deploy.ps1

# ADME-Fabric Control Plane Deployment Script (PowerShell)
# Idempotent deployment - safe to run multiple times

param(
    [string]$ResourceGroup = "rg-adme-control-plane",
    [string]$Location = "eastus",
    [string]$ContainerAppEnv = "env-adme-control-plane",
    [string]$ContainerAppName = "adme-control-plane",
    [string]$KeyVaultName = "",  # Auto-generated if not provided
    [string]$SqlServerName = "",  # Auto-generated if not provided
    [string]$SqlDatabaseName = "controlplane",
    [string]$EncryptionKey = $env:ENCRYPTION_KEY,
    [string]$LogLevel = "INFO",
    [string]$VNetName = "vnet-adme-control-plane",  # Virtual Network name
    [string]$VNetAddressPrefix = "10.0.0.0/16",     # VNet address space
    [string]$SubnetContainerApps = "snet-container-apps",  # Subnet for Container Apps
    [string]$SubnetPrivateEndpoints = "snet-private-endpoints",  # Subnet for Private Endpoints
    [switch]$SkipKeyVault,  # Use local encryption instead of Key Vault
    [switch]$SkipAzureSql,  # Use SQLite instead of Azure SQL
    [switch]$UseSqlite,     # Alias for SkipAzureSql (more intuitive)
    [switch]$SkipPrivateLink  # Skip Private Link setup (use public network)
)

$ErrorActionPreference = "Stop"

# Normalize parameters
if ($UseSqlite) { $SkipAzureSql = $true }

Write-Host "=========================================" -ForegroundColor Cyan
Write-Host "ADME-Fabric Control Plane Deployment" -ForegroundColor Cyan
Write-Host "=========================================" -ForegroundColor Cyan
Write-Host "Resource Group: $ResourceGroup"
Write-Host "Location: $Location"
Write-Host "Container App: $ContainerAppName"
Write-Host "Database: $(if ($SkipAzureSql) { 'SQLite (local)' } else { 'Azure SQL (Managed Identity)' })"
Write-Host "Key Vault: $(if ($SkipKeyVault) { 'Disabled' } else { 'Enabled (Managed Identity)' })"
Write-Host "Network: $(if ($SkipPrivateLink) { 'Public' } else { 'Private Link (VNet integrated)' })"
Write-Host "=========================================" -ForegroundColor Cyan

# Sanitize input parameters
if ($KeyVaultName -and ($KeyVaultName -match "\s")) {
    Write-Host "⚠ Warning: KeyVaultName parameter contained spaces or invalid characters. Resetting to auto-detect." -ForegroundColor Yellow
    $KeyVaultName = ""
}

# Generate encryption key if not provided (only used if Key Vault is skipped)
if ($EncryptionKey) {
    # Clean up key if it contains comments or whitespace
    $EncryptionKey = $EncryptionKey -replace '\s*#.*$', '' -replace '\s+', ''
}

if (-not $EncryptionKey) {
    Write-Host "⚠ Generating encryption key..." -ForegroundColor Yellow
    $EncryptionKey = python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
    Write-Host "  → Key generated (for fallback encryption)" -ForegroundColor Green
}

# Variables for Key Vault
$KeyVaultUrl = $null
$UserAssignedIdentityId = $null
$UserAssignedIdentityClientId = $null
$UserAssignedIdentityPrincipalId = $null

# Get subscription ID early (needed for various resource IDs)
$subscriptionId = az account show --query id -o tsv

# 1. Create Resource Group (idempotent)
Write-Host "`n✓ Checking resource group..." -ForegroundColor Green
$rgExists = az group exists --name $ResourceGroup
if ($rgExists -eq "true") {
    Write-Host "  → Resource group already exists"
}
else {
    Write-Host "  → Creating resource group..."
    az group create --name $ResourceGroup --location $Location --output table
    Start-Sleep -Seconds 2  # Wait for resource group to propagate
    Write-Host "  ✓ Resource group created" -ForegroundColor Green
}

# 1.5 Create User-Assigned Managed Identity (required for ACR pulls and Key Vault)
Write-Host "`n✓ Checking User-Assigned Managed Identity..." -ForegroundColor Green
$IdentityName = "id-$ContainerAppName"

$identityExists = $false
try {
    $identityCheck = az identity show --name $IdentityName --resource-group $ResourceGroup 2>$null
    if ($identityCheck) {
        $identityExists = $true
    }
}
catch {
    # Identity doesn't exist
}

if ($identityExists) {
    Write-Host "  → Managed Identity already exists: $IdentityName"
}
else {
    Write-Host "  → Creating User-Assigned Managed Identity..."
    az identity create `
        --name $IdentityName `
        --resource-group $ResourceGroup `
        --location $Location `
        --output table
    
    if ($LASTEXITCODE -ne 0) {
        Write-Host "  ✗ Failed to create Managed Identity (required for image pulls)." -ForegroundColor Red
        exit 1
    }

    Write-Host "  → Waiting for identity to propagate..."
    Start-Sleep -Seconds 10
    Write-Host "  ✓ Managed Identity created" -ForegroundColor Green
}

# Get identity details (always used for registry auth; also for Key Vault if enabled)
$UserAssignedIdentityId = az identity show --name $IdentityName --resource-group $ResourceGroup --query id -o tsv
$UserAssignedIdentityClientId = az identity show --name $IdentityName --resource-group $ResourceGroup --query clientId -o tsv
$UserAssignedIdentityPrincipalId = az identity show --name $IdentityName --resource-group $ResourceGroup --query principalId -o tsv
Write-Host "  → Identity Principal ID: $UserAssignedIdentityPrincipalId"

# 1.55 Create Virtual Network and Subnets for Private Link (if not skipping)
$VNetId = $null
$SubnetContainerAppsId = $null
$SubnetPrivateEndpointsId = $null

if (-not $SkipPrivateLink -and -not $SkipAzureSql) {
    Write-Host "`n✓ Checking Virtual Network for Private Link..." -ForegroundColor Green
    
