#!/usr/bin/env python3
"""
Enterprise SuperAdmin Governance
SuperAdmin privileges are strictly code-governed via immutable email whitelist (NEVER stored in DB).
"""
import sys
import os

sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
from app.superadmin_routes import get_superadmin_whitelist

def main():
    print("\n🔒 ENTERPRISE SECURITY POLICY:")
    print("SuperAdmin privilege is NOT stored as an attribute in the database.")
    print("SuperAdmin privileges are anchored to the code-level email whitelist.")
    print("\nCurrent Authorized Whitelist:")
    for email in sorted(get_superadmin_whitelist()):
        print(f"  • {email}")
    print("\nTo add or remove SuperAdmins, update SUPERADMIN_IMMUTABLE_WHITELIST in BACKEND/app/superadmin_routes.py and kSuperAdminEmails in superadmin/lib/config.dart.")

if __name__ == "__main__":
    main()