package main

import (
	"context"
	"errors"
	"fmt"
	"log"
	"time"

	postgresstore "knowledge-governance/internal/platform/postgres"
)

// bootstrapInitialAdmin creates the fixed day-one administrator when the user
// table is still empty. The initial password is a known constant the operator
// hands to the owner in person; must_change_password forces a private change
// on first login before any other screen is reachable. Once any user exists
// this is a no-op, so accounts are managed through the UI afterwards.
func bootstrapInitialAdmin(ctx context.Context, store *postgresstore.Store, now func() time.Time) error {
	count, err := store.CountAuthUsers(ctx)
	if err != nil {
		return err
	}
	if count > 0 {
		return nil
	}
	_, err = store.CreateInitialAdmin(ctx, "admin", "dobotai", now().UTC())
	if errors.Is(err, postgresstore.ErrAuthDuplicateUsername) {
		return nil
	}
	if err != nil {
		return fmt.Errorf("bootstrap initial admin: %w", err)
	}
	log.Printf("bootstrap: created initial admin account (first login must change the password)")
	return nil
}