    $vnetExists = $false
    try {
        $vnetCheck = az network vnet show --name $VNetName --resource-group $ResourceGroup 2>$null
        if ($vnetCheck) {
            $vnetExists = $true
        }
    }
    catch {
        # VNet doesn't exist
    }
    
    if ($vnetExists) {
        Write-Host "  → Virtual Network already exists: $VNetName"
        $VNetId = az network vnet show --name $VNetName --resource-group $ResourceGroup --query id -o tsv
    }
    else {
        Write-Host "  → Creating Virtual Network: $VNetName..."
        az network vnet create `
            --name $VNetName `
            --resource-group $ResourceGroup `
            --location $Location `
            --address-prefix $VNetAddressPrefix `
            --output table
        
        if ($LASTEXITCODE -ne 0) {
            Write-Host "  ⚠ Failed to create Virtual Network - falling back to public network" -ForegroundColor Yellow
            $SkipPrivateLink = $true
        }
        else {
            $VNetId = az network vnet show --name $VNetName --resource-group $ResourceGroup --query id -o tsv
            Write-Host "  ✓ Virtual Network created" -ForegroundColor Green
        }
    }
    
    if (-not $SkipPrivateLink) {
        # Create/check subnet for Container Apps Environment
        Write-Host "  → Checking subnet for Container Apps: $SubnetContainerApps..."
        $subnetCAExists = $false
        try {
            $subnetCheck = az network vnet subnet show --vnet-name $VNetName --name $SubnetContainerApps --resource-group $ResourceGroup 2>$null
            if ($subnetCheck) {
                $subnetCAExists = $true
            }
        }
        catch { }
        
        if ($subnetCAExists) {
            Write-Host "  → Container Apps subnet already exists"
            $SubnetContainerAppsId = az network vnet subnet show --vnet-name $VNetName --name $SubnetContainerApps --resource-group $ResourceGroup --query id -o tsv
        }
        else {
            Write-Host "  → Creating subnet for Container Apps..."
            # Container Apps requires a /23 or larger subnet with delegation
            az network vnet subnet create `
                --name $SubnetContainerApps `
                --resource-group $ResourceGroup `
                --vnet-name $VNetName `
                --address-prefix "10.0.0.0/23" `
                --delegations "Microsoft.App/environments" `
                --output table
            
            if ($LASTEXITCODE -eq 0) {
                $SubnetContainerAppsId = az network vnet subnet show --vnet-name $VNetName --name $SubnetContainerApps --resource-group $ResourceGroup --query id -o tsv
                Write-Host "  ✓ Container Apps subnet created" -ForegroundColor Green
            }
            else {
                Write-Host "  ⚠ Failed to create Container Apps subnet" -ForegroundColor Yellow
            }
        }
        
        # Create/check subnet for Private Endpoints
        Write-Host "  → Checking subnet for Private Endpoints: $SubnetPrivateEndpoints..."
        $subnetPEExists = $false
        try {
            $subnetPECheck = az network vnet subnet show --vnet-name $VNetName --name $SubnetPrivateEndpoints --resource-group $ResourceGroup 2>$null
            if ($subnetPECheck) {
                $subnetPEExists = $true
            }
        }
        catch { }
        
        if ($subnetPEExists) {
            Write-Host "  → Private Endpoints subnet already exists"
            $SubnetPrivateEndpointsId = az network vnet subnet show --vnet-name $VNetName --name $SubnetPrivateEndpoints --resource-group $ResourceGroup --query id -o tsv
        }
        else {
            Write-Host "  → Creating subnet for Private Endpoints..."
            az network vnet subnet create `
                --name $SubnetPrivateEndpoints `
                --resource-group $ResourceGroup `
                --vnet-name $VNetName `
                --address-prefix "10.0.2.0/24" `
                --output table
            
            if ($LASTEXITCODE -eq 0) {
                $SubnetPrivateEndpointsId = az network vnet subnet show --vnet-name $VNetName --name $SubnetPrivateEndpoints --resource-group $ResourceGroup --query id -o tsv
                Write-Host "  ✓ Private Endpoints subnet created" -ForegroundColor Green
            }
            else {
                Write-Host "  ⚠ Failed to create Private Endpoints subnet" -ForegroundColor Yellow
            }
        }
    }
}

# 1.6 Create Azure Key Vault (for secure secret storage)
if (-not $SkipKeyVault) {
    Write-Host "`n✓ Checking Azure Key Vault..." -ForegroundColor Green
    
    # Try to find existing Key Vault or generate name
    if (-not $KeyVaultName) {
        try {
            $KeyVaultName = az keyvault list --resource-group $ResourceGroup --query "[0].name" -o tsv 2>$null
        }
        catch {
            # No Key Vault exists
        }
    }
    
    if ($KeyVaultName) {
        Write-Host "  → Using existing Key Vault: $KeyVaultName"
    }
    else {
        Write-Host "  → Creating Azure Key Vault..."
        # Generate unique Key Vault name (3-24 chars, alphanumeric and hyphens)
        $KeyVaultName = "kv-admecp-$(Get-Random -Maximum 99999)"
        
        az keyvault create `
            --name $KeyVaultName `
            --resource-group $ResourceGroup `
            --location $Location `
            --enable-rbac-authorization true `
            --output table
        
        if ($LASTEXITCODE -ne 0) {
            Write-Host "  ⚠ Failed to create Key Vault - falling back to local encryption" -ForegroundColor Yellow
            $SkipKeyVault = $true
            $KeyVaultName = $null
        }
        else {
            Write-Host "  → Waiting for Key Vault to be ready..."
            Start-Sleep -Seconds 5
            Write-Host "  ✓ Key Vault created: $KeyVaultName" -ForegroundColor Green
        }
    }
    
    if ($KeyVaultName -and -not $SkipKeyVault) {
        $KeyVaultUrl = az keyvault show --name $KeyVaultName --query properties.vaultUri -o tsv
        Write-Host "  → Key Vault URL: $KeyVaultUrl"
        
        # Assign Key Vault Secrets Officer role to Managed Identity
        Write-Host "`n✓ Configuring Key Vault access for Managed Identity..." -ForegroundColor Green
        $subscriptionId = az account show --query id -o tsv
        $kvScope = "/subscriptions/$subscriptionId/resourceGroups/$ResourceGroup/providers/Microsoft.KeyVault/vaults/$KeyVaultName"
        
