#!/bin/sh
# One-shot schema migration only. Validate TLS before reading a secret or composing a URL.
set -eu

case "${THT_SESSION_DB_SSLMODE:-}" in
  verify-ca|verify-full) ;;
  *)
    echo "THT_SESSION_DB_SSLMODE must be verify-ca or verify-full" >&2
    exit 2
    ;;
esac

require_env() {
  eval "value=\${$1:-}"
  if [ -z "$value" ]; then
    echo "missing required session migrator configuration" >&2
    exit 2
  fi
}

require_env THT_SESSION_DB_HOST
require_env THT_SESSION_DB_PORT
require_env THT_SESSION_DB_NAME
require_env THT_SESSION_MIGRATOR_USER
require_env THT_SESSION_MIGRATOR_PASSWORD_FILE
require_env THT_SESSION_DB_SSLROOTCERT

if [ ! -r "$THT_SESSION_MIGRATOR_PASSWORD_FILE" ]; then
  echo "session migrator credential is unavailable" >&2
  exit 2
fi
export PGPASSWORD="$(cat "$THT_SESSION_MIGRATOR_PASSWORD_FILE")"
if [ -z "$PGPASSWORD" ]; then
  echo "session migrator credential is unavailable" >&2
  exit 2
fi

exec "${THT_BIN:-/opt/venv/bin/tht}" session migrate --database-url \
  "postgresql+psycopg2://${THT_SESSION_MIGRATOR_USER}@${THT_SESSION_DB_HOST}:${THT_SESSION_DB_PORT}/${THT_SESSION_DB_NAME}?sslmode=${THT_SESSION_DB_SSLMODE}&sslrootcert=${THT_SESSION_DB_SSLROOTCERT}" \
  --json