-- ════════════════════════════════════════════════════════════════════════════
-- D0 / M2 — Drive backfill: create drives + stamp drive_id + provenance
-- ════════════════════════════════════════════════════════════════════════════
-- Second of the D0 migration trio. Half (1) of the §A backfill — the safe,
-- focused half:
--
--   * For every internal user with a root folder, create a Personal drive.
--   * The folder literally named `My Folder - <username>` becomes the
--     user's default Personal drive (`default_for_user = <uid>`).
--   * Any sibling root folders become secondary Personal drives
--     (`default_for_user = NULL`, name carried over verbatim).
--   * One owner role_grants row per new drive.
--   * Every existing folder/file row gets a `drive_id` (cascaded down the
--     ltree from the wrapper).
--   * Every existing folder/file row gets `created_by` and `updated_by`
--     backfilled from the existing `user_id` column.
--
-- The aggressive half (drop the wrapper folder, rewrite path columns,
-- strip the `My Folder - <username>/` prefix from every path/lpath value)
-- lands in M2b — kept separate so the tree-shape rewrite can be reviewed
-- in isolation.
--
-- External users (`auth.users.is_external = TRUE`) are intentionally
-- skipped — they have no root folder of their own, only role_grants
-- against other users' resources.

-- ── Pre-flight 1: refuse on sibling root literally named 'drives' ──────────
-- 'drives' is a reserved URL segment on the native WebDAV surface
-- (`/webdav/drives/<uuid>/`). A folder named 'drives' would shadow the
-- drive-listing route once D1 ships. Surface the conflict now — operator
-- renames before retrying.

DO $BODY$
DECLARE
    bad_count BIGINT;
BEGIN
    SELECT count(*) INTO bad_count
    FROM storage.folders f
    JOIN auth.users u ON u.id = f.user_id
    WHERE f.parent_id IS NULL
      AND NOT f.is_trashed
      AND lower(f.name) = 'drives'
      AND NOT u.is_external;

    IF bad_count > 0 THEN
        RAISE EXCEPTION
            'D0 backfill refused: % root folder(s) literally named ''drives'' '
            'would collide with the reserved /webdav/drives/<uuid>/ URL segment '
            'once D1 ships. Rename the offending folders, then retry the '
            'migration. Query to inspect:  SELECT f.id, f.user_id, f.name '
            'FROM storage.folders f JOIN auth.users u ON u.id = f.user_id '
            'WHERE f.parent_id IS NULL AND NOT f.is_trashed AND lower(f.name) '
            '= ''drives'' AND NOT u.is_external;',
            bad_count;
    END IF;
END $BODY$;


-- ── Pre-flight 2: report sibling-root distribution (informational) ─────────
-- Most users have exactly one root (`My Folder - <username>`). Some may
-- have SQL-added siblings — those become secondary drives. Surface the
-- count so operators can sanity-check before the migration commits.

DO $BODY$
DECLARE
    extras BIGINT;
BEGIN
    WITH counts AS (
        SELECT u.id AS user_id, count(*) AS root_count
        FROM auth.users u
        JOIN storage.folders f ON f.user_id = u.id
        WHERE f.parent_id IS NULL
          AND NOT f.is_trashed
          AND NOT u.is_external
        GROUP BY u.id
    )
    SELECT count(*) INTO extras FROM counts WHERE root_count > 1;

    IF extras > 0 THEN
        RAISE NOTICE
            'D0 backfill: % user(s) have more than one root folder. Their '
            'siblings will be promoted to secondary Personal drives. Inspect '
            'with: WITH c AS (SELECT u.id, u.username, count(*) cnt FROM '
            'auth.users u JOIN storage.folders f ON f.user_id=u.id WHERE '
            'f.parent_id IS NULL AND NOT f.is_trashed AND NOT u.is_external '
            'GROUP BY u.id, u.username) SELECT * FROM c WHERE cnt > 1;',
            extras;
    END IF;
END $BODY$;


-- ── 1. Plan every drive that needs to be created ──────────────────────────
-- Temp table is the cleanest way to pre-compute the new UUIDs once and
-- reuse them across the INSERT-drives, INSERT-grants, and UPDATE-folders
-- steps below. `gen_random_uuid()` in a CTE would re-evaluate on every
-- branch.
--
-- A row joins each existing root folder to its future drive_id. The
-- `is_default` flag is computed per-user as a window function so EVERY
-- internal user with at least one root folder ends up with exactly one
-- default drive — even if the user's wrapper was renamed away from
-- `My Folder - <username>` at some point. Preference order:
--   1. The folder literally named `My Folder - <username>` if it exists.
--   2. Otherwise the oldest root by `created_at`, tiebroken by `id`.

