#!/usr/bin/env bash
# PANELS · genera secretos de UN ambiente y, si hay superusuario, crea
# roles/bases/ACLs. No crea el servidor Postgres, Redis ni el bucket:
# esos se levantan en Coolify / Contabo; este script solo deja los accesos.
#
# Uso (solo imprimir bloque .env, sin tocar servidores):
#   PGHOST=pg.interno REDIS_HOST=redis.interno S3_BUCKET=panels-prod \
#     ./db/provision/create-accesses.sh
#
# Uso (crear roles en un Postgres/Redis ya levantados):
#   PGHOST=... PGUSER=postgres PGPASSWORD=... REDIS_ADMIN_URL=redis://:...@host:6379 \
#     ./db/provision/create-accesses.sh --apply --verify
#
# Flags:
#   --apply   corre 01-04 SQL + 05 Redis ACL con las claves generadas
#   --verify  corre verify-connectivity.sh al final (implica tener URLs)
#   --out FILE  escribe el bloque .env (FILE debe estar gitignored, ej. .env.prod.local)
set -euo pipefail
HERE="$(cd "$(dirname "$0")" && pwd)"
APPLY=0
VERIFY=0
OUT=""
while [[ $# -gt 0 ]]; do
  case "$1" in
    --apply) APPLY=1; shift ;;
    --verify) VERIFY=1; shift ;;
    --out) OUT="$2"; shift 2 ;;
    -h|--help) sed -n '2,20p' "$0"; exit 0 ;;
    *) echo "Flag desconocido: $1" >&2; exit 1 ;;
  esac
done

rand24() { openssl rand -hex 24; }
rand32() { openssl rand -hex 32; }

PGHOST="${PGHOST:-127.0.0.1}"
PGPORT="${PGPORT:-5432}"
REDIS_HOST="${REDIS_HOST:-127.0.0.1}"
REDIS_PORT="${REDIS_PORT:-6379}"
PGUSER="${PGUSER:-postgres}"

PLATFORM_OWNER_PASSWORD="${PLATFORM_OWNER_PASSWORD:-$(rand24)}"
PLATFORM_APP_PASSWORD="${PLATFORM_APP_PASSWORD:-$(rand24)}"
IAM_OWNER_PASSWORD="${IAM_OWNER_PASSWORD:-$(rand24)}"
IAM_APP_PASSWORD="${IAM_APP_PASSWORD:-$(rand24)}"
CORE_OWNER_PASSWORD="${CORE_OWNER_PASSWORD:-$(rand24)}"
CORE_APP_PASSWORD="${CORE_APP_PASSWORD:-$(rand24)}"
IAM_REDIS_PASSWORD="${IAM_REDIS_PASSWORD:-$(rand24)}"
CORE_REDIS_PASSWORD="${CORE_REDIS_PASSWORD:-$(rand24)}"
SESSION_SECRET="${SESSION_SECRET:-$(rand32)}"
DOCS_KEY="${DOCS_KEY:-$(rand32)}"

block() {
  cat <<EOF
# PANELS · secretos de un solo ambiente (no mezclar prod/staging/dev)
SESSION_SECRET=${SESSION_SECRET}
DOCS_KEY=${DOCS_KEY}

DATABASE_URL_PLATFORM=postgresql://panels_platform_app:${PLATFORM_APP_PASSWORD}@${PGHOST}:${PGPORT}/panels_platform
DATABASE_URL_PLATFORM_OWNER=postgresql://panels_platform_owner:${PLATFORM_OWNER_PASSWORD}@${PGHOST}:${PGPORT}/panels_platform
DATABASE_URL_IAM=postgresql://panels_iam_app:${IAM_APP_PASSWORD}@${PGHOST}:${PGPORT}/panels_product
DATABASE_URL_IAM_OWNER=postgresql://panels_iam_owner:${IAM_OWNER_PASSWORD}@${PGHOST}:${PGPORT}/panels_product
DATABASE_URL_CORE=postgresql://panels_core_app:${CORE_APP_PASSWORD}@${PGHOST}:${PGPORT}/panels_product
DATABASE_URL_CORE_OWNER=postgresql://panels_core_owner:${CORE_OWNER_PASSWORD}@${PGHOST}:${PGPORT}/panels_product

