#!/bin/bash
# Rode este script UMA VEZ, no seu terminal (fora do Claude Code), para criar
# uma credencial dedicada de indexação e já preencher rag/.env com ela.
# Nunca expõe nem precisa da senha do rag_admin.
set -e

D="$(cd "$(dirname "$0")" && pwd)"
PW="$(python3 -c 'import secrets; print(secrets.token_urlsafe(24))')"
HOST="root@179.197.228.240"

echo "Criando role 'rag_doza_indexer' (escopo: schema doza, sem tocar em rag_admin)..."
ssh "$HOST" "docker exec -i rag-hub-db psql -U rag_admin -d rag_doza -v ON_ERROR_STOP=1" <<SQL
DO \$\$ BEGIN
  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname='rag_doza_indexer') THEN
    CREATE ROLE rag_doza_indexer LOGIN PASSWORD '$PW';
  ELSE
    ALTER ROLE rag_doza_indexer PASSWORD '$PW';
  END IF;
END \$\$;
GRANT USAGE, CREATE ON SCHEMA doza TO rag_doza_indexer;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA doza TO rag_doza_indexer;
ALTER DEFAULT PRIVILEGES IN SCHEMA doza GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO rag_doza_indexer;
GRANT USAGE ON ALL SEQUENCES IN SCHEMA doza TO rag_doza_indexer;
ALTER DEFAULT PRIVILEGES IN SCHEMA doza GRANT USAGE ON SEQUENCES TO rag_doza_indexer;
SQL

cat > "$D/.env" <<EOF
RAG_DB_HOST=127.0.0.1
RAG_DB_PORT=55435
RAG_DB_NAME=rag_doza
RAG_DB_USER=rag_doza_indexer
RAG_DB_PASSWORD=$PW
RAG_DB_SCHEMA=doza
EOF

echo "OK: rag/.env preenchido com a credencial dedicada rag_doza_indexer."