#!/bin/bash
# Generated by: Claude AI via Cursor
set -x

# This script deletes the AKS management cluster and associated Azure resources.
# It reuses the same variables from the other scripts in this folder.

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# Load variables - check if vars.sh is available
if [[ -f "${SCRIPT_DIR}/vars.sh" ]]; then
    source "${SCRIPT_DIR}/vars.sh"
else
    echo "Error: vars.sh not found. Please ensure you're running this from the managed-azure directory."
    exit 1
fi

# Variables from vars.sh that we'll use
AKS_RG="${AKS_RG:-}"
AKS_CLUSTER_NAME="${AKS_CLUSTER_NAME:-}"
SUBSCRIPTION_ID="${SUBSCRIPTION_ID:-}"
PERSISTENT_RG_NAME="${PERSISTENT_RG_NAME:-}"
PREFIX="${PREFIX:-}"

# Note: Managed identity variables removed since we preserve them for reuse

# Validate required variables
if [[ -z "$AKS_RG" ]]; then
    echo "Error: AKS_RG is not set. Please check your vars.sh file."
    exit 1
fi

if [[ -z "$AKS_CLUSTER_NAME" ]]; then
    echo "Error: AKS_CLUSTER_NAME is not set. Please check your vars.sh file."
    exit 1
fi

if [[ -z "$SUBSCRIPTION_ID" ]]; then
    echo "Error: SUBSCRIPTION_ID is not set. Please check your vars.sh file."
    exit 1
fi

if [[ -z "$PERSISTENT_RG_NAME" ]]; then
    echo "Error: PERSISTENT_RG_NAME is not set. Please check your vars.sh file."
    exit 1
fi

if [[ -z "$PREFIX" ]]; then
    echo "Error: PREFIX is not set. Please check your user-vars.sh file."
    exit 1
fi

# Get the Key Vault authorized object ID before deleting the cluster
if az aks show --name "$AKS_CLUSTER_NAME" --resource-group "$AKS_RG" >/dev/null 2>&1; then
    AZURE_KEY_VAULT_AUTHORIZED_OBJECT_ID=$(az aks show -n "$AKS_CLUSTER_NAME" -g "$AKS_RG" --query "addonProfiles.azureKeyvaultSecretsProvider.identity.objectId" -o tsv 2>/dev/null)
    
    # Remove the role assignment for Key Vault access if it exists
    if [[ -n "$AZURE_KEY_VAULT_AUTHORIZED_OBJECT_ID" && "$AZURE_KEY_VAULT_AUTHORIZED_OBJECT_ID" != "null" ]]; then
        ROLE_ASSIGNMENT_ID=$(az role assignment list \
            --assignee "$AZURE_KEY_VAULT_AUTHORIZED_OBJECT_ID" \
            --role "Key Vault Secrets User" \
            --scope "/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${PERSISTENT_RG_NAME}" \
            --output tsv \
            --query "[].id" 2>/dev/null)
        
        if [[ -n "$ROLE_ASSIGNMENT_ID" ]]; then
            az role assignment delete --ids "$ROLE_ASSIGNMENT_ID"
            echo "Removed Key Vault role assignment"
        else
            echo "No Key Vault role assignment found to remove"
        fi
    else
        echo "No Key Vault authorized object ID found"
    fi
else
    echo "AKS cluster $AKS_CLUSTER_NAME not found or already deleted"
fi

# Delete the AKS cluster
if az aks show --name "$AKS_CLUSTER_NAME" --resource-group "$AKS_RG" >/dev/null 2>&1; then
    az aks delete --resource-group "$AKS_RG" --name "$AKS_CLUSTER_NAME" --yes
    if [ $? -ne 0 ]; then
        echo "Error: Failed to delete AKS cluster $AKS_CLUSTER_NAME"
        exit 1
    fi
else
    echo "AKS cluster $AKS_CLUSTER_NAME does not exist or already deleted"
fi

# Delete the AKS resource group
if az group show --name "$AKS_RG" >/dev/null 2>&1; then
    az group delete --name "$AKS_RG" --yes
    if [ $? -ne 0 ]; then
        echo "Error: Failed to delete resource group $AKS_RG"
        exit 1
    fi
else
    echo "AKS resource group $AKS_RG does not exist or already deleted"
fi

# Note: We do NOT delete managed identities as they are reused across multiple clusters
# The AKS managed identities remain in ${PERSISTENT_RG_NAME} for reuse across clusters

echo "AKS cluster deletion completed successfully."

set +x