REDIS_URL_IAM=redis://panels_iam_redis:${IAM_REDIS_PASSWORD}@${REDIS_HOST}:${REDIS_PORT}
REDIS_URL_CORE=redis://panels_core_redis:${CORE_REDIS_PASSWORD}@${REDIS_HOST}:${REDIS_PORT}

# Contabo -- rellenar endpoint/keys del Object Storage de ESTE ambiente
S3_ENDPOINT=${S3_ENDPOINT:-}
S3_BUCKET=${S3_BUCKET:-}
S3_REGION=${S3_REGION:-usc1}
S3_ACCESS_KEY_ID=${S3_ACCESS_KEY_ID:-}
S3_SECRET_ACCESS_KEY=${S3_SECRET_ACCESS_KEY:-}

# Passwords sueltos (provision / compose local)
POSTGRES_SUPERUSER_PASSWORD=${PGPASSWORD:-}
PLATFORM_OWNER_PASSWORD=${PLATFORM_OWNER_PASSWORD}
PLATFORM_APP_PASSWORD=${PLATFORM_APP_PASSWORD}
IAM_OWNER_PASSWORD=${IAM_OWNER_PASSWORD}
IAM_APP_PASSWORD=${IAM_APP_PASSWORD}
CORE_OWNER_PASSWORD=${CORE_OWNER_PASSWORD}
CORE_APP_PASSWORD=${CORE_APP_PASSWORD}
IAM_REDIS_PASSWORD=${IAM_REDIS_PASSWORD}
CORE_REDIS_PASSWORD=${CORE_REDIS_PASSWORD}
EOF
}

if [[ "$APPLY" == "1" ]]; then
  : "${PGPASSWORD:?PGPASSWORD del superusuario es obligatorio con --apply}"
  SUPERUSER_URL="postgresql://${PGUSER}:${PGPASSWORD}@${PGHOST}:${PGPORT}/postgres"
  echo "== Aplicando roles/bases/esquemas en ${PGHOST}:${PGPORT} =="
  psql "$SUPERUSER_URL" \
    -v platform_owner_pw="$PLATFORM_OWNER_PASSWORD" -v platform_app_pw="$PLATFORM_APP_PASSWORD" \
    -v iam_owner_pw="$IAM_OWNER_PASSWORD" -v iam_app_pw="$IAM_APP_PASSWORD" \
    -v core_owner_pw="$CORE_OWNER_PASSWORD" -v core_app_pw="$CORE_APP_PASSWORD" \
    -f "$HERE/01-roles.sql"
  psql "$SUPERUSER_URL" -f "$HERE/02-databases.sql"
  psql "postgresql://${PGUSER}:${PGPASSWORD}@${PGHOST}:${PGPORT}/panels_platform" -f "$HERE/03-platform-database.sql"
  psql "postgresql://${PGUSER}:${PGPASSWORD}@${PGHOST}:${PGPORT}/panels_product" -f "$HERE/04-product-database.sql"
  if [[ -n "${REDIS_ADMIN_URL:-}" ]]; then
    echo "== Aplicando ACLs Redis =="
    REDIS_ADMIN_URL="$REDIS_ADMIN_URL" \
      IAM_REDIS_PASSWORD="$IAM_REDIS_PASSWORD" \
      CORE_REDIS_PASSWORD="$CORE_REDIS_PASSWORD" \
      "$HERE/05-redis-acl.sh"
  else
    echo "SKIP - REDIS_ADMIN_URL no definido; no se crearon usuarios ACL"
  fi
fi

ENV_TEXT="$(block)"
echo "$ENV_TEXT"
if [[ -n "$OUT" ]]; then
  umask 077
  printf '%s\n' "$ENV_TEXT" > "$OUT"
  echo "Escrito $OUT (permisos 600). No lo subas a git." >&2
fi

if [[ "$VERIFY" == "1" ]]; then
  echo "== Verificando conectividad ==" >&2
  tmp="$(mktemp)"
  umask 077
  printf '%s\n' "$ENV_TEXT" > "$tmp"
  set -a
  # shellcheck disable=SC1090
  source "$tmp"
  set +a
  rm -f "$tmp"
  "$HERE/verify-connectivity.sh"
fi