/**
 * Add (or update) a supervisor who can access the Command Center.
 *
 * Usage:
 *   SUPABASE_URL=... SUPABASE_SECRET_KEY=sb_secret_... \
 *     node add-supervisor.js <email> <password>
 *
 * Creates an auto-confirmed Supabase user with app_metadata.role = "supervisor"
 * (the role the backend + login page require). Re-running for an existing email
 * resets the password and ensures the role.
 */
'use strict';
const { createClient } = require('@supabase/supabase-js');

const URL = process.env.SUPABASE_URL;
const SECRET = process.env.SUPABASE_SECRET_KEY || process.env.SUPABASE_KEY;
const [email, password] = process.argv.slice(2);

if (!URL || !SECRET) { console.error('Set SUPABASE_URL and SUPABASE_SECRET_KEY env vars.'); process.exit(1); }
if (!email || !password) { console.error('Usage: node add-supervisor.js <email> <password>'); process.exit(1); }

(async () => {
  const admin = createClient(URL, SECRET, { auth: { persistSession: false } });
  const { error } = await admin.auth.admin.createUser({
    email, password, email_confirm: true, app_metadata: { role: 'supervisor' },
  });
  if (error && /already/i.test(error.message)) {
    const list = await admin.auth.admin.listUsers();
    const u = list.data.users.find((x) => x.email === email);
    if (!u) { console.error('User exists but could not be located.'); process.exit(1); }
    await admin.auth.admin.updateUserById(u.id, { password, app_metadata: { role: 'supervisor' } });
    console.log('Updated supervisor:', email);
  } else if (error) {
    console.error('Error:', error.message); process.exit(1);
  } else {
    console.log('Created supervisor:', email);
  }
})().catch((e) => { console.error('ERROR', e.message); process.exit(1); });