package auth

import (
	"context"
	"errors"
	"fmt"
	"log/slog"
	"strings"

	"mira/backend/internal/config"
	"mira/backend/internal/users"
)

func BootstrapSuperAdmin(ctx context.Context, cfg config.Config, store users.Store, logger *slog.Logger) error {
	email := strings.TrimSpace(cfg.SuperAdminEmail)
	password := cfg.SuperAdminPassword

	if email == "" || password == "" {
		if cfg.AppEnv == "production" {
			return errors.New("SUPER_ADMIN_EMAIL and SUPER_ADMIN_PASSWORD are required in production")
		}
		logger.Warn("super admin bootstrap skipped because credentials are not configured")
		return nil
	}

	if len(password) < 12 {
		return fmt.Errorf("SUPER_ADMIN_PASSWORD must have at least 12 characters")
	}

	hash, err := HashPassword(password)
	if err != nil {
		return fmt.Errorf("hash super admin password: %w", err)
	}

	user, err := store.UpsertSuperAdmin(ctx, email, hash)
	if err != nil {
		return fmt.Errorf("upsert super admin: %w", err)
	}

	logger.Info("super admin bootstrapped", "user_id", user.ID, "email", user.Email)
	return nil
}