#!/usr/bin/env bash
# PANELS · Fase 0 · aprovisiona Postgres + Redis LOCALES (dev), reproduciendo
# la misma topología de roles/esquemas/ACLs que se usará en Coolify.
#
# Requiere: un Postgres corriendo en localhost:5432 accesible como `postgres`
# vía socket unix (auth peer, el default de un `apt install postgresql`), y
# un Redis en localhost:6379.
#
# Uso: ./db/provision/dev-local.sh
set -euo pipefail
cd "$(dirname "$0")"

PG_SUPERUSER_CMD="sudo -u postgres psql -v ON_ERROR_STOP=1"
PGHOST=127.0.0.1
PGPORT=5432
REDIS_HOST=127.0.0.1
REDIS_PORT=6379

gen_pw() { openssl rand -hex 24; }

PLATFORM_OWNER_PW=$(gen_pw); PLATFORM_APP_PW=$(gen_pw)
IAM_OWNER_PW=$(gen_pw);      IAM_APP_PW=$(gen_pw)
CORE_OWNER_PW=$(gen_pw);     CORE_APP_PW=$(gen_pw)
IAM_REDIS_PW=$(gen_pw);      CORE_REDIS_PW=$(gen_pw)

echo "== 1/5: roles =="
$PG_SUPERUSER_CMD \
  -v platform_owner_pw="${PLATFORM_OWNER_PW}" -v platform_app_pw="${PLATFORM_APP_PW}" \
  -v iam_owner_pw="${IAM_OWNER_PW}"           -v iam_app_pw="${IAM_APP_PW}" \
  -v core_owner_pw="${CORE_OWNER_PW}"         -v core_app_pw="${CORE_APP_PW}" \
  -f 01-roles.sql

echo "== 2/5: bases de datos =="
$PG_SUPERUSER_CMD -f 02-databases.sql

echo "== 3/5: privilegios panels_platform =="
$PG_SUPERUSER_CMD -d panels_platform -f 03-platform-database.sql

echo "== 4/5: esquemas + privilegios panels_product =="
$PG_SUPERUSER_CMD -d panels_product -f 04-product-database.sql

echo "== 5/5: Redis ACLs =="
REDIS_ADMIN_URL="redis://${REDIS_HOST}:${REDIS_PORT}" \
IAM_REDIS_PASSWORD="$IAM_REDIS_PW" \
CORE_REDIS_PASSWORD="$CORE_REDIS_PW" \
./05-redis-acl.sh

ENV_FILE="../../.env.dev-local"
cat > "$ENV_FILE" <<EOF
# Generado por db/provision/dev-local.sh — solo para desarrollo local. No commitear.
DATABASE_URL_PLATFORM=postgresql://panels_platform_app:${PLATFORM_APP_PW}@${PGHOST}:${PGPORT}/panels_platform
DATABASE_URL_PLATFORM_OWNER=postgresql://panels_platform_owner:${PLATFORM_OWNER_PW}@${PGHOST}:${PGPORT}/panels_platform
DATABASE_URL_IAM=postgresql://panels_iam_app:${IAM_APP_PW}@${PGHOST}:${PGPORT}/panels_product
DATABASE_URL_IAM_OWNER=postgresql://panels_iam_owner:${IAM_OWNER_PW}@${PGHOST}:${PGPORT}/panels_product
DATABASE_URL_CORE=postgresql://panels_core_app:${CORE_APP_PW}@${PGHOST}:${PGPORT}/panels_product
DATABASE_URL_CORE_OWNER=postgresql://panels_core_owner:${CORE_OWNER_PW}@${PGHOST}:${PGPORT}/panels_product
REDIS_URL_IAM=redis://panels_iam_redis:${IAM_REDIS_PW}@${REDIS_HOST}:${REDIS_PORT}
REDIS_URL_CORE=redis://panels_core_redis:${CORE_REDIS_PW}@${REDIS_HOST}:${REDIS_PORT}
EOF

echo ""
echo "Listo. Credenciales de desarrollo local escritas en $(cd "$(dirname "$ENV_FILE")" && pwd)/$(basename "$ENV_FILE")"