        # Check if role assignment already exists
        $roleAssigned = $false
        try {
            $existingRole = az role assignment list --assignee $UserAssignedIdentityPrincipalId --scope $kvScope --query "[?roleDefinitionName=='Key Vault Secrets Officer']" -o tsv 2>$null
            if ($existingRole) {
                $roleAssigned = $true
            }
        }
        catch {
            # Role not assigned
        }
        
        if ($roleAssigned) {
            Write-Host "  → Role assignment already exists"
        }
        else {
            Write-Host "  → Attempting to assign 'Key Vault Secrets Officer' role..."
            try {
                $assignmentOutput = az role assignment create `
                    --role "Key Vault Secrets Officer" `
                    --assignee-object-id $UserAssignedIdentityPrincipalId `
                    --assignee-principal-type ServicePrincipal `
                    --scope $kvScope `
                    --output json 2>&1
                
                if ($LASTEXITCODE -eq 0) {
                    Write-Host "  ✓ Key Vault access configured" -ForegroundColor Green
                }
                else {
                    Write-Host "  ⚠ Could not assign Key Vault role automatically" -ForegroundColor Yellow
                    Write-Host "     This requires Owner or User Access Administrator role" -ForegroundColor Gray
                    Write-Host "     The role can be assigned manually after deployment" -ForegroundColor Gray
                    
                    # Save role assignment command for manual execution
                    $manualRoleCmd = "az role assignment create --role `"Key Vault Secrets Officer`" --assignee-object-id $UserAssignedIdentityPrincipalId --assignee-principal-type ServicePrincipal --scope `"$kvScope`""
                }
            }
            catch {
                Write-Host "  ⚠ Could not assign Key Vault role: $_" -ForegroundColor Yellow
            }
        }
    }
}

# 1.7 Create Azure SQL Database (for production persistence)
$SqlServerFqdn = $null
$DatabaseUrl = $null

if (-not $SkipAzureSql) {
    Write-Host "`n✓ Checking Azure SQL Database..." -ForegroundColor Green
    
    # Try to find existing SQL Server or generate name
    if (-not $SqlServerName) {
        try {
            $SqlServerName = az sql server list --resource-group $ResourceGroup --query "[0].name" -o tsv 2>$null
        }
        catch {
            # No SQL Server exists
        }
    }
    
    if ($SqlServerName) {
        Write-Host "  → Using existing SQL Server: $SqlServerName"
        $SqlServerFqdn = az sql server show --name $SqlServerName --resource-group $ResourceGroup --query fullyQualifiedDomainName -o tsv
    }
    else {
        Write-Host "  → Creating Azure SQL Server..."
        # Generate unique SQL server name (3-63 chars, lowercase alphanumeric and hyphens)
        $SqlServerName = "sql-admecp-$(Get-Random -Maximum 99999)"
        
        # Create SQL Server with Azure AD-only authentication (no SQL admin password needed)
        $currentUserObjectId = az ad signed-in-user show --query id -o tsv
        $currentUserUpn = az ad signed-in-user show --query userPrincipalName -o tsv
        
        az sql server create `
            --name $SqlServerName `
            --resource-group $ResourceGroup `
            --location $Location `
            --enable-ad-only-auth `
            --external-admin-principal-type User `
            --external-admin-name $currentUserUpn `
            --external-admin-sid $currentUserObjectId `
            --output table
        
        if ($LASTEXITCODE -ne 0) {
            Write-Host "  ⚠ Failed to create SQL Server - falling back to SQLite" -ForegroundColor Yellow
            $SkipAzureSql = $true
            $SqlServerName = $null
        }
        else {
            Write-Host "  → Waiting for SQL Server to be ready..."
            Start-Sleep -Seconds 5
            
            $SqlServerFqdn = az sql server show --name $SqlServerName --resource-group $ResourceGroup --query fullyQualifiedDomainName -o tsv
            Write-Host "  ✓ SQL Server created: $SqlServerFqdn" -ForegroundColor Green
        }
    }
    
    if ($SqlServerName -and -not $SkipAzureSql) {
        # Configure network access based on Private Link setting
        if (-not $SkipPrivateLink -and $SubnetPrivateEndpointsId) {
            Write-Host "  → Configuring SQL Server for Private Link only (no public access)..."
            
            # Disable public network access
            az sql server update `
                --name $SqlServerName `
                --resource-group $ResourceGroup `
                --enable-public-network false `
                --output none 2>$null
            
            if ($LASTEXITCODE -eq 0) {
                Write-Host "  ✓ Public network access disabled on SQL Server" -ForegroundColor Green
            }
            else {
                Write-Host "  ⚠ Could not disable public network access" -ForegroundColor Yellow
            }
            
            # Create Private DNS Zone for SQL Server
            Write-Host "  → Checking Private DNS Zone for SQL Server..."
            $SqlDnsZoneName = "privatelink.database.windows.net"
            $dnsZoneExists = $false
            try {
                $dnsCheck = az network private-dns zone show --name $SqlDnsZoneName --resource-group $ResourceGroup 2>$null
                if ($dnsCheck) { $dnsZoneExists = $true }
            }
            catch { }
            
            if ($dnsZoneExists) {
                Write-Host "  → Private DNS Zone already exists: $SqlDnsZoneName"
            }
            else {
                Write-Host "  → Creating Private DNS Zone: $SqlDnsZoneName..."
                az network private-dns zone create `
                    --name $SqlDnsZoneName `
                    --resource-group $ResourceGroup `
                    --output table
                
                if ($LASTEXITCODE -eq 0) {
                    Write-Host "  ✓ Private DNS Zone created" -ForegroundColor Green
                }
            }
            
            # Link DNS Zone to VNet
            Write-Host "  → Checking VNet link for DNS Zone..."
            $dnsLinkName = "link-$VNetName"
            $dnsLinkExists = $false
            try {
                $linkCheck = az network private-dns link vnet show --zone-name $SqlDnsZoneName --name $dnsLinkName --resource-group $ResourceGroup 2>$null
                if ($linkCheck) { $dnsLinkExists = $true }
            }
            catch { }
            
            if ($dnsLinkExists) {
                Write-Host "  → VNet DNS link already exists"
            }
            else {
                Write-Host "  → Creating VNet link for DNS Zone..."
                az network private-dns link vnet create `
                    --zone-name $SqlDnsZoneName `
                    --name $dnsLinkName `
                    --resource-group $ResourceGroup `
                    --virtual-network $VNetName `
                    --registration-enabled false `
                    --output table
                
                if ($LASTEXITCODE -eq 0) {
                    Write-Host "  ✓ VNet DNS link created" -ForegroundColor Green
                }
            }
            
