#!/usr/bin/env bash
# SPDX-FileCopyrightText: 2026 Bart Broere
# SPDX-License-Identifier: GPL-3.0-or-later
# Prepares a freshly initialised cluster for peo.
set -euo pipefail

# The bridge connects over 127.0.0.1 with the credentials users log in with, so
# loopback TCP connections must check passwords. The postgres image trusts them
# by default; Unix-socket connections (psql inside the container) stay trusted.
sed -i -E 's/^(host[[:space:]]+[^[:space:]]+[[:space:]]+[^[:space:]]+[[:space:]]+(127\.0\.0\.1\/32|::1\/128)[[:space:]]+)trust/\1scram-sha-256/' \
    "$PGDATA/pg_hba.conf"

# Create the default AGE graph that neo4j-browser opens on first connect.
psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "${POSTGRES_DB:-$POSTGRES_USER}" \
    -v graph="${PEO_DEFAULT_GRAPH:-neo4j}" <<'EOSQL'
LOAD 'age';
SET search_path = ag_catalog, "$user", public;
SELECT ag_catalog.create_graph(:'graph')
WHERE NOT EXISTS (SELECT 1 FROM ag_catalog.ag_graph WHERE name = :'graph');
EOSQL