#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PACKAGE_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
source "$SCRIPT_DIR/lib/common.sh"

PROJECT_ENV=""
SECRETS_ENV=""
APPROVAL_FILE=""
APPLY=0
while [ "$#" -gt 0 ]; do
  case "$1" in
    --project-env) PROJECT_ENV="$2"; shift 2 ;;
    --secrets-env) SECRETS_ENV="$2"; shift 2 ;;
    --approval-file) APPROVAL_FILE="$2"; shift 2 ;;
    --apply) APPLY=1; shift ;;
    *) die "unknown argument: $1" ;;
  esac
done

[ -n "$PROJECT_ENV" ] || die "--project-env is required"
[ -n "$SECRETS_ENV" ] || die "--secrets-env is required"
load_env_file "$PROJECT_ENV"
assert_no_placeholders "$PROJECT_ENV"
require_secret_permissions "$SECRETS_ENV"
assert_no_placeholders "$SECRETS_ENV"

log "PLAN update MQTT and OSS keys in ${STORE_DB_NAME}.ydy_config"
log "PLAN scope restaurant_id=${CONFIG_RESTAURANT_ID}; values remain redacted"
log "PLAN requires a verified database backup and exact configure-cloud-database approval"

[ "$APPLY" -eq 1 ] || {
  log "SHADOW_ONLY: database unchanged"
  exit 0
}

[ -n "$APPROVAL_FILE" ] || die "--approval-file is required with --apply"
require_apply_authorization "configure-cloud-database" "$APPROVAL_FILE" "$TARGET_HOST_REF"
[ -e "$BACKUP_REF" ] || die "approved backup reference does not exist: $BACKUP_REF"
load_env_file "$SECRETS_ENV"
require_cmd mysql
require_cmd python3

EXPECTED_KEYS=17
EXISTING_KEYS="$(
  MYSQL_PWD="$MYSQL_DEPLOY_PASSWORD" mysql \
    --batch --skip-column-names \
    --host="$MYSQL_HOST" --port="$MYSQL_PORT" --user="$MYSQL_DEPLOY_USER" \
    "$STORE_DB_NAME" \
    --execute="SELECT COUNT(*) FROM ydy_config WHERE config_key IN ('ali_mqtt_disjunctor','ali_mqtt_accessKey','ali_mqtt_secretKey','ali_mqtt_endPoint','ali_mqtt_instanceId','ali_mqtt_topic','ali_mqtt_groupId','ali_mqtt_deviceId','ali_mqtt_listener_deviceId','ali_mqtt_shared_subscribe','ossDisjunctor','ossAccessKeyId','ossAccessKeySecret','ossEndpoint','ossBucket','ossHost','businessIdentify') AND restaurant_id=${CONFIG_RESTAURANT_ID} AND status=1;"
)"
[ "$EXISTING_KEYS" = "$EXPECTED_KEYS" ] || die "expected $EXPECTED_KEYS unique active config rows, found $EXISTING_KEYS"

TMP_SQL="$(mktemp)"
trap 'rm -f "$TMP_SQL"' EXIT
python3 "$PACKAGE_ROOT/tools/render_cloud_sql.py" \
  --project-env "$PROJECT_ENV" \
  --secrets-env "$SECRETS_ENV" \
  --output "$TMP_SQL"

MYSQL_PWD="$MYSQL_DEPLOY_PASSWORD" mysql \
  --host="$MYSQL_HOST" --port="$MYSQL_PORT" --user="$MYSQL_DEPLOY_USER" \
  "$STORE_DB_NAME" < "$TMP_SQL"

log "CLOUD_DATABASE_CONFIG_APPLIED: values were not printed"