            # Create Private Endpoint for SQL Server
            Write-Host "  → Checking Private Endpoint for SQL Server..."
            $SqlPrivateEndpointName = "pe-sql-$SqlServerName"
            $peExists = $false
            try {
                $peCheck = az network private-endpoint show --name $SqlPrivateEndpointName --resource-group $ResourceGroup 2>$null
                if ($peCheck) { $peExists = $true }
            }
            catch { }
            
            if ($peExists) {
                Write-Host "  → Private Endpoint already exists: $SqlPrivateEndpointName"
            }
            else {
                Write-Host "  → Creating Private Endpoint for SQL Server..."
                $SqlServerResourceId = "/subscriptions/$subscriptionId/resourceGroups/$ResourceGroup/providers/Microsoft.Sql/servers/$SqlServerName"
                
                az network private-endpoint create `
                    --name $SqlPrivateEndpointName `
                    --resource-group $ResourceGroup `
                    --location $Location `
                    --vnet-name $VNetName `
                    --subnet $SubnetPrivateEndpoints `
                    --private-connection-resource-id $SqlServerResourceId `
                    --group-id sqlServer `
                    --connection-name "conn-$SqlServerName" `
                    --output table
                
                if ($LASTEXITCODE -eq 0) {
                    Write-Host "  ✓ Private Endpoint created" -ForegroundColor Green
                    
                    # Configure DNS record for the private endpoint
                    Write-Host "  → Creating DNS record for Private Endpoint..."
                    $peNicId = az network private-endpoint show --name $SqlPrivateEndpointName --resource-group $ResourceGroup --query "networkInterfaces[0].id" -o tsv
                    $peIpAddress = az network nic show --ids $peNicId --query "ipConfigurations[0].privateIPAddress" -o tsv
                    
                    # Create A record in Private DNS Zone
                    $dnsRecordExists = $false
                    try {
                        $recordCheck = az network private-dns record-set a show --zone-name $SqlDnsZoneName --name $SqlServerName --resource-group $ResourceGroup 2>$null
                        if ($recordCheck) { $dnsRecordExists = $true }
                    }
                    catch { }
                    
                    if (-not $dnsRecordExists) {
                        az network private-dns record-set a add-record `
                            --zone-name $SqlDnsZoneName `
                            --record-set-name $SqlServerName `
                            --resource-group $ResourceGroup `
                            --ipv4-address $peIpAddress `
                            --output none
                        
                        if ($LASTEXITCODE -eq 0) {
                            Write-Host "  ✓ DNS record created: $SqlServerName -> $peIpAddress" -ForegroundColor Green
                        }
                    }
                    else {
                        Write-Host "  → DNS record already exists"
                    }
                }
                else {
                    Write-Host "  ⚠ Failed to create Private Endpoint - ensure public access is available" -ForegroundColor Yellow
                    # Re-enable public access as fallback
                    az sql server update --name $SqlServerName --resource-group $ResourceGroup --enable-public-network true --output none 2>$null
                    $SkipPrivateLink = $true
                }
            }
        }
        else {
            # Allow Azure services to access SQL Server (public network)
            Write-Host "  → Configuring firewall to allow Azure services..."
            az sql server firewall-rule create `
                --server $SqlServerName `
                --resource-group $ResourceGroup `
                --name AllowAzureServices `
                --start-ip-address 0.0.0.0 `
                --end-ip-address 0.0.0.0 `
                --output none 2>$null
        }
        
        # Check/Create Database
        Write-Host "  → Checking database: $SqlDatabaseName..."
        $dbExists = $false
        try {
            $dbCheck = az sql db show --server $SqlServerName --resource-group $ResourceGroup --name $SqlDatabaseName 2>$null
            if ($dbCheck) { $dbExists = $true }
        }
        catch { }
        
        if ($dbExists) {
            Write-Host "  → Database already exists"
        }
        else {
            Write-Host "  → Creating database (Serverless tier)..."
            az sql db create `
                --server $SqlServerName `
                --resource-group $ResourceGroup `
                --name $SqlDatabaseName `
                --edition GeneralPurpose `
                --compute-model Serverless `
                --family Gen5 `
                --capacity 1 `
                --auto-pause-delay 60 `
                --min-capacity 0.5 `
                --output table
            
            if ($LASTEXITCODE -ne 0) {
                Write-Host "  ⚠ Failed to create database - falling back to SQLite" -ForegroundColor Yellow
                $SkipAzureSql = $true
            }
            else {
                Write-Host "  ✓ Database created: $SqlDatabaseName" -ForegroundColor Green
            }
        }
        
        # Build DATABASE_URL for the app
        if (-not $SkipAzureSql) {
            $DatabaseUrl = "mssql+pyodbc://@${SqlServerFqdn}:1433/${SqlDatabaseName}?driver=ODBC+Driver+18+for+SQL+Server&Encrypt=yes&TrustServerCertificate=no"
            Write-Host "  → Database URL: $DatabaseUrl"
            
            # Grant Managed Identity access to SQL Database
            Write-Host "`n✓ Configuring SQL Database access for Managed Identity..." -ForegroundColor Green
            Write-Host "  → Creating database user for Managed Identity..."
            Write-Host ""
            Write-Host "  ⚠ IMPORTANT: Run this SQL command in Azure Portal SQL Query Editor" -ForegroundColor Yellow
            Write-Host "     (or Azure Data Studio connected with your Azure AD account):" -ForegroundColor Yellow
            Write-Host ""
            $IdentityName = "id-$ContainerAppName"
            $sqlCmd = @"
-- Run this in database: $SqlDatabaseName
CREATE USER [$IdentityName] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [$IdentityName];
ALTER ROLE db_datawriter ADD MEMBER [$IdentityName];
ALTER ROLE db_ddladmin ADD MEMBER [$IdentityName];
"@
            Write-Host "  $sqlCmd" -ForegroundColor Cyan
            Write-Host ""
            
