-- Run only after restoring a production snapshot into an isolated dev database.
-- Preserve public osu identities, matches, mappools, and tournaments while
-- preventing copied credentials, sessions, and contact addresses from working.
BEGIN;

DO $$
BEGIN
	IF current_database() !~ '^vash_dev(_refresh_[0-9]+)?$' THEN
		RAISE EXCEPTION 'Refusing to sanitize non-dev database %', current_database();
	END IF;
END $$;

DELETE FROM session;
DELETE FROM verification;

UPDATE account
SET access_token = NULL,
	refresh_token = NULL,
	id_token = NULL,
	access_token_expires_at = NULL,
	refresh_token_expires_at = NULL,
	password = NULL,
	profile = CASE WHEN jsonb_typeof(profile) = 'object'
		THEN profile - 'email' - 'emailVerified' ELSE profile END;

UPDATE "user"
SET email = 'dev+' || md5(id) || '@identity.invalid',
	contact_email = NULL,
	email_verified = false;

DELETE FROM broadcast_destination;
UPDATE broadcast_channel SET agent_token_hash = NULL, live = false;
DELETE FROM broadcast_session;

COMMIT;