/**
 * One-time RBAC backfill for existing tenants.
 * Idempotent: reuses seedPermissions + seedSystemRoles (ON CONFLICT DO NOTHING).
 *
 * Requires DATABASE_URL (same env var as drizzle-kit migrate / db:seed).
 */
import { readFileSync, existsSync } from 'node:fs'
import { resolve } from 'node:path'
import { count } from 'drizzle-orm'
import { drizzle } from 'drizzle-orm/postgres-js'
import postgres from 'postgres'
import type { Db } from '../client'
import { seedPermissions, seedSystemRoles } from '../queries/seed-rbac'
import * as schema from '../schema'
import { rolePermissions, tenants } from '../schema'

function loadDatabaseUrl(): string {
  const fromEnv = process.env['DATABASE_URL']
  if (fromEnv) return fromEnv

  // Local dev: same source wrangler uses (apps/zync-api/.dev.vars).
  const devVarsPath = resolve(process.cwd(), '../../apps/zync-api/.dev.vars')
  if (existsSync(devVarsPath)) {
    for (const line of readFileSync(devVarsPath, 'utf8').split('\n')) {
      const trimmed = line.trim()
      if (!trimmed || trimmed.startsWith('#')) continue
      const eq = trimmed.indexOf('=')
      if (eq === -1) continue
      const key = trimmed.slice(0, eq).trim()
      const value = trimmed.slice(eq + 1).trim()
      if (key === 'DATABASE_URL' && value) return value
    }
  }

  throw new Error(
    'DATABASE_URL is not set. Export it or add it to apps/zync-api/.dev.vars (same as db:migrate / db:seed).',
  )
}

async function countRolePermissionRows(db: Db): Promise<number> {
  const [row] = await db.select({ n: count() }).from(rolePermissions)
  return Number(row?.n ?? 0)
}

async function main(): Promise<void> {
  const connectionString = loadDatabaseUrl()
  const sql = postgres(connectionString, { max: 5, idle_timeout: 20 })
  const db = drizzle(sql, { schema }) as Db

  try {
    const before = await countRolePermissionRows(db)
    console.log(`role_permissions BEFORE: ${before}`)

    await seedPermissions(db)

    const tenantRows = await db.select({ id: tenants.id }).from(tenants)
    for (const t of tenantRows) {
      await seedSystemRoles(db, t.id)
    }

    const after = await countRolePermissionRows(db)
    console.log(`Tenants processed: ${tenantRows.length}`)
    console.log(`role_permissions AFTER: ${after}`)
  } finally {
    await sql.end({ timeout: 5 })
  }
}

main().catch((err: unknown) => {
  console.error(err)
  process.exit(1)
})