            # Save SQL command for later
            $sqlSetupPath = ".azure/sql-setup.sql"
            $sqlCmd | Out-File -FilePath $sqlSetupPath -Force
            Write-Host "  → SQL setup script saved to: $sqlSetupPath" -ForegroundColor Gray
        }
    }
}

if ($SkipAzureSql) {
    Write-Host "`n⚠ Using SQLite database (local/container storage)" -ForegroundColor Yellow
}

# 2. Create or get Azure Container Registry
Write-Host "`n✓ Checking Azure Container Registry..." -ForegroundColor Green
$AcrName = $null
try {
    $AcrName = az acr list --resource-group $ResourceGroup --query "[0].name" -o tsv 2>$null
}
catch {
    # Ignore error if no ACR exists
}

if ($AcrName) {
    Write-Host "  → Using existing ACR: $AcrName"
}
else {
    Write-Host "  → Creating Azure Container Registry..."
    # Generate unique ACR name (lowercase, alphanumeric only)
    $AcrName = "acradmecp$(Get-Random -Maximum 999999)"
    
    Write-Host "  → ACR Name: $AcrName"
    az acr create `
        --resource-group $ResourceGroup `
        --name $AcrName `
        --sku Basic `
        --admin-enabled true `
        --location $Location `
        --output table
    
    if ($LASTEXITCODE -ne 0) {
        Write-Host "  ✗ Failed to create ACR" -ForegroundColor Red
        exit 1
    }
    
    Write-Host "  → Waiting for ACR to be ready..."
    Start-Sleep -Seconds 10
    Write-Host "  ✓ ACR created: $AcrName" -ForegroundColor Green
}

# Grant AcrPull to the user-assigned identity for image pulls
if ($UserAssignedIdentityPrincipalId) {
    Write-Host "  → Ensuring Managed Identity has AcrPull on $AcrName..."
    $acrScope = az acr show --name $AcrName --query id -o tsv
    try {
        az role assignment create `
            --role "AcrPull" `
            --assignee-object-id $UserAssignedIdentityPrincipalId `
            --assignee-principal-type ServicePrincipal `
            --scope $acrScope `
            --only-show-errors | Out-Null
        Write-Host "  ✓ AcrPull assigned" -ForegroundColor Green
    }
    catch {
        Write-Host "  ⚠ Could not assign AcrPull (requires Owner/User Access Administrator)" -ForegroundColor Yellow
    }
}

# 3. Create Storage Account for SQLite persistence
Write-Host "`n✓ Checking Storage Account for database persistence..." -ForegroundColor Green
$StorageAccountName = $null
$StorageEnabled = $false
$StorageUsingIdentity = $false

try {
    $StorageAccountName = az storage account list --resource-group $ResourceGroup --query "[0].name" -o tsv 2>$null
}
catch {
    # Ignore error if no storage account exists
}

if ($StorageAccountName) {
    Write-Host "  → Using existing Storage Account: $StorageAccountName"
}
else {
    Write-Host "  → Creating Storage Account..."
    # Generate unique storage account name (lowercase, alphanumeric only, max 24 chars)
    $StorageAccountName = "stadmecp$(Get-Random -Maximum 999999)"
    
    az storage account create `
        --name $StorageAccountName `
        --resource-group $ResourceGroup `
        --location $Location `
        --sku Standard_LRS `
        --kind StorageV2 `
        --allow-shared-key-access true `
        --output table 2>$null
    
    if ($LASTEXITCODE -ne 0) {
        Write-Host "  ⚠ Failed to create Storage Account (may be blocked by policy)" -ForegroundColor Yellow
        $StorageAccountName = $null
    }
    else {
        Write-Host "  → Waiting for Storage Account to be ready..."
        Start-Sleep -Seconds 5
        Write-Host "  ✓ Storage Account created: $StorageAccountName" -ForegroundColor Green
    }
}

# 4. Create File Share for SQLite database
$FileShareName = "controlplane-data"
$StorageKey = $null

if ($StorageAccountName) {
    Write-Host "`n✓ Checking File Share for SQLite database..." -ForegroundColor Green
    
    # First try with storage key
    try {
        $StorageKey = az storage account keys list --resource-group $ResourceGroup --account-name $StorageAccountName --query "[0].value" -o tsv 2>$null
        
        if ($StorageKey) {
            $shareExists = az storage share exists --name $FileShareName --account-name $StorageAccountName --account-key $StorageKey --query "exists" -o tsv 2>$null
            if ($shareExists -eq "true") {
                Write-Host "  → File Share already exists: $FileShareName"
                $StorageEnabled = $true
            }
            else {
                Write-Host "  → Creating File Share..."
                az storage share create `
                    --name $FileShareName `
                    --account-name $StorageAccountName `
                    --account-key $StorageKey `
                    --quota 1 `
                    --output table 2>$null
                
                if ($LASTEXITCODE -eq 0) {
                    Write-Host "  ✓ File Share created: $FileShareName" -ForegroundColor Green
                    $StorageEnabled = $true
                }
            }
        }
    }
    catch {
        Write-Host "  → Storage key access not available, will try Managed Identity" -ForegroundColor Yellow
    }
    
    # If key-based access failed but we have Managed Identity, set up identity-based access
    if (-not $StorageEnabled -and $UserAssignedIdentityPrincipalId) {
        Write-Host "  → Setting up Managed Identity access for storage..." -ForegroundColor Yellow
        
        $storageScope = "/subscriptions/$subscriptionId/resourceGroups/$ResourceGroup/providers/Microsoft.Storage/storageAccounts/$StorageAccountName"
        
        # Assign Storage File Data SMB Share Contributor role
        Write-Host "  → Assigning 'Storage File Data SMB Share Contributor' role..."
        try {
            az role assignment create `
                --role "Storage File Data SMB Share Contributor" `
                --assignee-object-id $UserAssignedIdentityPrincipalId `
                --assignee-principal-type ServicePrincipal `
                --scope $storageScope `
                --output json 2>&1 | Out-Null
            
            if ($LASTEXITCODE -eq 0) {
                Write-Host "  ✓ Storage role assigned to Managed Identity" -ForegroundColor Green
                $StorageUsingIdentity = $true
            }
        }
        catch {
            Write-Host "  ⚠ Could not assign storage role (requires Owner permissions)" -ForegroundColor Yellow
        }
        
