#!/usr/bin/env bash
set -euo pipefail

# Restored resume DB may contain JWKS encrypted with an old AUTH_SECRET.
# Better Auth then fails session verification after OAuth (login page loop).
# Safe fix: drop JWKS + sessions; app regenerates keys on next start.

echo "=== resume: reset Better Auth JWKS (fixes session decrypt errors) ==="
docker stop resume >/dev/null
docker exec postgres_resume psql -U postgres -d postgres -c "TRUNCATE jwks, session, oauth_access_token, oauth_refresh_token CASCADE;"
docker start resume >/dev/null
sleep 15
docker logs resume --tail 15 2>&1
echo "done — retry resume.ginnoir.com → Authentik"