#!/usr/bin/env bash
# Production startup (gunicorn) with a stable SECRET_KEY.
#
# Key resolution order:
#   1. SECRET_KEY environment variable (takes precedence),
#   2. .secret_key file next to this script (created once on first start),
#   3. otherwise a random key is generated and saved to .secret_key.
#
# A stable key matters: it signs the session cookies, so changing it
# on every restart would log out all users.
set -euo pipefail
cd "$(dirname "$0")"

SECRET_FILE=".secret_key"

if [ -z "${SECRET_KEY:-}" ]; then
    if [ -f "$SECRET_FILE" ]; then
        SECRET_KEY="$(cat "$SECRET_FILE")"
    else
        SECRET_KEY="$(python3 -c 'import secrets; print(secrets.token_hex(32))')"
        printf '%s' "$SECRET_KEY" > "$SECRET_FILE"
        chmod 600 "$SECRET_FILE"
        echo "Generated a new SECRET_KEY, saved to $SECRET_FILE" >&2
    fi
    export SECRET_KEY
fi

# Migrate before starting, so the schema matches the code.
if [ -x ".venv/bin/alembic" ]; then
    .venv/bin/alembic upgrade head
elif command -v alembic >/dev/null 2>&1; then
    alembic upgrade head
fi

if [ -x ".venv/bin/gunicorn" ]; then
    GUNICORN=".venv/bin/gunicorn"
else
    GUNICORN="gunicorn"
fi

exec "$GUNICORN" -c gunicorn.conf.py "app:create_app()"