import json, os, subprocess

SITE = os.environ.get("SITE_NAME", "hisham-cmd-ofoqerp.hf.space")
ADMIN_PASSWORD = os.environ.get("ADMIN_PASSWORD", "admin")
SITES_DIR = "/home/frappe/frappe-bench/sites"

config_path = f"{SITES_DIR}/{SITE}/site_config.json"
if not os.path.exists(config_path):
    print(f"SKIP: no site_config at {config_path}")
    exit(0)

config = json.load(open(config_path))
db_name = config["db_name"]
print(f"DB: {db_name}")

from passlib.hash import pbkdf2_sha256
hash = pbkdf2_sha256.hash(ADMIN_PASSWORD)
print(f"Hash prefix: {hash[:50]}...")

# Verify passlib hash works
assert pbkdf2_sha256.verify(ADMIN_PASSWORD, hash), "Hash verification failed!"
print("Hash self-verify: OK")

# Update __Auth table (Frappe v15 uses passlib pbkdf2_sha256)
r = subprocess.run(
    ["mysql", "-u", "root", "-pmysql_root", db_name,
     "-e", f"UPDATE __Auth SET `password`='{hash}' WHERE doctype='User' AND name='Administrator' AND fieldname='password'"],
    capture_output=True, text=True, timeout=15
)
print(f"mysql stdout: {r.stdout.strip() or '(empty)'}")
print(f"mysql stderr: {r.stderr.strip() or '(empty)'}")
print(f"mysql returncode: {r.returncode}")
print(f"Rows affected: (check output)")

# Verify the update
r2 = subprocess.run(
    ["mysql", "-u", "root", "-pmysql_root", db_name,
     "-e", "SELECT doctype, name, fieldname, LEFT(`password`,40) FROM __Auth WHERE doctype='User' AND name='Administrator'"],
    capture_output=True, text=True, timeout=15
)
print(f"Verify:\n{r2.stdout.strip() or r2.stderr.strip()}")

# Double-check with passlib
r3 = subprocess.run(
    ["mysql", "-u", "root", "-pmysql_root", db_name,
     "-e", "SELECT `password` FROM __Auth WHERE doctype='User' AND name='Administrator' AND fieldname='password'"],
    capture_output=True, text=True, timeout=15
)
if r3.returncode == 0 and r3.stdout:
    lines = [l.strip() for l in r3.stdout.split('\n') if l.strip() and l.strip() != 'password']
    if lines:
        stored = lines[0]
        match = pbkdf2_sha256.verify(ADMIN_PASSWORD, stored)
        print(f"Post-update verify: {match}")
        if not match:
            print("WARNING: Hash update may have failed!")
    else:
        print("WARNING: No rows found in __Auth for Administrator!")
else:
    print(f"Verify query failed: {r3.stderr.strip()}")