"""Seed the minimum needed to use the app: an admin account.

Real dogs come from batch-loaded datasets (scripts.load_dataset) or organic found/lost reports —
there is no synthetic 'generated-dot' demo data. Idempotent.

The admin password is taken from SEED_ADMIN_PASSWORD, or randomly generated and printed once.
It is deliberately not hardcoded: a password committed to a public repo is a published credential
for every copy of this project that anyone runs.

Run from the backend dir:  python -m scripts.seed
"""
from __future__ import annotations

import os
import secrets

from app.db import SessionLocal, engine
from app.models import Base, User
from app.models.base import UserRole
from app.security import hash_password

ADMIN_EMAIL = "admin@example.com"


def run() -> None:
    Base.metadata.create_all(bind=engine)
    db = SessionLocal()
    try:
        if db.query(User).filter(User.email == ADMIN_EMAIL).first():
            print(f"Admin {ADMIN_EMAIL} already present; nothing to seed.")
            return
        password = os.getenv("SEED_ADMIN_PASSWORD") or secrets.token_urlsafe(16)
        generated = not os.getenv("SEED_ADMIN_PASSWORD")
        db.add(
            User(
                name="Admin", email=ADMIN_EMAIL, zip="20001",
                password_hash=hash_password(password), role=UserRole.admin,
            )
        )
        db.commit()
        print("Seed complete.")
        print(f"  Admin login: {ADMIN_EMAIL}")
        if generated:
            print(f"  Generated password (shown once, not stored anywhere): {password}")
            print("  Set SEED_ADMIN_PASSWORD to choose your own instead.")
    finally:
        db.close()


if __name__ == "__main__":
    run()