#!/usr/bin/env bash
# database/users -- who can log in, and what they are allowed to touch
set -o pipefail
SELF=$(readlink -f "${BASH_SOURCE[0]}")
NV_BASE=$(cd "$(dirname "$SELF")/../../.." && pwd)
export NV_BASE
# shellcheck source=/dev/null
. "$NV_BASE/lib/core/bootstrap.sh"

nv_require_root || exit 1
ui_header "$(t db_m_users)"
db_available || { ui_err "$(t db_unreachable)"; exit 1; }

ui_section "$(t db_users_list)"
printf '  %-24s %-14s %s\n' "$(t db_user)" "$(t db_host)" "$(t db_user_kind)"
db_root_exec "SELECT User,Host FROM mysql.user ORDER BY User" 2>/dev/null \
    | while IFS=$'\t' read -r user host; do
          [ -z "$user" ] && continue
          kind=$(t db_user_app)
          case $user in root|mariadb.sys|mysql|debian-sys-maint) kind=$(t db_user_system) ;; esac
          printf '  %-24s %-14s %s\n' "$user" "$host" "$kind"
      done

ui_section "$(t db_users_grants)"
for domain in $(nv_site_list); do
    u=$(nv_site_get "$domain" db_user "")
    d=$(nv_site_get "$domain" db_name "")
    [ -z "$u" ] && continue
    grants=$(db_root_exec "SHOW GRANTS FOR '$u'@'localhost'" 2>/dev/null | tr '\n' ' ')
    printf '  %-24s %s\n' "$u" "$(ui_trunc "${grants:-$(t db_user_no_grant)}" 46)"
    [ -n "$d" ] && printf '  %-24s   -> %s\n' '' "$d"
done

ui_section "$(t db_users_root)"
root_auth=$(db_root_exec "SELECT plugin FROM mysql.user WHERE User='root' LIMIT 1" 2>/dev/null)
case $root_auth in
    unix_socket) ui_ok "$(t db_root_socket)" ;;
    '')          ui_warn "$(t db_root_unknown)" ;;
    *)           ui_warn "$(t db_root_password_auth "$root_auth")" ;;
esac
ui_blank
exit 0
