service exists" "kubectl get service -n n8n n8n"; then
    ((FAILURES++))
fi

# 6. Check ingress
echo ""
if ! validate_step "n8n ingress exists" "kubectl get ingress -n n8n"; then
    ((FAILURES++))
fi

# 7. Check ingress hostname
echo ""
if kubectl get ingress -n n8n &>/dev/null; then
    INGRESS_HOST=$(kubectl get ingress -n n8n -o jsonpath='{.items[0].spec.rules[0].host}' 2>/dev/null || echo "")
    if [ -n "$INGRESS_HOST" ]; then
        echo -e "n8n ingress hostname: ${GREEN}$INGRESS_HOST${NC}"
    else
        echo -e "${RED}✗ No ingress hostname found${NC}"
        ((FAILURES++))
    fi
fi

# 8. Check TLS certificate
echo ""
if ! validate_step "n8n TLS certificate" "kubectl get certificate -n n8n n8n-tls"; then
    ((FAILURES++))
else
    CERT_READY=$(kubectl get certificate -n n8n n8n-tls -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}' 2>/dev/null || echo "False")
    if [ "$CERT_READY" = "True" ]; then
        echo -e "  Certificate status: ${GREEN}Ready${NC}"
    else
        echo -e "  Certificate status: ${YELLOW}Not Ready${NC}"
        echo -e "${YELLOW}    → Check: kubectl describe certificate -n n8n n8n-tls${NC}"
    fi
fi

# 9. Check PVC
echo ""
if ! validate_step "n8n PVC exists" "kubectl get pvc -n n8n"; then
    ((FAILURES++))
fi

# 10. Test n8n health
echo ""
echo "Testing n8n connectivity..."
if [ -n "$INGRESS_HOST" ]; then
    if HTTP_CODE=$(curl -s -k -o /dev/null -w "%{http_code}" "https://$INGRESS_HOST" 2>/dev/null); then
        if [ "$HTTP_CODE" -eq 200 ] || [ "$HTTP_CODE" -eq 302 ]; then
            echo -e "  HTTP response: ${GREEN}$HTTP_CODE${NC}"
        else
            echo -e "  HTTP response: ${YELLOW}$HTTP_CODE${NC}"
        fi
    else
        echo -e "${YELLOW}  → Could not connect to $INGRESS_HOST${NC}"
    fi
fi

# Summary
echo ""
echo "=========================================="
if [ $FAILURES -eq 0 ]; then
    echo -e "${GREEN}✓ All checks passed!${NC}"
    echo ""
    echo "n8n is ready at: https://$INGRESS_HOST"
    echo ""
    echo "Next steps:"
    echo "1. Access n8n and create admin account"
    echo "2. Install SCCM API service on Windows: sccm-automation/Install-SCCMAPIService.ps1"
    echo "3. Import workflow: sccm-automation/firefox-automation-workflow.json"
    echo "4. Configure credentials in n8n"
    echo "5. Activate the workflow"
    echo ""
    echo "See: sccm-automation/QUICKSTART.md for detailed setup"
else
    echo -e "${RED}✗ $FAILURES check(s) failed${NC}"
    echo ""
    echo "Please review the errors above and take corrective action."
    echo ""
    echo "Common fixes:"
    echo "1. Initialize secrets: ./scripts/init-n8n-secrets.sh"
    echo "2. Deploy n8n: helmfile -l name=n8n apply"
    echo "3. Check logs: kubectl logs -n n8n deployment/n8n"
    echo "4. Check events: kubectl get events -n n8n --sort-by='.lastTimestamp'"
fi
echo "=========================================="

exit $FAILURES