import crypto from "node:crypto";
import { db, hashPassword, AdminUser } from "./db";

export interface BootstrapResult {
  initialized: boolean;
  user: AdminUser | null;
  isNew: boolean;
}

/**
 * Ensures the first / Main Admin exists. Provisioned server-side ONLY — there is
 * no public signup. Credentials come exclusively from environment variables; if
 * they are absent and no Main Admin exists yet, this is a safe no-op (never
 * creates an account with a hardcoded/default password baked into source).
 *
 *   MAIN_ADMIN_EMAIL     required to provision
 *   MAIN_ADMIN_PASSWORD  required to provision (never logged/echoed)
 *   MAIN_ADMIN_NAME      optional display name
 */
export async function bootstrapMainAdmin(): Promise<BootstrapResult> {
  const existingMain = (await db.getUsers()).find(
    (u) => u.level === "MAIN_ADMIN" && u.status === "ACTIVE"
  );

  if (existingMain) {
    return { initialized: true, user: existingMain, isNew: false };
  }

  const email = process.env.MAIN_ADMIN_EMAIL?.trim().toLowerCase();
  const password = process.env.MAIN_ADMIN_PASSWORD;
  const name = process.env.MAIN_ADMIN_NAME?.trim() || "Main Administrator";

  // No credentials configured → do not fabricate a default account.
  if (!email || !password) {
    return { initialized: false, user: null, isNew: false };
  }

  const { hash, salt } = hashPassword(password);
  const now = new Date().toISOString();

  const mainAdmin: AdminUser = {
    id: crypto.randomUUID(),
    email,
    name,
    level: "MAIN_ADMIN",
    role: "MAIN_ADMIN",
    status: "ACTIVE",
    passwordHash: hash,
    passwordSalt: salt,
    passwordChangeRequired: false,
    twoFactorEnabled: false,
    twoFactorSecret: null,
    createdAt: now,
    updatedAt: now,
    lastLoginAt: null,
    createdBy: null,
  };

  await db.createUser(mainAdmin);

  await db.logSecurityEvent({
    actorId: mainAdmin.id,
    actorName: "SYSTEM_BOOTSTRAP",
    actorEmail: mainAdmin.email,
    actorLevel: "SYSTEM",
    targetUserId: mainAdmin.id,
    targetUserEmail: mainAdmin.email,
    targetUserName: mainAdmin.name,
    action: "ADMIN_BOOTSTRAP",
    details: {
      note: "Primary Main Admin initialized via server-side bootstrap (env-provisioned).",
      email: mainAdmin.email,
    },
    ipAddress: "127.0.0.1",
  });

  return { initialized: true, user: mainAdmin, isNew: true };
}