#!/bin/sh
# Migration 60 --> 61
# Convert PostgreSQL accounts to platform-minted credentials, first part.
#
# The converted postgres chart reads each account's verifier from an account
# Secret the Cozystack API writes, and the API seeds those Secrets only on a
# write of the application. This hook runs before any component chart changes
# version and seeds them for every existing Postgres release from the
# passwords in <release>-credentials, so clients keep logging in at every
# point of the upgrade. The second part is the cozystack-credentials-migration-60
# Job (templates/credentials-migration-job.yaml), which finishes each release
# once its chart has switched. State: the credentials-migration-60 ConfigMap in
# cozy-system.
#
# Fail-closed: migrations never re-run, so an error here stops the upgrade
# rather than stamping the version past a release that was not recorded.

set -euo pipefail

# shellcheck source=lib/cozystack-version.sh
. "$(dirname "$0")/lib/cozystack-version.sh"

credentials-migrate seed \
  --migration 60 \
  --kind Postgres \
  --format scram-sha-256 \
  --accounts-path users \
  --label 'cnpg.io/reload=true'

stamp_cozystack_version 61
