/**
 * Create vendor email accounts (*.multi.deal) and vendor.test, link to vendor records.
 * Run: DATABASE_URL=... PII_KEY=... tsx src/server/db/seeds/seed-vendor-users.ts
 *
 * Safe to re-run — skips existing users, updates vendor owner_user_id.
 * Appends credentials to Docs/logins.dev
 */

import { scriptOutput } from '../../lib/script-output.js';
import { eq } from 'drizzle-orm';
import * as schema from '../schema.js';
import { getDb } from '../client.js';
import { blindIndex } from '../crypto.js';
import { setUserEmail } from '../pii-write.js';
import { hashPassword } from '../../auth/credentials.js';
import { appendFileSync } from 'node:fs';
import { resolve } from 'node:path';
import { createUserRecord, updatePasswordHash } from '../queries/users.js';
import { setVendorOwnerUserId } from '../queries/vendors.js';
import { readSeedCliEnv } from '../seed-cli-env.js';

const { DATABASE_URL, PII_KEY, PASSWORD_PEPPER_V1 } = readSeedCliEnv();

const db = getDb({ DATABASE_URL });

function generatePassword(): string {
  const chars = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz23456789!@#$%^&*';
  let pw = '';
  const arr = new Uint8Array(20);
  crypto.getRandomValues(arr);
  for (const b of arr) pw += chars[b % chars.length];
  return pw;
}

// vendor_id → email mapping (ID-based, not display-name — survives re-seeds)
// Vendor IDs from DB as of 2026-05-20 (project rough-brook-49654702)
const VENDOR_ACCOUNTS = [
  {
    vendorId: '346635de-c822-422f-9a03-130186842640',
    email: 'lechem.shalom@multi.deal',
    label: 'לחם שלום',
  },
  {
    vendorId: 'ebad48fe-dc96-4e29-b50e-fbce3e301f5b',
    email: 'sushi.hacarmel@multi.deal',
    label: 'סושי הכרם',
  },
  {
    vendorId: 'dfbe0fbe-5ea0-4e30-9a1e-84d82b7e2336',
    email: 'de.luca@multi.deal',
    label: 'דה לוקה',
  },
  {
    vendorId: 'bfce1e18-8834-4eb1-9bb0-d91c476aa897',
    email: 'segev.barber@multi.deal',
    label: 'ברבר שופ',
  },
  {
    vendorId: '26c14530-ad39-42fc-b735-03b134d00b9b',
    email: 'halom.gelato@multi.deal',
    label: 'ממתק',
  },
  {
    vendorId: 'fff8fdc2-3a50-4c11-b9e2-fe17e5dd68a1',
    email: 'amitz.escape@multi.deal',
    label: 'חדר בריחה',
  },
  {
    vendorId: 'd76d5c66-618a-46b6-97a6-5730f4fff6f6',
    email: 'gil.bakery@multi.deal',
    label: 'עוגות שי',
  },
  {
    vendorId: 'a6a6eb8e-eb12-4527-8ae4-0f2dffded392',
    email: 'uri.sushi@multi.deal',
    label: 'פיט קיטשן',
  },
  {
    vendorId: 'f6437d33-9f98-42f1-a8d0-0df58089a614',
    email: 'merav.spa@multi.deal',
    label: 'ספא נפש',
  },
  // vendor.test — primary test vendor account
  {
    vendorId: 'bfcac0c0-d95f-473f-8f0a-a20716476972',
    email: 'vendor.test@multi.deal',
    label: 'vendor.test (רוטשילד 22)',
  },
];

async function upsertVendorUser(
  email: string,
  password: string,
  vendorId: string,
): Promise<string> {
  const emailIdx = await blindIndex(email, PII_KEY);
  const passwordHash = await hashPassword(password, PASSWORD_PEPPER_V1);

  const existing = await db.query.users.findFirst({
    where: eq(schema.users.emailIndex, emailIdx),
  });

  let userId: string;
  if (existing) {
    await updatePasswordHash(db, existing.id, passwordHash);
    userId = existing.id;
  } else {
    const emailPatch = await setUserEmail(email, PII_KEY);
    const inserted = await createUserRecord(db, {
      ...emailPatch,
      passwordHash,
      isAdmin: false,
      avatarType: 'ICON',
      avatarValue: 'icon_1',
      purchaseCount: 0,
      accountState: 'ACTIVE',
    });
    userId = inserted.id;
  }

  await setVendorOwnerUserId(db, vendorId, userId);

  return userId;
}

async function main() {
  const logins: string[] = [];

  for (const acct of VENDOR_ACCOUNTS) {
    // Look up vendor by ID directly — no fragile display-name matching
    const vendor = await db.query.vendors.findFirst({
      where: eq(schema.vendors.id, acct.vendorId),
      columns: { id: true, displayName: true },
    });

    if (!vendor) {
      console.warn(`  SKIP ${acct.email} — vendor ID ${acct.vendorId} not found in DB`);
      continue;
    }

    const password = generatePassword();
    const userId = await upsertVendorUser(acct.email, password, vendor.id);

    scriptOutput(
      `  ✓ ${acct.email} → user ${userId.slice(0, 8)}…, vendor ${vendor.id.slice(0, 8)}… (${vendor.displayName})`,
    );
    logins.push(
      `\nVendor   │ ${acct.label} (${vendor.displayName})\nEmail    │ ${acct.email}\nPassword │ ${password}\nUser ID  │ ${userId}\nVendor ID│ ${vendor.id}\nLogin    │ https://dev.multi.deal/login → email + password tab ✓ VERIFIED`,
    );
  }

  const loginsPath = resolve(process.cwd(), '../../Docs/logins.dev');
  const separator =
    '\n\n# ── Vendor email accounts (seeded by seed-vendor-users.ts ' +
    new Date().toISOString().slice(0, 10) +
    ') ──────────────────\n';
  appendFileSync(loginsPath, separator + logins.join('\n'));
  scriptOutput(`\nAppended ${logins.length} vendor credentials to Docs/logins.dev`);
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});