#!/usr/bin/env bash
set -Eeuo pipefail
source "$(dirname "$0")/common.sh"
require_command kubectl
validate_environment

ENV_FILE="${ENV_FILE:-${ROOT_DIR}/deploy/env/evaluator.env}"
WALLET_DIR="${WALLET_DIR:-${ROOT_DIR}/deploy/wallet}"

[[ -f "${ENV_FILE}" ]] || { echo "Arquivo de variáveis não encontrado: ${ENV_FILE}" >&2; exit 1; }
[[ -d "${WALLET_DIR}" ]] || { echo "Diretório do wallet não encontrado: ${WALLET_DIR}" >&2; exit 1; }

kubectl create namespace "${NAMESPACE}" --dry-run=client -o yaml | kubectl apply -f -
kubectl -n "${NAMESPACE}" create secret generic evaluator-secrets \
  --from-env-file="${ENV_FILE}" \
  --dry-run=client -o yaml | kubectl apply -f -

wallet_args=()
while IFS= read -r -d '' file; do
  wallet_args+=("--from-file=$(basename "${file}")=${file}")
done < <(find "${WALLET_DIR}" -maxdepth 1 -type f -print0)

((${#wallet_args[@]} > 0)) || { echo "Nenhum arquivo encontrado em ${WALLET_DIR}" >&2; exit 1; }
kubectl -n "${NAMESPACE}" create secret generic evaluator-wallet \
  "${wallet_args[@]}" \
  --dry-run=client -o yaml | kubectl apply -f -



LANGFUSE_CREDENTIALS_FILE="${LANGFUSE_CREDENTIALS_FILE:-${ROOT_DIR}/deploy/langfuse/langfuse_credentials.yaml}"
if [[ -f "${LANGFUSE_CREDENTIALS_FILE}" ]]; then
  kubectl -n "${NAMESPACE}" create secret generic evaluator-langfuse \
    --from-file=langfuse_credentials.yaml="${LANGFUSE_CREDENTIALS_FILE}" \
    --dry-run=client -o yaml | kubectl apply -f -
  echo "Credenciais Langfuse atualizadas no secret evaluator-langfuse."
else
  echo "Arquivo de credenciais Langfuse não encontrado: ${LANGFUSE_CREDENTIALS_FILE}" >&2
  exit 1
fi

GCP_CREDENTIALS_FILE="${GCP_CREDENTIALS_FILE:-${ROOT_DIR}/deploy/gcp/GCP_ACCESS_KEY.json}"
if [[ -f "${GCP_CREDENTIALS_FILE}" ]]; then
  kubectl -n "${NAMESPACE}" create secret generic evaluator-gcp \
    --from-file=GCP_ACCESS_KEY.json="${GCP_CREDENTIALS_FILE}" \
    --dry-run=client -o yaml | kubectl apply -f -
  echo "Credencial GCP atualizada no secret evaluator-gcp."
else
  echo "Aviso: credencial GCP não encontrada em ${GCP_CREDENTIALS_FILE}; secret evaluator-gcp não foi alterado." >&2
fi

echo "Secrets atualizados no namespace ${NAMESPACE}."