#!/usr/bin/env bash
# Bugsink 建站後的冪等初始化：建 team／project 與唯讀 API token，印出三行 KEY=VALUE 供 install.sh 讀。
# 用法：b0-bootstrap-snippet.sh [容器名]（預設 guidant-bugsink）。DB 連線由容器自己的 DATABASE_URL 帶，片段不經手密碼。
# 陷阱：team 名稱全站唯一、project 以 (team, name) 唯一，所以靠名稱 get_or_create 才能重跑不重建；
#       token 以 description 找回既有那支，重跑不會多發一支（多發的舊 token 會一直有效）。
set -euo pipefail

BUGSINK_CONTAINER="${1:-guidant-bugsink}"

docker exec -i "$BUGSINK_CONTAINER" bugsink-manage shell --no-imports <<'PY' | grep -E '^BUGSINK_(PROJECT_ID|SENTRY_KEY|API_TOKEN)='
from django.db import transaction
from teams.models import Team, TeamVisibility
from projects.models import Project, ProjectVisibility
from bsmain.models import AuthToken

TEAM_NAME = "Guidant AI"
PROJECT_NAME = "guidant-ai"
TOKEN_DESCRIPTION = "guidant-ai installer (read-only)"

with transaction.atomic():
    team, _ = Team.objects.get_or_create(
        name=TEAM_NAME, defaults={"visibility": TeamVisibility.HIDDEN})
    project, _ = Project.objects.get_or_create(
        team=team, name=PROJECT_NAME,
        defaults={"slug": PROJECT_NAME, "visibility": ProjectVisibility.TEAM_MEMBERS})
    token = (AuthToken.objects
             .filter(description=TOKEN_DESCRIPTION, expires_at__isnull=True)
             .order_by("created_at").first())
    if token is None:
        # 唯讀三權限；service token（不綁 user、不綁 project）才能跨 project 讀 issue／event。
        token = AuthToken.objects.create(
            description=TOKEN_DESCRIPTION,
            is_user_bound=False, is_project_bound=False,
            issues_read=True, events_read=True, projects_read=True)

print(f"BUGSINK_PROJECT_ID={project.id}")
print(f"BUGSINK_SENTRY_KEY={project.sentry_key.hex}")
print(f"BUGSINK_API_TOKEN={token.token}")
PY