        # Create file share using Azure CLI with login credentials
        Write-Host "  → Creating File Share using Azure AD auth..."
        az storage share create `
            --name $FileShareName `
            --account-name $StorageAccountName `
            --auth-mode login `
            --quota 1 `
            --output table 2>$null
        
        if ($LASTEXITCODE -eq 0) {
            Write-Host "  ✓ File Share created with identity access" -ForegroundColor Green
            $StorageEnabled = $true
        }
        else {
            Write-Host "  ⚠ Could not create file share" -ForegroundColor Yellow
        }
    }
}

if (-not $StorageEnabled) {
    Write-Host "`n⚠ Storage not available" -ForegroundColor Yellow
    Write-Host "  → App will run without persistent storage (data in container)" -ForegroundColor Yellow
    Write-Host "  → Database will be recreated on each deployment" -ForegroundColor Gray
}

# 5. Build and push Docker image
Write-Host "`n✓ Cleaning caches before build..." -ForegroundColor Green

# Remove Python cache folders
Get-ChildItem -Path . -Directory -Recurse -Filter "__pycache__" -ErrorAction SilentlyContinue | Remove-Item -Recurse -Force -ErrorAction SilentlyContinue
Get-ChildItem -Path . -Directory -Recurse -Filter ".pytest_cache" -ErrorAction SilentlyContinue | Remove-Item -Recurse -Force -ErrorAction SilentlyContinue

# Remove Streamlit cache
if (Test-Path ".streamlit") {
    Remove-Item -Path ".streamlit" -Recurse -Force -ErrorAction SilentlyContinue
}

# Remove any .pyc files
Get-ChildItem -Path . -Recurse -Filter "*.pyc" -ErrorAction SilentlyContinue | Remove-Item -Force -ErrorAction SilentlyContinue

Write-Host "  ✓ Caches cleaned" -ForegroundColor Green

Write-Host "`n✓ Building and pushing Docker image (no cache)..." -ForegroundColor Green
$ImageTag = Get-Date -Format "yyyyMMdd-HHmmss"
$BuildId = [guid]::NewGuid().ToString().Substring(0, 8)
az acr build `
    --registry $AcrName `
    --image "adme-control-plane:latest" `
    --image "adme-control-plane:$ImageTag" `
    --file Dockerfile `
    --build-arg CACHE_BUST=$BuildId `
    . `
    --output table

Write-Host "  ✓ Image pushed: adme-control-plane:latest" -ForegroundColor Green

# 4. Get ACR login server (identity will be used for auth)
Write-Host "`n✓ Getting ACR login server..." -ForegroundColor Green
$AcrServer = az acr show --name $AcrName --query loginServer -o tsv

# 5. Create Container Apps Environment (idempotent)
Write-Host "`n✓ Checking Container Apps Environment..." -ForegroundColor Green
$envExists = $false
$envIsVnetIntegrated = $false
try {
    $envCheck = az containerapp env show --name $ContainerAppEnv --resource-group $ResourceGroup 2>$null
    if ($envCheck) {
        $envExists = $true
        # Check if environment is already VNet integrated
        $envVnet = az containerapp env show --name $ContainerAppEnv --resource-group $ResourceGroup --query "properties.vnetConfiguration.infrastructureSubnetId" -o tsv 2>$null
        if ($envVnet) {
            $envIsVnetIntegrated = $true
        }
    }
}
catch {
    # Environment doesn't exist
}

if ($envExists) {
    Write-Host "  → Container Apps Environment already exists"
    if ($envIsVnetIntegrated) {
        Write-Host "  → Environment is VNet integrated" -ForegroundColor Green
    }
    elseif (-not $SkipPrivateLink -and $SubnetContainerAppsId) {
        Write-Host "  ⚠ Warning: Existing environment is NOT VNet integrated." -ForegroundColor Yellow
        Write-Host "    To use Private Link, delete the existing environment and re-run deployment." -ForegroundColor Yellow
        Write-Host "    Command: az containerapp env delete --name $ContainerAppEnv --resource-group $ResourceGroup --yes" -ForegroundColor Gray
    }
}
else {
    # Create new environment - with or without VNet integration
    if (-not $SkipPrivateLink -and $SubnetContainerAppsId) {
        Write-Host "  → Creating Container Apps Environment with VNet integration (this may take 5-7 minutes)..."
        az containerapp env create `
            --name $ContainerAppEnv `
            --resource-group $ResourceGroup `
            --location $Location `
            --infrastructure-subnet-resource-id $SubnetContainerAppsId `
            --internal-only false `
            --output table
    }
    else {
        Write-Host "  → Creating Container Apps Environment (this may take 2-3 minutes)..."
        az containerapp env create `
            --name $ContainerAppEnv `
            --resource-group $ResourceGroup `
            --location $Location `
            --output table
    }
    
    if ($LASTEXITCODE -ne 0) {
        Write-Host "  ✗ Failed to create Container Apps Environment" -ForegroundColor Red
        exit 1
    }
    
    Write-Host "  ✓ Environment created" -ForegroundColor Green
}

# 7. Add Azure Files storage to Container Apps Environment (if storage is available)
$StorageMountName = "sqlitedata"

if ($StorageEnabled) {
    Write-Host "`n✓ Configuring Azure Files storage mount..." -ForegroundColor Green
    
    # Check if storage already configured
    $storageConfigured = $false
    try {
        $storageCheck = az containerapp env storage show --name $StorageMountName --resource-group $ResourceGroup --environment $ContainerAppEnv 2>$null
        if ($storageCheck) {
            $storageConfigured = $true
        }
    }
    catch {
        # Storage not configured
    }

    if ($storageConfigured) {
        Write-Host "  → Storage mount already configured"
    }
    else {
        Write-Host "  → Adding Azure Files storage to environment..."
        
