name: Setup PostgreSQL Database

on:
  workflow_dispatch:

jobs:
  setup-database:
    runs-on: ubuntu-latest
    steps:
      - name: Install PostgreSQL client
        run: |
          sudo apt-get update
          sudo apt-get install -y postgresql-client

      - name: Create database and users (idempotent)
        env:
          DB_HOST: ${{ secrets.POSTGRES_HOST }}
          DB_PORT: ${{ secrets.POSTGRES_PORT }}
          PGPASSWORD: ${{ secrets.POSTGRES_ROOT_PASSWORD }}
          DB_NAME: ${{ secrets.DB_NAME }}
          DB_USER: ${{ secrets.DB_USER }}
          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
          DB_READONLY_USER: ${{ secrets.DB_READONLY_USER }}
          DB_READONLY_PASSWORD: ${{ secrets.DB_READONLY_PASSWORD }}
        run: |
          # Create database if it doesn't exist
          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -tc "SELECT 1 FROM pg_database WHERE datname = '${DB_NAME}'" | grep -q 1 || \
            psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "CREATE DATABASE ${DB_NAME};"
          
          # Create admin user if it doesn't exist
          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -tc "SELECT 1 FROM pg_user WHERE usename = '${DB_USER}'" | grep -q 1 || \
            psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "CREATE USER ${DB_USER} WITH PASSWORD '${DB_PASSWORD}';"
          
          # Grant all privileges on database to admin user
          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "GRANT ALL PRIVILEGES ON DATABASE ${DB_NAME} TO ${DB_USER};"
          
          # Grant schema privileges to admin user
          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "GRANT ALL PRIVILEGES ON SCHEMA public TO ${DB_USER};"
          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO ${DB_USER};"
          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON TABLES TO ${DB_USER};"
          
          # Create read-only user if it doesn't exist
          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -tc "SELECT 1 FROM pg_user WHERE usename = '${DB_READONLY_USER}'" | grep -q 1 || \
            psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "CREATE USER ${DB_READONLY_USER} WITH PASSWORD '${DB_READONLY_PASSWORD}';"
          
          # Grant read-only privileges to readonly user
          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "GRANT CONNECT ON DATABASE ${DB_NAME} TO ${DB_READONLY_USER};"
          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "GRANT USAGE ON SCHEMA public TO ${DB_READONLY_USER};"
          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${DB_READONLY_USER};"
          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO ${DB_READONLY_USER};"

      - name: Verify setup
        env:
          DB_HOST: ${{ secrets.POSTGRES_HOST }}
          DB_PORT: ${{ secrets.POSTGRES_PORT }}
          PGPASSWORD: ${{ secrets.POSTGRES_ROOT_PASSWORD }}
          DB_NAME: ${{ secrets.DB_NAME }}
          DB_USER: ${{ secrets.DB_USER }}
          DB_READONLY_USER: ${{ secrets.DB_READONLY_USER }}
        run: |
          echo "Database setup completed successfully!"
          echo "Database:"
          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "\l" | grep ${DB_NAME}
          echo "Users:"
          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "\du" | grep -E "${DB_USER}|${DB_READONLY_USER}"