#!/bin/bash
# Safe database initialization script
# Applies init-users.sql with environment variable substitution
# Exit on any error
set -euo pipefail

# Get superuser password from CNPG secret
PG_PASSWORD=$(kubectl get secret -n ddb ddb-cluster-app -o jsonpath='{.data.password}' | base64 -d)
export PGPASSWORD="$PG_PASSWORD"

# Apply SQL with safe variable substitution (psql -v prevents injection)
psql \
  -h ddb-cluster-rw.ddb.svc.cluster.local \
  -U postgres \
  -d postgres \
  -v authentik_password="$AUTHENTIK_PG_PASSWORD" \
  -v story_crater_password="$STORY_CRATER_PG_PASSWORD" \
  -f k8s/ddb/init-users.sql

unset PGPASSWORD
echo "✓ Database initialization complete"