#!/usr/bin/env -S deno run --allow-net --allow-env --allow-read
/**
 * PANELS · Fase 4 · bootstrap explícito y one-shot del primer administrador.
 *
 * Antes, `seed()` (api/db.ts) y `seedPlatform()` (api/platform_db.ts)
 * creaban/actualizaban contraseñas de admin en CADA arranque de la API
 * (incluyendo el peligroso SEED_SYNC_PASSWORD reescribiendo passwords en
 * cada deploy). Ahora es un comando manual, corrido una vez por ambiente.
 *
 * Uso (correr SIEMPRE desde dentro de api/, para que se resuelva
 * api/deno.json y sus dependencias npm):
 *   cd api
 *   set -a && source ../.env.dev-local && set +a
 *   deno run --allow-net --allow-env --allow-read scripts/bootstrap-admin.ts platform
 *   deno run --allow-net --allow-env --allow-read scripts/bootstrap-admin.ts tenant \
 *     --tenant-id=1 --company-code=ARCT2608 --username=arct2608 --display-name="Administrador"
 *
 * Requiere SEED_PASSWORD en el entorno. No falla si el usuario ya existe:
 * actualiza el hash y deja must_change_password=true.
 */
import { getPlatformDb } from "../platform_db.ts";
import { getCoreDb } from "../db.ts";
import { withIamOwner } from "../iam_db.ts";
import { hashPassword } from "../crypto.ts";
import { config } from "../config.ts";

function arg(name: string, fallback?: string): string | undefined {
  const prefix = `--${name}=`;
  const found = Deno.args.find((a) => a.startsWith(prefix));
  return found ? found.slice(prefix.length) : fallback;
}

async function bootstrapPlatformAdmin() {
  if (!config.seedPassword) {
    throw new Error("Falta SEED_PASSWORD en el entorno");
  }
  const pdb = await getPlatformDb();
  const hash = await hashPassword(config.seedPassword);
  const existing = await pdb.prepare(
    "SELECT id FROM platform_users WHERE username = 'admin'",
  ).get();
  if (existing) {
    await pdb.prepare(
      "UPDATE platform_users SET password_hash = ?, display_name = 'Admin PANELS', status = 'activo' WHERE username = 'admin'",
    ).run(hash);
    console.log("[bootstrap] platform_users.admin actualizado");
  } else {
    await pdb.prepare(
      `INSERT INTO platform_users (username, password_hash, display_name, status)
       VALUES ('admin', ?, 'Admin PANELS', 'activo')`,
    ).run(hash);
    console.log("[bootstrap] platform_users.admin creado");
  }
}

async function bootstrapTenantAdmin() {
  if (!config.seedPassword) {
    throw new Error("Falta SEED_PASSWORD en el entorno");
  }
  const tenantId = Number(arg("tenant-id", "1"));
  const companyCode = arg("company-code", "ARCT2608")!;
  const username = arg("username", "arct2608")!;
  const displayName = arg("display-name", "Administrador")!;

  const core = await getCoreDb();
  const company = await core.prepare(
    "SELECT id FROM companies WHERE code = ? AND tenant_id = ?",
  ).get(companyCode, tenantId) as { id: number } | undefined;
  if (!company) {
    throw new Error(
      `No existe la empresa ${companyCode} en tenant_id=${tenantId} -- corre primero las migraciones con --context-filter=dev`,
    );
  }

  const hash = await hashPassword(config.seedPassword);
  await withIamOwner(async (db) => {
    const adminRole = await db.prepare(
      `SELECT id FROM roles WHERE code = 'tenant_admin' AND is_system AND tenant_id IS NULL`,
    ).get() as { id: number } | undefined;
    if (!adminRole) throw new Error("Rol sistema tenant_admin no encontrado");

    const existing = await db.prepare("SELECT id FROM users WHERE username = ?").get(username);
    if (existing) {
      await db.prepare(
        `UPDATE users SET password_hash = ?, display_name = ?, company_id = ?, tenant_id = ?,
          role_id = ?, must_change_password = true, status = 'activo',
          scope_all_projects = true, warehouse_central = true, warehouse_projects = true
         WHERE username = ?`,
      ).run(hash, displayName, company.id, tenantId, adminRole.id, username);
      console.log(`[bootstrap] iam.users.${username} actualizado (tenant_id=${tenantId})`);
    } else {
      await db.prepare(
        `INSERT INTO users (
          username, password_hash, display_name, company_id, tenant_id, role_id,
          must_change_password, email, status, scope_all_projects, warehouse_central, warehouse_projects
        ) VALUES (?, ?, ?, ?, ?, ?, true, '', 'activo', true, true, true)`,
      ).run(username, hash, displayName, company.id, tenantId, adminRole.id);
      console.log(`[bootstrap] iam.users.${username} creado (tenant_id=${tenantId})`);
    }
  });
}

const mode = Deno.args[0];
if (mode === "platform") {
  await bootstrapPlatformAdmin();
} else if (mode === "tenant") {
  await bootstrapTenantAdmin();
} else {
  console.error("Uso: bootstrap-admin.ts <platform|tenant> [--tenant-id=1] [--company-code=ARCT2608] [--username=arct2608] [--display-name=Administrador]");
  Deno.exit(1);
}
Deno.exit(0);