        if ($StorageKey -and -not $StorageUsingIdentity) {
            # Use storage key authentication
            Write-Host "  → Using storage key authentication"
            az containerapp env storage set `
                --name $ContainerAppEnv `
                --resource-group $ResourceGroup `
                --storage-name $StorageMountName `
                --azure-file-account-name $StorageAccountName `
                --azure-file-account-key $StorageKey `
                --azure-file-share-name $FileShareName `
                --access-mode ReadWrite `
                --output table
        }
        else {
            # Use identity-based authentication (SMB)
            Write-Host "  → Using Managed Identity authentication"
            # Note: Container Apps environment storage with identity requires the storage account resource ID
            $storageResourceId = "/subscriptions/$subscriptionId/resourceGroups/$ResourceGroup/providers/Microsoft.Storage/storageAccounts/$StorageAccountName"
            
            az containerapp env storage set `
                --name $ContainerAppEnv `
                --resource-group $ResourceGroup `
                --storage-name $StorageMountName `
                --azure-file-account-name $StorageAccountName `
                --azure-file-share-name $FileShareName `
                --access-mode ReadWrite `
                --output table 2>$null
            
            # If that fails, we may need to use key-based with identity fallback
            if ($LASTEXITCODE -ne 0) {
                Write-Host "  ⚠ Identity-based storage mount not supported, trying alternative..." -ForegroundColor Yellow
            }
        }
        
        if ($LASTEXITCODE -ne 0) {
            Write-Host "  ⚠ Failed to configure storage mount - continuing without persistence" -ForegroundColor Yellow
            $StorageEnabled = $false
        }
        else {
            Write-Host "  ✓ Storage mount configured" -ForegroundColor Green
        }
    }
}
else {
    Write-Host "`n⚠ Skipping storage mount (storage not available)" -ForegroundColor Yellow
}

# 8. Deploy or Update Container App
Write-Host "`n✓ Deploying Container App..." -ForegroundColor Green
$appExists = $false
try {
    $appCheck = az containerapp show --name $ContainerAppName --resource-group $ResourceGroup 2>$null
    if ($appCheck) {
        $appExists = $true
    }
}
catch {
    # App doesn't exist
}

# Check for Key Vault setup
$useKeyVault = (-not $SkipKeyVault -and $UserAssignedIdentityId)

# Use template-based YAML generation (more reliable than string building)
$templatePath = ".azure/containerapp.template.yaml"
$yamlPath = ".azure/containerapp.yaml"

if (-not (Test-Path $templatePath)) {
    Write-Host "  ✗ Template file not found: $templatePath" -ForegroundColor Red
    exit 1
}

# Read template
$yamlContent = Get-Content $templatePath -Raw

# Replace placeholders (using PLACEHOLDER_ prefix to avoid YAML parsing issues)
$yamlContent = $yamlContent -replace 'PLACEHOLDER_LOCATION', $Location
$yamlContent = $yamlContent -replace 'PLACEHOLDER_APP_NAME', $ContainerAppName
$yamlContent = $yamlContent -replace 'PLACEHOLDER_RESOURCE_GROUP', $ResourceGroup
$yamlContent = $yamlContent -replace 'PLACEHOLDER_IDENTITY_ID', $UserAssignedIdentityId
$yamlContent = $yamlContent -replace 'PLACEHOLDER_ENVIRONMENT_ID', "/subscriptions/$subscriptionId/resourceGroups/$ResourceGroup/providers/Microsoft.App/managedEnvironments/$ContainerAppEnv"
$yamlContent = $yamlContent -replace 'PLACEHOLDER_ACR_SERVER', $AcrServer
$yamlContent = $yamlContent -replace 'PLACEHOLDER_IMAGE', "${AcrServer}/adme-control-plane:latest"
$yamlContent = $yamlContent -replace 'PLACEHOLDER_ENCRYPTION_KEY', $EncryptionKey
$yamlContent = $yamlContent -replace 'PLACEHOLDER_LOG_LEVEL', $LogLevel
$yamlContent = $yamlContent -replace 'PLACEHOLDER_KEYVAULT_URL', $(if ($useKeyVault) { $KeyVaultUrl } else { '' })
$yamlContent = $yamlContent -replace 'PLACEHOLDER_IDENTITY_CLIENT_ID', $(if ($useKeyVault -or $DatabaseUrl) { $UserAssignedIdentityClientId } else { '' })
$yamlContent = $yamlContent -replace 'PLACEHOLDER_DATABASE_PATH', $(if ($StorageEnabled) { '/mnt/data/control_plane.db' } else { '/app/data/control_plane.db' })
$yamlContent = $yamlContent -replace 'PLACEHOLDER_DATABASE_URL', $(if ($DatabaseUrl) { $DatabaseUrl } else { '' })

# If storage not enabled, remove volume sections
if (-not $StorageEnabled) {
    Write-Host "  → Deploying without persistent storage$(if ($useKeyVault) { ' (with Key Vault)' })..." -ForegroundColor Yellow
    # Remove volumeMounts section
    $yamlContent = $yamlContent -replace '(?ms)        volumeMounts:\r?\n          - volumeName: sqlitedata\r?\n            mountPath: /mnt/data\r?\n', ''
    # Remove volumes section
    $yamlContent = $yamlContent -replace '(?ms)    volumes:\r?\n      - name: sqlitedata\r?\n        storageType: AzureFile\r?\n        storageName: sqlitedata\r?\n', ''
}
else {
    Write-Host "  → Deploying with persistent storage$(if ($useKeyVault) { ' and Key Vault' })..."
}

# Write YAML with UTF8 without BOM
[System.IO.File]::WriteAllText((Join-Path $PWD $yamlPath), $yamlContent, [System.Text.UTF8Encoding]::new($false))

# Debug: Show generated YAML
Write-Host "`n  Generated YAML:" -ForegroundColor Gray
Write-Host "  ─────────────────────────────────────" -ForegroundColor Gray
$yamlContent.Split("`n") | ForEach-Object { Write-Host "  $_" -ForegroundColor DarkGray }
Write-Host "  ─────────────────────────────────────" -ForegroundColor Gray

if ($appExists) {
    # Update existing app - force new revision with unique suffix
    $revisionSuffix = Get-Date -Format "yyMMddHHmmss"
    Write-Host "  → Updating existing Container App (revision suffix: $revisionSuffix)..." -ForegroundColor Yellow
    
