/**
 * Upsert the bootstrap admin account password from .env CURATOR_USERNAME / CURATOR_PASSWORD.
 * Use when login fails after changing .env, or after a DB restore with a different hash.
 *
 *   npm run dev:reset-curator
 */
require('dotenv').config();
const bcrypt = require('bcryptjs');
const pool = require('../server/db');

const ADMIN_PERMISSIONS = [
  'images',
  'checkup',
  'curator_notes',
  'translations',
  'influences',
  'tours',
  'users',
];

async function main() {
  const username = (process.env.CURATOR_USERNAME || 'curator').trim();
  const password = process.env.CURATOR_PASSWORD;
  if (!password) {
    throw new Error('Set CURATOR_PASSWORD in .env before running this script');
  }

  const passwordHash = await bcrypt.hash(password, 10);
  const { rows } = await pool.query(`SELECT id FROM users WHERE LOWER(username) = LOWER($1)`, [
    username,
  ]);

  if (rows.length === 0) {
    await pool.query(
      `INSERT INTO users (username, password_hash, role, permissions, is_active)
       VALUES ($1, $2, 'admin', $3::text[], true)`,
      [username, passwordHash, ADMIN_PERMISSIONS]
    );
    console.log(`Created admin account: ${username}`);
  } else {
    await pool.query(
      `UPDATE users
       SET password_hash = $2,
           role = 'admin',
           permissions = $3::text[],
           is_active = true
       WHERE id = $1`,
      [rows[0].id, passwordHash, ADMIN_PERMISSIONS]
    );
    console.log(`Updated password and admin role for account: ${username}`);
  }

  // Drop stale sessions so a fresh login is required.
  await pool.query('DELETE FROM session');
  console.log('Cleared session store. Sign in again with CURATOR_USERNAME / CURATOR_PASSWORD from .env');
}

main()
  .then(() => pool.end())
  .catch((err) => {
    console.error(err.message || err);
    pool.end().finally(() => process.exit(1));
  });