package db

import (
	"crypto/rand"
	"encoding/hex"
	"log/slog"
	"strings"

	"golang.org/x/crypto/bcrypt"
	"github.com/google/uuid"
	"gorm.io/gorm"
)

func generateRandomPassword(length int) (string, error) {
	bytes := make([]byte, length)
	if _, err := rand.Read(bytes); err != nil {
		return "", err
	}
	return hex.EncodeToString(bytes)[:length], nil
}

func SeedAdminUser(db *gorm.DB, username, password string) error {
	var count int64
	db.Model(&AdminUser{}).Count(&count)
	if count > 0 {
		slog.Info("admin user already exists, skipping seed")
		return nil
	}

	pwd := password
	if pwd == "" {
		var err error
		pwd, err = generateRandomPassword(24)
		if err != nil {
			return err
		}
		slog.Warn("no ADMIN_PASSWORD set — generated random password (save this, it won't be shown again)")
	}

	hash, err := bcrypt.GenerateFromPassword([]byte(pwd), bcrypt.DefaultCost)
	if err != nil {
		return err
	}

	admin := AdminUser{
		ID:           uuid.New(),
		Username:     strings.ToLower(username),
		PasswordHash: string(hash),
		IsActive:    true,
	}

	if err := db.Create(&admin).Error; err != nil {
		return err
	}

	slog.Info("admin user seeded", "username", admin.Username)
	slog.Warn("ADMIN USER: username=" + username + " password=" + pwd + " (save this, it won't be shown again)")
	return nil
}