    # Update with revision suffix to force a new revision even with same image tag
    az containerapp update `
        --name $ContainerAppName `
        --resource-group $ResourceGroup `
        --image "${AcrServer}/adme-control-plane:latest" `
        --revision-suffix $revisionSuffix `
        --output table
}
else {
    # Create new app
    az containerapp create `
        --name $ContainerAppName `
        --resource-group $ResourceGroup `
        --yaml $yamlPath `
        --output table
}

if ($LASTEXITCODE -ne 0) {
    Write-Host "  ✗ Failed to deploy Container App" -ForegroundColor Red
    exit 1
}

Write-Host "  ✓ Container App deployed" -ForegroundColor Green

# 9. Get app URL
Write-Host "`n=========================================" -ForegroundColor Cyan
Write-Host "✓ Deployment Complete!" -ForegroundColor Green
Write-Host "=========================================" -ForegroundColor Cyan
$AppUrl = az containerapp show --name $ContainerAppName --resource-group $ResourceGroup --query properties.configuration.ingress.fqdn -o tsv
Write-Host "App URL: https://$AppUrl" -ForegroundColor Yellow
Write-Host "=========================================" -ForegroundColor Cyan

if ($DatabaseUrl) {
    Write-Host "`n✓ Azure SQL Database enabled (Managed Identity auth)" -ForegroundColor Green
    Write-Host "  → Server: $SqlServerFqdn" -ForegroundColor Gray
    Write-Host "  → Database: $SqlDatabaseName" -ForegroundColor Gray
    Write-Host "  → Managed Identity: $IdentityName" -ForegroundColor Gray
    
    if (-not $SkipPrivateLink -and $SubnetPrivateEndpointsId) {
        Write-Host "  → Network: Private Link (VNet integrated)" -ForegroundColor Green
        Write-Host "  → Private Endpoint: pe-sql-$SqlServerName" -ForegroundColor Gray
        Write-Host "  → Public network access: Disabled" -ForegroundColor Green
    }
    else {
        Write-Host "  → Network: Public (with Azure services firewall rule)" -ForegroundColor Yellow
    }
    
    Write-Host ""
    Write-Host "  ⚠ REQUIRED: Grant database access to the Managed Identity" -ForegroundColor Yellow
    Write-Host "     Run the SQL script in: .azure/sql-setup.sql" -ForegroundColor Yellow
}
elseif ($StorageEnabled) {
    Write-Host "`n✓ SQLite database is persisted at: /mnt/data/control_plane.db" -ForegroundColor Green
    Write-Host "  → Mounted from Azure Files: $StorageAccountName/$FileShareName" -ForegroundColor Gray
}
else {
    Write-Host "`n⚠ SQLite database is in-container (not persisted across deployments)" -ForegroundColor Yellow
    Write-Host "  → For production persistence, run with Azure SQL (default) or -UseSqlite with storage" -ForegroundColor Gray
}

if (-not $SkipKeyVault -and $KeyVaultUrl) {
    Write-Host "`n✓ Azure Key Vault enabled for secure secret storage" -ForegroundColor Green
    Write-Host "  → Key Vault: $KeyVaultName" -ForegroundColor Gray
    Write-Host "  → URL: $KeyVaultUrl" -ForegroundColor Gray
    Write-Host "  → Managed Identity: $IdentityName" -ForegroundColor Gray
    
    # Check if manual role assignment is needed
    if ($manualRoleCmd) {
        Write-Host "`n⚠ Key Vault Role Assignment" -ForegroundColor Yellow
        Write-Host "  You need Owner or User Access Administrator role to assign roles." -ForegroundColor Yellow
        Write-Host "  Run this command (as Owner/Admin) to complete the setup:" -ForegroundColor Yellow
        Write-Host "  $manualRoleCmd" -ForegroundColor Cyan
    }
}
else {
    Write-Host "`n⚠ Using local encryption for secrets (Key Vault not configured)" -ForegroundColor Yellow
    Write-Host "  → To enable Key Vault, re-run without -SkipKeyVault flag" -ForegroundColor Gray
}

Write-Host "`nView logs:"
Write-Host "  az containerapp logs show --name $ContainerAppName --resource-group $ResourceGroup --follow" -ForegroundColor Gray

Write-Host "`nTo redeploy (just build and push):"
Write-Host "  .\deploy.ps1" -ForegroundColor Gray

# Save deployment info
$IdentityName = "id-$ContainerAppName"
$DeploymentInfo = @{
    ResourceGroup       = $ResourceGroup
    ContainerAppName    = $ContainerAppName
    AcrName             = $AcrName
    StorageAccountName  = $StorageAccountName
    StorageEnabled      = $StorageEnabled
    KeyVaultName        = $KeyVaultName
    KeyVaultUrl         = $KeyVaultUrl
    KeyVaultEnabled     = (-not $SkipKeyVault -and $KeyVaultUrl)
    SqlServerName       = $SqlServerName
    SqlServerFqdn       = $SqlServerFqdn
    SqlDatabaseName     = $SqlDatabaseName
    SqlEnabled          = (-not $SkipAzureSql -and $DatabaseUrl)
    DatabaseUrl         = $DatabaseUrl
    ManagedIdentityName = $IdentityName
    ManagedIdentityId   = $UserAssignedIdentityId
    AppUrl              = "https://$AppUrl"
    DeployedAt          = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    EncryptionKey       = $EncryptionKey
    DatabasePath        = if ($DatabaseUrl) { "Azure SQL" } elseif ($StorageEnabled) { "/mnt/data/control_plane.db" } else { "/app/data/control_plane.db" }
    PrivateLinkEnabled  = (-not $SkipPrivateLink -and $SubnetPrivateEndpointsId -ne $null)
    VNetName            = if (-not $SkipPrivateLink) { $VNetName } else { $null }
    SqlPrivateEndpoint  = if (-not $SkipPrivateLink -and $SqlServerName) { "pe-sql-$SqlServerName" } else { $null }
} | ConvertTo-Json

$DeploymentInfo | Out-File -FilePath ".azure/last-deployment.json" -Force
Write-Host "`n✓ Deployment info saved to .azure/last-deployment.json" -ForegroundColor Green