# Zoo Universe — thin wrapper over the lux CLI.
#
# All per-env parameters (networkID, ports, dataDir, genesis path) live
# in chain.yaml. This Makefile carries only the brand name and the env
# list. Verbs delegate to the lux CLI which resolves `<brand>/<env>` to
# a RuntimeProfile via the brand registry (~/work/<brand>/universe).
#
# Equivalent invocations (Make is optional):
#   make up env=devnet     ≡  lux up zoo/devnet
#   make cycle env=mainnet ≡  lux cycle zoo/mainnet

SHELL := /bin/bash
.DEFAULT_GOAL := help

BRAND := zoo
ENVS  := localnet devnet testnet mainnet
LUX   := lux

# Single parametric verbs: `make up env=devnet`, etc.
.PHONY: up down snap cycle ps ctx
up    : ; @$(LUX) up    $(BRAND)/$(env)
down  : ; @$(LUX) down  $(BRAND)/$(env)
snap  : ; @$(LUX) snap  $(BRAND)/$(env)
cycle : ; @$(LUX) cycle $(BRAND)/$(env)
ps    : ; @$(LUX) ps
ctx   : ; @$(LUX) ctx

# Fanout: cycle every env in sequence.
.PHONY: cycle-all
cycle-all: ; @for e in $(ENVS); do $(LUX) cycle $(BRAND)/$$e || exit 1; done

# DOKS cluster overlays (separate concern: K8s, not chain lifecycle).
KCTX := do-sfo3-zoo-k8s
.PHONY: k8s-apply k8s-pods
k8s-apply: ; @kubectl --context $(KCTX) apply -k k8s/zoo-$(env)/
k8s-pods : ; @kubectl --context $(KCTX) -n zoo-$(env) get pods -o wide

# IAM — Zoo's identity app graph (deterministic, from this repo only).
#
# infra/k8s/iam/provision.yaml is the ONE source of truth for Zoo's OAuth
# clients. These targets are the ONLY supported way to change them — never
# hand-edit an application in a console, or the next converge silently reverts
# it and the drift is invisible until a login breaks.
#
# IAM_CTX/IAM_NS are hanzo-k8s/hanzo, NOT the Zoo cluster: the IdP that answers
# zoolabs.id runs there, and so does the service token it authenticates with.
IAM_DOC := infra/k8s/iam/provision.yaml
IAM_CTX := do-sfo3-hanzo-k8s
IAM_NS  := hanzo

.PHONY: iam-provision iam-provision-plan iam-provision-logs

iam-provision-plan: ## Derive Zoo's OAuth clients and print them; writes nothing
	@kubectl --context $(IAM_CTX) -n $(IAM_NS) run zoo-iam-plan-$$$$ --rm -i --restart=Never \
		--image=$$(awk -F'image: ' '/image: ghcr.io/{print $$2; exit}' infra/k8s/iam/provision-job.yaml) \
		--overrides='{"spec":{"imagePullSecrets":[{"name":"ghcr-secret"}]}}' \
		--command -- /iam2 provision --config=/dev/stdin --url=https://zoolabs.id --dry-run < $(IAM_DOC)

iam-provision: ## Converge zoolabs.id onto provision.yaml (idempotent; never rotates a secret)
	@kubectl --context $(IAM_CTX) -n $(IAM_NS) create configmap zoo-iam-provision \
		--from-file=provision.yaml=$(IAM_DOC) --dry-run=client -o yaml | \
		kubectl --context $(IAM_CTX) apply -f -
	@kubectl --context $(IAM_CTX) -n $(IAM_NS) delete job zoo-iam-provision --ignore-not-found
	@kubectl --context $(IAM_CTX) apply -f infra/k8s/iam/provision-job.yaml
	@kubectl --context $(IAM_CTX) -n $(IAM_NS) wait --for=condition=complete job/zoo-iam-provision --timeout=180s \
		|| { echo "provision did not complete — logs:"; $(MAKE) iam-provision-logs; exit 1; }
	@$(MAKE) iam-provision-logs

iam-provision-logs: ## Show what the last converge actually did
	@kubectl --context $(IAM_CTX) -n $(IAM_NS) logs job/zoo-iam-provision --tail=100 2>/dev/null || true

.PHONY: help
help: ## Show this help
	@printf "  Chain verbs (env=<localnet|devnet|testnet|mainnet>)\n"
	@printf "    make up env=devnet            boot zoo/<env>\n"
	@printf "    make down env=devnet          stop zoo/<env>\n"
	@printf "    make snap env=devnet          snapshot zoo/<env>\n"
	@printf "    make cycle env=devnet         boot → deploy → stop → snap\n"
	@printf "    make cycle-all                cycle every env\n"
	@printf "    make ps / make ctx            registry inspection\n"
	@printf "\n  K8s (DOKS $(KCTX))\n"
	@printf "    make k8s-apply env=mainnet    apply k8s/zoo-<env>/ overlay\n"
	@printf "    make k8s-pods  env=mainnet    list pods in namespace\n"
	@printf "\n  IAM (zoolabs.id, via $(IAM_CTX)/$(IAM_NS))\n"
	@printf "    make iam-provision-plan       derive OAuth clients, write nothing\n"
	@printf "    make iam-provision            converge zoolabs.id onto $(IAM_DOC)\n"
	@printf "    make iam-provision-logs       what the last converge did\n"