-- `ON COMMIT DROP` would race with the `[init-schema]` CI flow that
-- runs migrations via `psql \i` in autocommit mode: the CREATE statement
-- commits, the table drops, and the next statement (the DO block) can't
-- see it. The plain temp table survives until session end in autocommit
-- mode and until our explicit DROP at the bottom under `sqlx migrate`'s
-- single-tx mode. Works under both.
CREATE TEMPORARY TABLE _drive_plan AS
WITH root_folders AS (
    SELECT
        u.id                                AS user_id,
        u.username                          AS username,
        u.storage_quota_bytes               AS quota,
        f.id                                AS wrapper_id,
        f.name                              AS wrapper_name,
        f.created_at                        AS created_at,
        (f.name = 'My Folder - ' || u.username) AS name_matches_default
    FROM auth.users u
    JOIN storage.folders f
      ON f.user_id   = u.id
     AND f.parent_id IS NULL
     AND NOT f.is_trashed
    WHERE NOT u.is_external
)
SELECT
    user_id,
    username,
    quota,
    wrapper_id,
    wrapper_name,
    -- Rank candidates per user: name-matched root wins; otherwise oldest
    -- by created_at then by id (stable, deterministic). ROW_NUMBER() = 1
    -- becomes the default drive for that user.
    (ROW_NUMBER() OVER (
        PARTITION BY user_id
        ORDER BY name_matches_default DESC,
                 created_at ASC,
                 wrapper_id ASC
    ) = 1) AS is_default,
    gen_random_uuid() AS new_drive_id
FROM root_folders;


-- ── 1b. Log which users got an auto-picked default (no name match) ────────
-- Operational nicety: if a user's default came from oldest-root fallback
-- rather than the canonical `My Folder - <username>`, surface it so an
-- operator can DM the user and confirm the migration picked the right
-- root. Not a failure — just visibility.

DO $BODY$
DECLARE
    auto_picked BIGINT;
BEGIN
    SELECT count(*) INTO auto_picked
    FROM _drive_plan p
    WHERE p.is_default
      AND p.wrapper_name <> 'My Folder - ' || p.username;

    IF auto_picked > 0 THEN
        RAISE NOTICE
            'D0 backfill: % user(s) had no `My Folder - <username>` root; '
            'the oldest sibling root was auto-picked as their default '
            'Personal drive. Inspect with: SELECT user_id, username, '
            'wrapper_name FROM _drive_plan WHERE is_default AND '
            'wrapper_name <> ''My Folder - '' || username; '
            '(temp table only exists during the migration transaction.)',
            auto_picked;
    END IF;
END $BODY$;


-- ── 2. Insert the drive rows ───────────────────────────────────────────────
-- Default drives carry the i18n-neutral name 'Personal' (renameable
-- later via the drive settings panel). Secondary drives carry their
-- original folder name verbatim.

INSERT INTO storage.drives
    (id, name, kind, default_for_user, quota_bytes)
SELECT
    p.new_drive_id,
    CASE WHEN p.is_default THEN 'Personal' ELSE p.wrapper_name END,
    'personal',
    CASE WHEN p.is_default THEN p.user_id ELSE NULL END,
    p.quota
FROM _drive_plan p;


-- ── 3. Insert one owner role_grants row per drive ─────────────────────────
-- Each user is the sole owner of every drive their wrappers produced.
-- The lifecycle hook (D0-9) will do the same for users created post-D0.

INSERT INTO storage.role_grants
    (subject_type, subject_id, resource_type, resource_id, role, granted_by)
SELECT 'user', p.user_id, 'drive', p.new_drive_id, 'owner', p.user_id
FROM _drive_plan p;


-- ── 4. Stamp drive_id on each wrapper folder ──────────────────────────────
-- The wrapper still exists as a folder during M2 (the wrapper-drop lives
-- in M2b). Setting drive_id on the wrapper lets the cascade in §5 walk
-- the ltree subtree without needing a separate index.

UPDATE storage.folders f
   SET drive_id = p.new_drive_id
  FROM _drive_plan p
 WHERE f.id = p.wrapper_id;


-- ── 5. Cascade drive_id down the folder tree ──────────────────────────────
-- For every folder descended from a wrapper, set drive_id to that
-- wrapper's. Uses the existing GiST index `idx_folders_lpath` for the
-- @> (ancestor-of) lookup. Trashed descendants get a drive_id too —
-- soft-deleted folders need a drive_id once M3 makes the column NOT NULL.

UPDATE storage.folders sub
   SET drive_id = wrapper.drive_id
  FROM storage.folders wrapper
 WHERE wrapper.id IN (SELECT wrapper_id FROM _drive_plan)
   AND sub.lpath <@ wrapper.lpath
   AND sub.id  != wrapper.id
   AND sub.drive_id IS NULL;


-- ── 6. Cascade drive_id to files (via their folder) ───────────────────────
-- Files inherit drive_id from their containing folder. A NULL folder_id
-- file is an orphan — left with NULL drive_id here; M3's NOT NULL
-- constraint will refuse the migration if any such orphans remain,
-- which is the right outcome (forces operator inspection).

