"""Create the demo admin login the platform injects at deploy.

The platform generates DEMO_EMAIL / DEMO_PASSWORD, sets them in the environment
and runs this script. We create an admin account with that username/password so
the deployed app can be opened. Idempotent: re-running only updates the password.

The public admin login is username-based, so DEMO_EMAIL is used as the username.
The built-in ``DEVTeacher`` account still exists for the teacher.
"""

from __future__ import annotations

import os

from app.db import Base, SessionLocal, engine
from app.models import AdminUser
from app.security import hash_password


def main() -> None:
    email = os.environ.get("DEMO_EMAIL")
    password = os.environ.get("DEMO_PASSWORD")
    if not email or not password:
        print("[seed_demo] DEMO_EMAIL / DEMO_PASSWORD not set; skipping")
        return

    Base.metadata.create_all(bind=engine)
    db = SessionLocal()
    try:
        user = db.query(AdminUser).filter(AdminUser.username == email).first()
        if user is None:
            user = AdminUser(username=email, password_hash=hash_password(password))
            db.add(user)
            print(f"[seed_demo] created demo admin {email}")
        else:
            user.password_hash = hash_password(password)
            print(f"[seed_demo] updated demo admin {email}")
        db.commit()
    finally:
        db.close()


if __name__ == "__main__":
    main()