# Sourced by managed-container; uses the shared OCF and parameter environment.

pg_replication_exec()
{
    mc_runtime_exec \
        --user "${PG_OS_USER}" \
        "${CONTAINER_NAME}" \
        sh -c '
            if [ -z "${POSTGRES_REPLICATION_PASSWORD:-}" ]; then
                printf "%s\n" \
                    "POSTGRES_REPLICATION_PASSWORD is missing from container environment" \
                    >&2
                exit 1
            fi

            export PGPASSWORD="${POSTGRES_REPLICATION_PASSWORD}"

            exec "$@"
        ' sh "$@"
}

ensure_rewind_privileges()
{
    local repl_user

    repl_user="$(
        pg_command '
            printf "%s" "${POSTGRES_REPLICATION_USER:-}"
        ' 2>/dev/null
    )" || {
        ocf_exit_reason \
            "Unable to read POSTGRES_REPLICATION_USER from container"
        return "${OCF_ERR_GENERIC}"
    }

    if [ -z "${repl_user}" ]; then
        ocf_exit_reason \
            "POSTGRES_REPLICATION_USER is empty"
        return "${OCF_ERR_CONFIGURED}"
    fi

    case "${repl_user}" in
        *[!A-Za-z0-9_]*)
            ocf_exit_reason \
                "Invalid replication role name: ${repl_user}"
            return "${OCF_ERR_CONFIGURED}"
            ;;
    esac

    ocf_log info \
        "Ensuring pg_rewind source privileges for role ${repl_user}"

    if ! pg_command "
        psql \
            -U '${DB_USER}' \
            -d postgres \
            -v ON_ERROR_STOP=1 \
            -c \"
                GRANT EXECUTE
                    ON FUNCTION pg_catalog.pg_ls_dir(text, boolean, boolean)
                    TO ${repl_user};

                GRANT EXECUTE
                    ON FUNCTION pg_catalog.pg_stat_file(text, boolean)
                    TO ${repl_user};

                GRANT EXECUTE
                    ON FUNCTION pg_catalog.pg_read_binary_file(text)
                    TO ${repl_user};

                GRANT EXECUTE
                    ON FUNCTION pg_catalog.pg_read_binary_file(
                        text,
                        bigint,
                        bigint,
                        boolean
                    )
                    TO ${repl_user};
            \"
    " >/dev/null
    then
        ocf_exit_reason \
            "Failed ensuring pg_rewind privileges for ${repl_user}"
        return "${OCF_ERR_GENERIC}"
    fi

    return "${OCF_SUCCESS}"
}