UPDATE storage.files fi
   SET drive_id = fo.drive_id
  FROM storage.folders fo
 WHERE fi.folder_id = fo.id
   AND fi.drive_id IS NULL
   AND fo.drive_id IS NOT NULL;


-- ── 7. Provenance backfill ────────────────────────────────────────────────
-- Every pre-Drive row carries authentic provenance from day one: created_by
-- and updated_by both default to the user_id that we know created the
-- resource (that's exactly what user_id meant pre-D0). New writes during
-- the dual-write window populate both columns explicitly.

UPDATE storage.folders
   SET created_by = user_id,
       updated_by = user_id
 WHERE created_by IS NULL;

UPDATE storage.files
   SET created_by = user_id,
       updated_by = user_id
 WHERE created_by IS NULL;


-- ── 7b. Drop the planning temp table ──────────────────────────────────────
-- Explicit drop since we removed `ON COMMIT DROP` above. Idempotent
-- (`IF EXISTS`) so a partial re-run during development doesn't error.

DROP TABLE IF EXISTS _drive_plan;


-- ── 8. Post-flight consistency check ──────────────────────────────────────
-- The checks here REFUSE to commit if any invariant is violated, so a
-- successful migration is a verifiable migration.
--
--   8a. Every internal user with a root folder has exactly one
--       default drive.
--   8b. Every drive has at least one owner role_grants row.
--   8c. No NULL drive_id remains on a folder/file row whose owner is
--       a non-external user with a root folder (i.e. every row that
--       belongs to a drive must now declare which one).
--
-- M3 turns drive_id NOT NULL; the check below is a stricter pre-flight
-- so the failure mode is "migration refuses" rather than "M3 errors
-- with a NOT NULL violation halfway through".

DO $BODY$
DECLARE
    missing_default BIGINT;
    grantless_drives BIGINT;
    null_folder_drive_id BIGINT;
    null_file_drive_id BIGINT;
BEGIN
    SELECT count(*) INTO missing_default
    FROM auth.users u
    WHERE NOT u.is_external
      AND EXISTS (
          SELECT 1 FROM storage.folders f
           WHERE f.user_id = u.id AND f.parent_id IS NULL AND NOT f.is_trashed
      )
      AND NOT EXISTS (
          SELECT 1 FROM storage.drives d
           WHERE d.default_for_user = u.id
      );
    IF missing_default > 0 THEN
        RAISE EXCEPTION
            'D0 backfill consistency check failed: % internal user(s) with a '
            'root folder have no default Personal drive. Investigate before '
            'declaring the migration successful.',
            missing_default;
    END IF;

    SELECT count(*) INTO grantless_drives
    FROM storage.drives d
    WHERE NOT EXISTS (
        SELECT 1 FROM storage.role_grants g
         WHERE g.resource_type = 'drive'
           AND g.resource_id   = d.id
           AND g.role          = 'owner'
    );
    IF grantless_drives > 0 THEN
        RAISE EXCEPTION
            'D0 backfill consistency check failed: % drive(s) have no owner '
            'role_grants row. Investigate before declaring the migration '
            'successful.',
            grantless_drives;
    END IF;

    SELECT count(*) INTO null_folder_drive_id
    FROM storage.folders f
    WHERE f.drive_id IS NULL
      AND EXISTS (
          SELECT 1 FROM auth.users u
           WHERE u.id = f.user_id AND NOT u.is_external
      );
    IF null_folder_drive_id > 0 THEN
        RAISE EXCEPTION
            'D0 backfill consistency check failed: % folder(s) belonging to '
            'an internal user still have NULL drive_id. M3 will refuse to '
            'add NOT NULL until these are resolved.',
            null_folder_drive_id;
    END IF;

    SELECT count(*) INTO null_file_drive_id
    FROM storage.files fi
    WHERE fi.drive_id IS NULL
      AND EXISTS (
          SELECT 1 FROM auth.users u
           WHERE u.id = fi.user_id AND NOT u.is_external
      );
    IF null_file_drive_id > 0 THEN
        RAISE EXCEPTION
            'D0 backfill consistency check failed: % file(s) belonging to an '
            'internal user still have NULL drive_id (likely orphans — '
            'folder_id pointing at a missing folder). Inspect with: SELECT '
            'fi.id, fi.user_id, fi.folder_id FROM storage.files fi JOIN '
            'auth.users u ON u.id = fi.user_id WHERE fi.drive_id IS NULL '
            'AND NOT u.is_external;',
            null_file_drive_id;
    END IF;
END $BODY$;