"""Bootstrap auth: initialize DB and seed admin user at install time.

Run once during installation. Writes config/auth/config.json with a
generated JWT secret and creates the admin user in SQLite.

Usage:
    python scripts/bootstrap_auth.py --project-dir /path/to/project \
                                      --username admin \
                                      --password secret \
                                      --domain wall.example.com
"""

import argparse
import json
import os
import sys
from pathlib import Path

# Ensure project lib is importable
PROJECT_DIR = Path(".")


def main() -> None:
    parser = argparse.ArgumentParser(description="Bootstrap Vacuum Wall auth")
    parser.add_argument("--project-dir", required=True, help="Project root directory")
    parser.add_argument("--username", required=True, help="Admin username")
    parser.add_argument("--password", required=True, help="Admin password")
    parser.add_argument("--domain", required=True, help="Management domain (rp_id)")
    args = parser.parse_args()

    project_dir = Path(args.project_dir).resolve()
    sys.path.insert(0, str(project_dir))

    # Set DB path before importing lib modules
    db_path = str(project_dir / "data" / "auth.db")
    os.environ["VACUUM_WALL_DB_BACKEND"] = "sqlite"
    os.environ["VACUUM_WALL_DB_PATH"] = db_path

    from lib.auth_users import ALL_SUBSYSTEMS, create_user

    # Write config
    config_dir = project_dir / "config" / "auth"
    config_dir.mkdir(parents=True, exist_ok=True)
    config_path = config_dir / "config.json"

    config = {
        "jwt": {
            "access_token_ttl": 900,
            "refresh_token_ttl": 604800,
            "algorithm": "HS256",
        },
        "webauthn": {
            "rp_name": "Vacuum Wall",
            "rp_id": args.domain,
            "origin": f"https://{args.domain}",
        },
    }

    with open(config_path, "w") as f:
        json.dump(config, f, indent=2)
        f.write("\n")

    print(f"Wrote auth config: {config_path}")

    # Initialize DB and create admin user
    permissions = {sub: "rw" for sub in ALL_SUBSYSTEMS}
    user = create_user(args.username, args.password, permissions)

    print(f"Created admin user: {user['username']} (id={user['id']})")
    print(f"Permissions: {len(permissions)} subsystems, all 'rw'")


if __name__ == "__main__":
    main()