#!/bin/sh
set -e

# Generate session secret if not set or default
if [ "$TEN31_SESSION_SECRET" = "change-me" ]; then
  if [ -f /data/.session-secret ]; then
    export TEN31_SESSION_SECRET=$(cat /data/.session-secret)
  else
    export TEN31_SESSION_SECRET=$(python3 -c "import secrets; print(secrets.token_hex(32))")
    echo "$TEN31_SESSION_SECRET" > /data/.session-secret
    chmod 600 /data/.session-secret
  fi
fi

# Create first approver on first boot if no users exist
if [ ! -f /data/.initialized ]; then
  echo "First boot: running migrations and creating default approver..."

  # Set default credentials (user can change via CLI later)
  ADMIN_NAME="${TEN31_ADMIN_NAME:-Jonathan}"
  ADMIN_USERNAME="${TEN31_ADMIN_USERNAME:-admin}"
  ADMIN_EMAIL="${TEN31_ADMIN_EMAIL:-jonathan@ten31.xyz}"
  ADMIN_PASSWORD="${TEN31_ADMIN_PASSWORD:-Ten31}"

  python3 -m ten31portal.cli create-user \
    --name "$ADMIN_NAME" \
    --username "$ADMIN_USERNAME" \
    --email "$ADMIN_EMAIL" \
    --role approver \
    --password "$ADMIN_PASSWORD" \
    --service-admin || true

  touch /data/.initialized
  echo "Default approver created: username=$ADMIN_USERNAME"
fi

# Log level is overridable at runtime for debugging; defaults to info.
LOG_LEVEL="${TEN31_LOG_LEVEL:-info}"

# Serve frontend static files from the backend
exec uvicorn ten31portal.main:app \
  --host 0.0.0.0 \
  --port 8000 \
  --log-level "$LOG_LEVEL"