#!/usr/bin/env bash
# Teardown for the sh-mcp G16 / 0a spike kit (account 328440206208, us-east-1).
# Re-authored 2026-07-07 (the original /tmp copy was cleared). THROWAWAY kit only.
#
# Deletes: Cognito pool sh-mcp-0a-spike (+ its domain, app client, test users),
#          HTTP API sh-mcp-0a-spike-api, Lambda sh-mcp-0a-spike-probe (+ role + log group).
# Does NOT touch: the real sh-mcp-auth stack, or the Salesforce sh_mcp_0a objects
#          (Auth Provider / External/Named Credential / External Service) — delete those
#          by hand in the SF sandbox (speed-speed-957--shmcp) and prod (speed-speed-957).
#
# Run ONLY after the G16 verdict is recorded in project_sh_mcp memory.
# Usage:  bash docs/g16-spike-teardown.sh --yes
set -euo pipefail
R=us-east-1
POOL=us-east-1_GsDbGe0pa
DOMAIN=sh-mcp-0a-spike-19568
API=ex1v1x1hqc
FN=sh-mcp-0a-spike-probe
ROLE=sh-mcp-0a-spike-probe-role
LOG=/aws/lambda/sh-mcp-0a-spike-probe

if [[ "${1:-}" != "--yes" ]]; then
  echo "This DELETES the G16 spike kit (Cognito pool $POOL, API $API, Lambda $FN)."
  echo "Re-run with --yes to proceed. (Salesforce sh_mcp_0a objects are manual.)"
  exit 1
fi

echo "1/5 delete Cognito hosted-UI domain $DOMAIN"
aws cognito-idp delete-user-pool-domain --region $R --user-pool-id $POOL --domain "$DOMAIN" || true

echo "2/5 delete Cognito user pool $POOL (removes app client + test users)"
aws cognito-idp delete-user-pool --region $R --user-pool-id $POOL || true

echo "3/5 delete HTTP API $API"
aws apigatewayv2 delete-api --region $R --api-id $API || true

echo "4/5 delete Lambda $FN + log group $LOG"
aws lambda delete-function --region $R --function-name $FN || true
aws logs delete-log-group --region $R --log-group-name "$LOG" || true

echo "5/5 delete execution role $ROLE (detach inline/managed first)"
for P in $(aws iam list-attached-role-policies --role-name $ROLE --query 'AttachedPolicies[].PolicyArn' --output text 2>/dev/null || true); do
  aws iam detach-role-policy --role-name $ROLE --policy-arn "$P" || true
done
for P in $(aws iam list-role-policies --role-name $ROLE --query 'PolicyNames[]' --output text 2>/dev/null || true); do
  aws iam delete-role-policy --role-name $ROLE --policy-name "$P" || true
done
aws iam delete-role --role-name $ROLE || true

echo "Done. Remember to delete the Salesforce sh_mcp_0a objects manually in both orgs."