#!/usr/bin/env bash
set -euo pipefail

OUTPUT_FILE="${1:-./ToE-lambda-output.xlsx}"
FUNCTION_NAME="uat-lambda-abacus-earnings-transfer"
BUCKET="uat-abacus-earnings-transfer"
TMPFILE=$(mktemp "${TMPDIR:-/tmp}/uat-response.XXXXXX")
trap 'rm -f "$TMPFILE"' EXIT

echo "==> Assuming accounting role..."
AWSUME_OUTPUT=$(awsume accounting-role -s 2>&1) || true
eval "$(echo "$AWSUME_OUTPUT" | grep '^export ')"

CALLER=$(aws sts get-caller-identity --query 'Arn' --output text 2>/dev/null)
echo "==> Authenticated as: ${CALLER}"
if [[ "$CALLER" != *"role"* ]]; then
  echo "ERROR: Expected accounting role but got: ${CALLER}"
  exit 1
fi

echo "==> Invoking ${FUNCTION_NAME}..."
aws lambda invoke \
  --function-name "$FUNCTION_NAME" \
  --payload '{}' \
  --cli-binary-format raw-in-base64-out \
  "$TMPFILE"

RESPONSE=$(cat "$TMPFILE")
echo "$RESPONSE"

OUTPUT_KEY=$(echo "$RESPONSE" | python3 -c "
import sys, json
data = json.load(sys.stdin)
status = data.get('status', '')
if status != 'OK':
    error = data.get('error', 'unknown error')
    print(f'Lambda returned status={status}: {error}', file=sys.stderr)
    sys.exit(1)
print(data['output_key'])
")

if [ -z "$OUTPUT_KEY" ]; then
  echo "ERROR: Could not extract output_key from response"
  exit 1
fi

echo "==> Downloading s3://${BUCKET}/${OUTPUT_KEY} -> ${OUTPUT_FILE}"
aws s3 cp "s3://${BUCKET}/${OUTPUT_KEY}" "$OUTPUT_FILE"

echo "==> Done: ${OUTPUT_FILE}"