#!/usr/bin/env bash
# One-pass-ish deploy of the AWS side. Fusion is shared SaaS and is NOT deployed
# here -- it is configured in its console (fusion/POLICY_SETUP.md) to call the
# endpoints this stack exposes. Assumes aws-cli (creds + region), docker,
# terraform, and the AgentCore CLI are installed. Review before running.
set -euo pipefail
cd "$(dirname "$0")/.."

REGION="${REGION:-us-east-1}"
ACCOUNT="$(aws sts get-caller-identity --query Account --output text)"
ECR="${ACCOUNT}.dkr.ecr.${REGION}.amazonaws.com"

echo "==> Step 1: core infra (DynamoDB + RAG Lambda + IAM)"
terraform -chdir=terraform init
terraform -chdir=terraform apply -target=aws_lambda_function.rag -auto-approve

echo "==> Step 2: build + push the Presidio detector image"
aws ecr describe-repositories --repository-names hncb-presidio --region "$REGION" >/dev/null 2>&1 \
  || aws ecr create-repository --repository-name hncb-presidio --region "$REGION" \
       --tags Key=Owner,Value="conan hncb demo" >/dev/null
aws ecr get-login-password --region "$REGION" | docker login --username AWS --password-stdin "$ECR"
docker build -t "$ECR/hncb-presidio:latest" ./presidio
docker push "$ECR/hncb-presidio:latest"

echo "==> Step 3: full apply (Presidio Fargate service + tables)"
terraform -chdir=terraform apply \
  -var "presidio_image_uri=$ECR/hncb-presidio:latest" \
  -auto-approve

echo "==> Step 4: seed data"
export CUSTOMERS_TABLE="$(terraform -chdir=terraform output -raw customers_table)"
export VAULT_TABLE="$(terraform -chdir=terraform output -raw vault_table)"
python seed/seed.py --with-demo-token

echo "==> Step 5: AgentCore (Gateway + Runtime)"
export RAG_LAMBDA_ARN="$(terraform -chdir=terraform output -raw rag_lambda_arn)"
export REGION
bash scripts/agentcore_setup.sh

echo ""
echo "Remaining steps (see CLAUDE.md task backlog):"
echo "  - Build the /tokenize + /restore HTTPS endpoints Fusion SaaS will call (T1, T2)"
echo "  - Configure the shared Fusion SaaS instance -> fusion/POLICY_SETUP.md"
echo "  - Point ui/index.html GATEWAY_URL at the Fusion SaaS entrypoint, then host it"
echo "Done."