#!/bin/sh
# Sets SUPER_ADMIN_EMAIL/FIRST_NAME/LAST_NAME in every business's .env
# under STACKS_DIR and recreates each container so
# scripts/ensure-super-admin.ts (run on every container start via
# docker/entrypoint.sh) picks it up immediately. No password to set —
# sign-in is OTP-only; see ensure-super-admin.ts's own header for why.
#
# Only touches these three keys in each .env — every other secret/setting
# already in the file (Google/email/push credentials, etc.) is left
# byte-for-byte alone. Safe to re-run any time you want to change who the
# Super Administrator is, or after adding a new business.
#
# Usage:
#   set-super-admin.sh <email> <first-name> <last-name>
#
# STACKS_DIR defaults to /opt/nextchair/stacks — override via env var if
# this repo is cloned somewhere else.

set -eu

if [ $# -lt 3 ]; then
  echo "Usage: $0 <email> <first-name> <last-name>" >&2
  exit 1
fi
EMAIL="$1"
FIRST_NAME="$2"
LAST_NAME="$3"
STACKS_DIR="${STACKS_DIR:-/opt/nextchair/stacks}"

if [ ! -d "$STACKS_DIR" ]; then
  echo "STACKS_DIR '$STACKS_DIR' does not exist." >&2
  exit 1
fi

for env_file in "$STACKS_DIR"/*/.env; do
  [ -f "$env_file" ] || continue
  dir=$(dirname "$env_file")
  slug=$(basename "$dir")

  tmp="${env_file}.tmp.$$"
  awk -v email="$EMAIL" -v first="$FIRST_NAME" -v last="$LAST_NAME" '
    BEGIN { seen_email=0; seen_first=0; seen_last=0 }
    /^SUPER_ADMIN_EMAIL=/ { print "SUPER_ADMIN_EMAIL=\"" email "\""; seen_email=1; next }
    /^SUPER_ADMIN_FIRST_NAME=/ { print "SUPER_ADMIN_FIRST_NAME=\"" first "\""; seen_first=1; next }
    /^SUPER_ADMIN_LAST_NAME=/ { print "SUPER_ADMIN_LAST_NAME=\"" last "\""; seen_last=1; next }
    /^SUPER_ADMIN_PASSWORD=/ { next }
    { print }
    END {
      if (!seen_email) print "SUPER_ADMIN_EMAIL=\"" email "\""
      if (!seen_first) print "SUPER_ADMIN_FIRST_NAME=\"" first "\""
      if (!seen_last) print "SUPER_ADMIN_LAST_NAME=\"" last "\""
    }
  ' "$env_file" > "$tmp" && mv "$tmp" "$env_file"

  echo "[$slug] .env updated — recreating container..."
  if (cd "$dir" && docker compose up -d --force-recreate) > /tmp/set-super-admin-$$.log 2>&1; then
    echo "[$slug] ok"
  else
    echo "[$slug] FAILED to recreate container:" >&2
    cat /tmp/set-super-admin-$$.log >&2
  fi
  rm -f /tmp/set-super-admin-$$.log
done