# Probe 10.206.0.14 only (intranet data host). Avoid foreach var name 'host'.
$ErrorActionPreference = "Continue"
$mysql = "C:\yutongda\tools\mysql-8.0.39-winx64\bin\mysql.exe"
$psql = "C:\yutongda\tools\pgsql\bin\psql.exe"
$dbCred = Get-Content "C:\yutongda\secure\application-database-credentials.json" -Raw | ConvertFrom-Json
$sec = Get-Content "E:\wwwroot\ops\inquiry_robot_db_secrets.json" -Raw | ConvertFrom-Json
$dataHost = [string]$dbCred.mysql_host

Write-Output ("dataHost=" + $dataHost)
Write-Output ("appIntranet=" + (Get-NetIPAddress -AddressFamily IPv4 | Where-Object { $_.IPAddress -like '10.*' } | Select-Object -First 1 -ExpandProperty IPAddress))

Write-Output "=== MySQL ytd_jeecg @ dataHost ==="
$u = [string]$dbCred.mysql_username
$p = [string]$dbCred.mysql_password
& $mysql -h $dataHost -P 3306 -u $u "-p$p" --connect-timeout=10 --batch -e "SELECT CURRENT_USER() AS u; SHOW DATABASES LIKE 'inquiry%'; SHOW GRANTS FOR CURRENT_USER();" 2>&1 |
  Where-Object { "$_" -notmatch "Warning" } | ForEach-Object { "$_" }

Write-Output "=== MySQL inquiry_robot @ dataHost ==="
$ir = [string]$sec.mysql_user
$irp = [string]$sec.mysql_password
$out = & $mysql -h $dataHost -P 3306 -u $ir "-p$irp" --connect-timeout=10 --batch -N -e "SELECT 1" 2>&1
$text = ($out | ForEach-Object {"$_"}) -join "`n"
if ($text -match "ERROR") {
  ($text -split "`n" | Where-Object { $_ -match "ERROR" } | Select-Object -First 1)
} else {
  Write-Output "inquiry_robot_login=OK"
}

Write-Output "=== try CREATE DATABASE on dataHost as ytd_jeecg (expect deny) ==="
$c = & $mysql -h $dataHost -P 3306 -u $u "-p$p" --connect-timeout=10 -e "CREATE DATABASE IF NOT EXISTS inquiry_robot" 2>&1
($c | ForEach-Object {"$_"}) | Where-Object { $_ -match "ERROR|Query OK|Rows" } | Select-Object -First 3

Write-Output "=== PG ytd_runtime / inquiry @ dataHost ==="
$env:PGPASSWORD = [string]$dbCred.postgres_password
& $psql -h $dataHost -p 5432 -U ([string]$dbCred.postgres_username) -d ([string]$dbCred.postgres_database) -tAc "SELECT current_user, current_database(); SELECT datname FROM pg_database WHERE datname LIKE 'inquiry%' OR datname LIKE 'ytd%';" 2>&1 |
  ForEach-Object { "$_" }

Write-Output "=== PG inquiry_robot_runtime @ dataHost ==="
$env:PGPASSWORD = [string]$sec.pg_password
& $psql -h $dataHost -p 5432 -U inquiry_robot_runtime -d inquiry_robot_runtime -tAc "SELECT 'pg_ir_ok'" 2>&1 |
  ForEach-Object { "$_" }

Write-Output "=== local-only leftovers (info) ==="
$env:PGPASSWORD = [string]$sec.pg_password
& $psql -h 127.0.0.1 -p 5432 -U inquiry_robot_runtime -d inquiry_robot_runtime -tAc "SELECT 'local_pg_ok'" 2>&1 | ForEach-Object { "local_pg=" + $_ }
Remove-Item Env:PGPASSWORD -EA SilentlyContinue

# ensure .env stays on intranet data host
Write-Output "=== ensure .env hosts = dataHost ==="
$envPath = "E:\wwwroot\.env"
$lines = Get-Content $envPath
$changed = $false
$outLines = foreach ($line in $lines) {
  if ($line -match '^MYSQL_HOST=' -and $line -ne "MYSQL_HOST=$dataHost") { $changed = $true; "MYSQL_HOST=$dataHost" }
  elseif ($line -match '^PG_HOST=' -and $line -ne "PG_HOST=$dataHost") { $changed = $true; "PG_HOST=$dataHost" }
  elseif ($line -match '^YTD_MYSQL_URL=' -and $line -notmatch [regex]::Escape("jdbc:mysql://${dataHost}:3306/inquiry_robot")) {
    $changed = $true
    "YTD_MYSQL_URL=jdbc:mysql://${dataHost}:3306/inquiry_robot?characterEncoding=UTF-8&useUnicode=true&useSSL=true&requireSSL=true&verifyServerCertificate=false&tinyInt1isBit=false&allowPublicKeyRetrieval=true&serverTimezone=Asia/Shanghai"
  }
  else { $line }
}
if ($changed) {
  Set-Content $envPath -Value $outLines -Encoding UTF8
  if (Test-Path "E:\wwwroot\agent\current") { Copy-Item $envPath "E:\wwwroot\agent\current\.env" -Force }
  Write-Output "env_patched=true"
} else {
  Write-Output "env_patched=false (already intranet)"
}

$status = @{
  mysqlHost = $dataHost
  pgHost = $dataHost
  appServerIntranet = "10.206.0.15"
  mysqlCreatedOnDataHost = $false
  pgCreatedOnDataHost = $false
  localPgLeftover = $true
  note = "Apps must use intranet data host 10.206.0.14 (not 127.0.0.1). Empty DB create needs DBA on 10.206.0.14; app users have no CREATE DATABASE."
  needDba = $true
  sqlDir = "E:\\wwwroot\\ops\\sql"
  updatedAt = (Get-Date).ToString("o")
} | ConvertTo-Json
Set-Content "E:\wwwroot\ops\data-plane-status.json" -Value $status -Encoding UTF8
Write-Output $status
Write-Output "DONE"