#!/usr/bin/env bash
set -euo pipefail

read_secret() {
  local name="$1"
  local path="${POSTGRES_SECRET_ROOT:-/run/secrets}/${name}"
  [[ -f "$path" && -r "$path" && -s "$path" ]] || {
    echo "PostgreSQL secret-file validation failed" >&2
    exit 78
  }
  local mode
  mode="$(stat -c '%a' "$path" 2>/dev/null || true)"
  [[ "$mode" == "400" || "$mode" == "600" ]] || {
    echo "PostgreSQL secret-file validation failed" >&2
    exit 78
  }
  [[ "$(stat -c '%u' "$path" 2>/dev/null || true)" == "${POSTGRES_SECRET_EXPECTED_UID:-${SECRET_EXPECTED_UID:?}}" ]] || {
    echo "PostgreSQL secret-file validation failed" >&2
    exit 78
  }
  [[ "$(stat -c '%g' "$path" 2>/dev/null || true)" == "${POSTGRES_SECRET_EXPECTED_GID:-${SECRET_EXPECTED_GID:?}}" ]] || {
    echo "PostgreSQL secret-file validation failed" >&2
    exit 78
  }
  local value
  value="$(tr -d '\r\n' < "$path")"
  [[ -n "$value" ]] || { echo "PostgreSQL secret-file validation failed" >&2; exit 78; }
  printf '%s' "$value"
}

HUB_PASSWORD="$(read_secret hub_database_password)"
CF_PASSWORD="$(read_secret contextforge_database_password)"

psql --username "$POSTGRES_USER" --dbname postgres --set=ON_ERROR_STOP=1 \
  --set=hub_password="$HUB_PASSWORD" --set=cf_password="$CF_PASSWORD" <<'SQL'
SELECT format('CREATE ROLE itworx_mcp_hub LOGIN PASSWORD %L', :'hub_password')
WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'itworx_mcp_hub')\gexec
SELECT format('CREATE ROLE contextforge LOGIN PASSWORD %L', :'cf_password')
WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'contextforge')\gexec
SELECT 'CREATE DATABASE itworx_mcp_hub OWNER itworx_mcp_hub'
WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'itworx_mcp_hub')\gexec
SELECT 'CREATE DATABASE contextforge OWNER contextforge'
WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'contextforge')\gexec
REVOKE ALL ON DATABASE itworx_mcp_hub FROM PUBLIC;
REVOKE ALL ON DATABASE contextforge FROM PUBLIC;
SQL