import argparse
import os
from sqlalchemy import text

from app.core.db import db_session
from app.core.security import normalize_email
from app.services.auth_service import hash_password


def create_admin(email: str, names: str, surnames: str):
    password = os.environ.get("DOCUMENTA_BOOTSTRAP_PASSWORD", "")
    if len(password) < 12:
        raise SystemExit("La contraseña debe tener al menos 12 caracteres")
    email = normalize_email(email)
    with db_session() as db:
        user = db.execute(text("SELECT id FROM usuarios WHERE email=:email FOR UPDATE"), {"email": email}).scalar()
        if user:
            db.execute(text("UPDATE usuarios SET password_hash=:password,activo=TRUE WHERE id=:id"),
                       {"password": hash_password(password), "id": user})
        else:
            user = db.execute(text("""
              INSERT INTO usuarios (uuid,email,password_hash,nombres,apellidos,email_verificado_en)
              VALUES (UNHEX(REPLACE(UUID(),'-','')),:email,:password,:names,:surnames,UTC_TIMESTAMP(6))
            """), {"email": email, "password": hash_password(password), "names": names, "surnames": surnames}).lastrowid
        db.execute(text("""
          INSERT IGNORE INTO usuarios_roles (usuario_id,rol_id)
          SELECT :user,id FROM roles WHERE codigo='ADMIN_PLATAFORMA'
        """), {"user": user})
    print(f"Administrador preparado: {email}. Debe configurar 2FA al primer ingreso.")


if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    sub = parser.add_subparsers(dest="command", required=True)
    admin = sub.add_parser("create-admin")
    admin.add_argument("--email", required=True)
    admin.add_argument("--names", required=True)
    admin.add_argument("--surnames", required=True)
    args = parser.parse_args()
    if args.command == "create-admin":
        create_admin(args.email, args.names, args.surnames)