/**
 * Upsert the admin@example.dev user with correct password hash.
 * Run: DATABASE_URL=... PII_KEY=... tsx src/server/db/seeds/fix-admin-password.ts
 *
 * Safe to run multiple times — uses email_index lookup + upsert.
 */

import { scriptOutput } from '../../lib/script-output.js';
import { eq } from 'drizzle-orm';
import * as schema from '../schema.js';
import { getDb } from '../client.js';
import { hashPassword } from '../../auth/credentials.js';
import { blindIndex } from '../crypto.js';
import { setUserEmail } from '../pii-write.js';
import { createUserRecord, updatePasswordHash, setUserAdminFlag } from '../queries/users.js';
import { readSeedCliEnv } from '../seed-cli-env.js';

const { DATABASE_URL, PII_KEY, PASSWORD_PEPPER_V1 } = readSeedCliEnv();

const db = getDb({ DATABASE_URL });

const ADMIN_EMAIL = 'admin@example.dev';
const ADMIN_PASSWORD = 'OQPDnd9QCK6K-2DB@Multideal1';

async function main() {
  const emailIdx = await blindIndex(ADMIN_EMAIL, PII_KEY);
  const passwordHash = await hashPassword(ADMIN_PASSWORD, PASSWORD_PEPPER_V1);

  const existing = await db.query.users.findFirst({
    where: eq(schema.users.emailIndex, emailIdx),
  });

  if (existing) {
    await updatePasswordHash(db, existing.id, passwordHash);
    await setUserAdminFlag(db, existing.id, true);
    scriptOutput(`Updated admin user ${existing.id} — password + is_admin set`);
  } else {
    const emailPatch = await setUserEmail(ADMIN_EMAIL, PII_KEY);
    const inserted = await createUserRecord(db, {
      ...emailPatch,
      passwordHash,
      isAdmin: true,
      avatarType: 'ICON',
      avatarValue: 'icon_1',
      purchaseCount: 0,
      accountState: 'ACTIVE',
    });
    scriptOutput(`Created admin user ${inserted.id} with email ${ADMIN_EMAIL}`);
  }
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});