services/adminAuthService.js

const bcrypt = require('bcrypt');
const AdminUser = require('../models/AdminUser');
const { env } = require('../configs/env');

const DEFAULT_ADMIN_USERNAME = 'admin';
const DEFAULT_ADMIN_NAME = 'Administrator';
const BCRYPT_SALT_ROUNDS = 12;

let initPromise = null;

const resolveBootstrapCredentials = () => {
  const username = env.adminBootstrapUsername || DEFAULT_ADMIN_USERNAME;
  const name = env.adminBootstrapName || DEFAULT_ADMIN_NAME;
  const password = env.adminBootstrapPassword;

  if (!password) {
    throw new Error('ADMIN_BOOTSTRAP_PASSWORD is not configured. Set it in the environment before first admin login.');
  }

  if (password.length < env.adminPasswordMinLength) {
    throw new Error(`Admin bootstrap password must be at least ${env.adminPasswordMinLength} characters`);
  }

  return {
    username,
    name,
    password,
  };
};

const ensureAdminInitialized = () => {
  if (!initPromise) {
    initPromise = (async () => {
      const existing = await AdminUser.findOne({ role: 'admin' }).select('_id username').lean();
      if (existing) return;

      const bootstrap = resolveBootstrapCredentials();
      const passwordHash = await bcrypt.hash(bootstrap.password, BCRYPT_SALT_ROUNDS);
      await AdminUser.create({
        username: bootstrap.username,
        name: bootstrap.name,
        passwordHash,
        role: 'admin',
      });
    })();
  }
  return initPromise;
};

module.exports = {
  ensureAdminInitialized,
};