#!/bin/sh
set -eu

EXPECTED_SOURCE_SHA256='4b207d8cb071a136c10cd779fab9ffcf846a1618a87d076bdfd7dc5dfa14438c'

if [ "$#" -ne 2 ]; then
  echo "usage: $0 SOURCE_DUMP OUTPUT_SQL" >&2
  exit 64
fi

source_dump=$1
output_sql=$2
script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)

if [ ! -f "$source_dump" ]; then
  echo "source dump does not exist: $source_dump" >&2
  exit 66
fi

actual_source_sha256=$(shasum -a 256 "$source_dump" | awk '{print $1}')
if [ "$actual_source_sha256" != "$EXPECTED_SOURCE_SHA256" ]; then
  echo "source dump SHA-256 mismatch" >&2
  echo "expected: $EXPECTED_SOURCE_SHA256" >&2
  echo "actual:   $actual_source_sha256" >&2
  exit 65
fi

output_dir=$(dirname -- "$output_sql")
mkdir -p "$output_dir"
temporary_output=$(mktemp "${output_sql}.tmp.XXXXXX")
trap 'rm -f "$temporary_output"' EXIT HUP INT TERM

awk -f "$script_dir/sanitize_blank_bootstrap.awk" "$source_dump" > "$temporary_output"

if grep -Eq '^(COPY |INSERT INTO |SELECT pg_catalog\.setval\(|ALTER .* OWNER TO |GRANT |REVOKE |\\(un)?restrict )' "$temporary_output"; then
  echo "sanitized bootstrap still contains a forbidden data/environment statement" >&2
  exit 65
fi

if ! grep -q '^CREATE TABLE public\.nodes ' "$temporary_output"; then
  echo "sanitized bootstrap is missing the required nodes table" >&2
  exit 65
fi

mv "$temporary_output" "$output_sql"
trap - EXIT HUP INT TERM

echo "source_sha256=$actual_source_sha256"
echo "bootstrap_sha256=$(shasum -a 256 "$output_sql" | awk '{print $1}')"