#!/bin/bash
# Create an Eventyay superuser (organizer admin account).
#
# Required for first-time setup — the web UI cannot be accessed until
# at least one superuser exists.
#
# Runs on the worker pod because the web pod's memory limit is too tight
# to run an additional Django process alongside gunicorn workers.
set -e
set -o pipefail

if [ -z "${KUBECONFIG}" ] || [ -z "${WILD_INSTANCE}" ] || [ -z "${WILD_API_DATA_DIR}" ]; then
    echo "ERROR: KUBECONFIG, WILD_INSTANCE, and WILD_API_DATA_DIR must be set"
    exit 1
fi

if [ -z "${EMAIL}" ]; then
    echo "ERROR: EMAIL is required"
    exit 1
fi

CONFIG_FILE="${WILD_API_DATA_DIR}/instances/${WILD_INSTANCE}/config.yaml"

NAMESPACE="$(yq '.apps.eventyay.namespace' "${CONFIG_FILE}" | tr -d '"')"
NAMESPACE="${NAMESPACE:-eventyay}"

# Run on the worker pod — same image as web, but with a higher memory limit
# which is needed to run manage.py alongside the existing gunicorn workers.
POD="$(kubectl get pods -n "${NAMESPACE}" -l component=worker --field-selector=status.phase=Running -o jsonpath='{.items[0].metadata.name}' 2>/dev/null)"
if [ -z "${POD}" ]; then
    echo "ERROR: No running Eventyay worker pod found in namespace ${NAMESPACE}"
    exit 1
fi

if [ -z "${PASSWORD}" ]; then
    PASSWORD="$(openssl rand -base64 24 | tr -d '/+=' | head -c 24)"
fi

echo "Creating superuser '${EMAIL}'..."

kubectl exec -n "${NAMESPACE}" "${POD}" -- \
    python manage.py shell -c "
from django.contrib.auth import get_user_model
User = get_user_model()
if User.objects.filter(email='${EMAIL}').exists():
    raise SystemExit('ERROR: User ${EMAIL} already exists')
User.objects.create_superuser(email='${EMAIL}', password='${PASSWORD}')
"

echo ""
echo "=== Superuser created ==="
echo "Email:    ${EMAIL}"
echo "Password: ${PASSWORD}"
echo ""
echo "Log in at /orga/login/ with these credentials."
echo "Save this password — it will not be shown again."