#!/usr/bin/env bash
# database/passwd -- rotate a database user's password
#
# Used when a password has been exposed. The new password is written to the
# site secret file and to wp-config.php when the site is WordPress, so the site
# keeps working after the rotation.
set -o pipefail
SELF=$(readlink -f "${BASH_SOURCE[0]}")
NV_BASE=$(cd "$(dirname "$SELF")/../../.." && pwd)
export NV_BASE
# shellcheck source=/dev/null
. "$NV_BASE/lib/core/bootstrap.sh"

nv_require_root || exit 1
ui_header "$(t db_m_passwd)"

db_available || { ui_err "$(t db_unreachable)"; exit 1; }

if [ $# -ge 1 ]; then domain=$1; else
    ui_info "$(nv_site_list | paste -sd' ' -)"
    printf '  %s: ' "$(t site_prompt_domain)"
    read -r domain || exit 130
fi
domain=$(nv_lower "$(nv_trim "$domain")")
nv_site_exists "$domain" || { ui_err "$(t site_not_registered)"; exit 2; }

db_user=$(nv_site_get "$domain" db_user "")
[ -n "$db_user" ] || { ui_err "$(t db_no_user_for_site)"; exit 2; }

ui_kv "$(t col_domain)" "$domain"
ui_kv "$(t db_user)"    "$db_user"
ui_warn "$(t db_passwd_effect)"
ui_confirm "$(t db_passwd_confirm "$db_user")" n || { ui_info "$(t pf_cancelled)"; exit 0; }

pass=$(site_random_password)
nv_lock_acquire "db:$db_user" 10 || { nv_fail 6199 "$(t lock_busy "$db_user")"; exit 1; }

db_root_exec "ALTER USER '$db_user'@'localhost' IDENTIFIED BY '$pass'" \
    || { nv_fail 3107 "$(t db_passwd_failed)"; nv_lock_release "db:$db_user"; exit 1; }
db_root_exec "FLUSH PRIVILEGES" >/dev/null 2>&1 || true
site_secret_write "$domain" "$pass"
nv_trace db-passwd "$db_user"

root=$(nv_site_get "$domain" root_path "")
if [ -n "$root" ] && [ -f "$root/wp-config.php" ] && [ -x /usr/local/bin/wp ]; then
    sudo -u "$(site_web_user "$domain")" \
        /usr/local/bin/wp --path="$root" config set DB_PASSWORD "$pass" --quiet 2>/dev/null \
        && ui_ok "$(t db_passwd_wp_updated)" || ui_warn "$(t db_passwd_wp_failed)"
fi

nv_lock_release "db:$db_user"
ui_blank
ui_ok "$(t db_passwd_done "$db_user")"
ui_kv "$(t db_pass)" "$pass"
ui_warn "$(t db_pass_once)"
exit 0
