#!/usr/bin/env python3
"""Seed a default tenant and admin user for LeoCRM.

Usage: python scripts/seed_admin.py

Creates:
  - Tenant: "Default Org" (slug: default)
  - Admin role with full permissions
  - Admin user: admin@media-on.de / Admin123!
  - UserTenant link with admin role

If tenant or user already exists, skips creation.

Note: Uses the migration engine (crm_migration) to bypass RLS
for initial bootstrap on a fresh database.
"""

import asyncio
import sys
import os

# Ensure app is importable
sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

from app.core.db import get_migration_engine, set_tenant_context
from app.core.auth import hash_password
from app.models.tenant import Tenant
from app.models.user import User, UserTenant
from app.models.role import Role
from sqlalchemy import select
from sqlalchemy.ext.asyncio import async_sessionmaker


async def seed():
    # Use migration engine to bypass RLS for bootstrap
    engine = get_migration_engine()
    async_session = async_sessionmaker(engine, expire_on_commit=False)

    async with async_session() as db:
        # Check if default tenant exists
        result = await db.execute(select(Tenant).where(Tenant.slug == "default"))
        tenant = result.scalar_one_or_none()

        if tenant is None:
            tenant = Tenant(name="Default Org", slug="default")
            db.add(tenant)
            await db.flush()
            print(f"Created tenant: {tenant.name} (slug: {tenant.slug}, id: {tenant.id})")
        else:
            print(f"Tenant exists: {tenant.name} (id: {tenant.id})")

        # Set tenant context for RLS
        await set_tenant_context(db, tenant.id)

        # Create admin role if not exists
        result = await db.execute(select(Role).where(Role.name == "admin", Role.tenant_id == tenant.id))
        role = result.scalar_one_or_none()

        if role is None:
            role = Role(
                tenant_id=tenant.id,
                name="admin",
                permissions={"*:*": True},
            )
            db.add(role)
            await db.flush()
            print(f"Created admin role: {role.id}")
        else:
            print(f"Admin role exists: {role.id}")

        # Check if admin user exists
        result = await db.execute(select(User).where(User.email == "admin@media-on.de"))
        user = result.scalar_one_or_none()

        if user is None:
            user = User(
                email="admin@media-on.de",
                name="Administrator",
                password_hash=hash_password(os.environ.get("ADMIN_PASSWORD", "Admin123!")),
                is_active=True,
                preferences={},
            )
            db.add(user)
            await db.flush()
            print(f"Created user: {user.email} (id: {user.id})")

            # Link user to tenant with admin role
            ut = UserTenant(
                user_id=user.id,
                tenant_id=tenant.id,
                role_id=role.id,
                is_default=True,
            )
            db.add(ut)
            await db.flush()
            print(f"Created user_tenant link with admin role")
        else:
            print(f"User exists: {user.email} (id: {user.id})")

        await db.commit()
        print("Seed completed successfully.")


if __name__ == "__main__":
    asyncio.run(seed())