#!/usr/bin/env bash
# Provision an ISOLATED Postgres database for the Phase 5 exception matrix.
#
# Secrets are injected through the environment only (never stored in the repo):
#   SUDO_PASSWORD    password for `sudo -S` (required to create role/DB)
#   P5_DB_PASSWORD   password for the isolated role (required)
#   P5_DB_ROLE       role name        (default: kaotings_p5)
#   P5_DB            database name    (default: kaotings_p5)
#   P5_PGHOST        host:port        (default: 127.0.0.1:5432)
#
# Idempotent: drops and recreates the isolated role/database, applies the API
# migrations and seeds the plan policies + default voice, matching a fresh
# production schema. The production `kaotings` database is never touched.

set -euo pipefail

: "${SUDO_PASSWORD:?SUDO_PASSWORD must be set in the environment}"
: "${P5_DB_PASSWORD:?P5_DB_PASSWORD must be set in the environment}"
ROLE="${P5_DB_ROLE:-kaotings_p5}"
DB="${P5_DB:-kaotings_p5}"
PGHOST="${P5_PGHOST:-127.0.0.1:5432}"

API_DIR="$(cd "$(dirname "$0")/.." && pwd)"
PY="${P5_PYTHON:-python3}"

pg() { echo "$SUDO_PASSWORD" | sudo -S -p '' -u postgres psql "$@"; }

pg -c "DROP DATABASE IF EXISTS $DB;" -c "DROP ROLE IF EXISTS $ROLE;"
pg -c "CREATE ROLE $ROLE LOGIN PASSWORD '$P5_DB_PASSWORD';" -c "CREATE DATABASE $DB OWNER $ROLE;"
pg -d "$DB" -c "CREATE EXTENSION IF NOT EXISTS pgcrypto;"

export DATABASE_URL="postgresql://$ROLE:$P5_DB_PASSWORD@$PGHOST/$DB"
(cd "$API_DIR" && "$PY" -m app.migrate)

echo "isolated database ready: $DB (role $ROLE)"