"""Provision the isolated OpenAI plugin-review account and sample tenant.

The password is supplied at runtime (or through ``P2HS_REVIEWER_PASSWORD``); it
is never written to source control or printed by this script. Run only after the
178 migration has been applied to the intended database.
"""
from __future__ import annotations

import argparse
import asyncio
import getpass
import os
import sys
from datetime import datetime, timezone
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
if str(ROOT) not in sys.path:
    sys.path.insert(0, str(ROOT))

from sqlalchemy import select

from src.core.database import async_session_factory
from src.core.orm_import import import_all_orm_models
from src.core.security.hashing import hash_password
from src.domain.auth.models import User
from src.domain.auth.repository import UserRepository
from src.domain.projects.models import Project
from src.domain.projects.repository import ProjectJobOutboxRepository, ProjectRepository, ProjectSettingsRepository
from src.domain.workspaces.models import Role, Workspace, WorkspaceMembership, WorkspaceSettings, ROLE_PERMISSIONS
from src.domain.workspaces.repository import WorkspaceRepository

import_all_orm_models()


def parse_args() -> argparse.Namespace:
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("--email", default="reviewer-openai@p2hs.com")
    parser.add_argument("--workspace-name", default="OpenAI Plugin Review")
    parser.add_argument("--project-name", default="OpenAI Review Demo")
    parser.add_argument("--password", help="Reviewer password; omitted to prompt securely")
    return parser.parse_args()


async def provision(args: argparse.Namespace, password: str) -> None:
    async with async_session_factory() as db:
        users = UserRepository(db)
        email = args.email.strip().lower()
        user = await users.get_by_email(email)
        if user is None:
            user = await users.create(email=email, display_name="OpenAI Plugin Reviewer")
        user.email_verified_at = user.email_verified_at or datetime.now(timezone.utc)
        user.password_hash = hash_password(password)
        user.password_login_enabled = True

        workspace_repo = WorkspaceRepository(db)
        workspace = (
            await db.execute(
                select(Workspace).where(Workspace.owner_id == user.id).where(Workspace.name == args.workspace_name)
            )
        ).scalar_one_or_none()
        if workspace is None:
            workspace = await workspace_repo.create(
                slug="openai-plugin-review",
                name=args.workspace_name,
                owner_id=user.id,
                selected_plan_slug="staff",
                onboarding_status="plan_selected",
                skip_plan_quota_limits=True,
            )
        # This tenant is a synthetic, no-production-billing reviewer sandbox.
        # Keep normal paid-workspace MFA policy unchanged everywhere else.
        workspace.security_policy_require_mfa_for_paid_users = False

        role = (
            await db.execute(select(Role).where(Role.workspace_id.is_(None)).where(Role.name == "owner"))
        ).scalar_one_or_none()
        if role is None:
            role = Role(name="owner", workspace_id=None, permissions=ROLE_PERMISSIONS["owner"], is_system=True)
            db.add(role)
            await db.flush()
        membership = (
            await db.execute(
                select(WorkspaceMembership)
                .where(WorkspaceMembership.workspace_id == workspace.id)
                .where(WorkspaceMembership.user_id == user.id)
            )
        ).scalar_one_or_none()
        if membership is None:
            db.add(WorkspaceMembership(workspace_id=workspace.id, user_id=user.id, role_id=role.id))
        settings = (
            await db.execute(select(WorkspaceSettings).where(WorkspaceSettings.workspace_id == workspace.id))
        ).scalar_one_or_none()
        if settings is None:
            db.add(WorkspaceSettings(workspace_id=workspace.id))

        project_repo = ProjectRepository(db)
        project = (
            await db.execute(
                select(Project)
                .where(Project.workspace_id == workspace.id)
                .where(Project.name == args.project_name)
                .where(Project.deleted_at.is_(None))
            )
        ).scalar_one_or_none()
        if project is None:
            project = await project_repo.create(
                workspace_id=workspace.id,
                slug="openai-review-demo",
                name=args.project_name,
                project_type="react_app",
                description="Synthetic sample project for OpenAI plugin review.",
                created_by=user.id,
            )
            await ProjectSettingsRepository(db).get_or_create(project.id)
            await ProjectJobOutboxRepository(db).insert_initial_project_jobs(project.id)

        await db.commit()
        print(f"Provisioned reviewer account: {email}")
        print(f"Workspace: {workspace.name} ({workspace.id})")
        print(f"Project: {project.name} ({project.id})")


def main() -> None:
    args = parse_args()
    password = args.password or os.getenv("P2HS_REVIEWER_PASSWORD") or getpass.getpass("Reviewer password: ")
    if len(password) < 12:
        raise SystemExit("Reviewer password must be at least 12 characters.")
    asyncio.run(provision(args, password))


if __name__ == "__main__":
    main()