#!/bin/sh
set -e

# Generate session secret if not set or default
if [ "$TEN31_SESSION_SECRET" = "change-me" ]; then
  if [ -f /data/.session-secret ]; then
    export TEN31_SESSION_SECRET=$(cat /data/.session-secret)
  else
    export TEN31_SESSION_SECRET=$(python3 -c "import secrets; print(secrets.token_hex(32))")
    echo "$TEN31_SESSION_SECRET" > /data/.session-secret
    chmod 600 /data/.session-secret
  fi
fi

# Create first approver on first boot if no users exist
if [ ! -f /data/.initialized ]; then
  echo "First boot: running migrations and creating default approver..."

  # Set default credentials (user can change via CLI later)
  ADMIN_NAME="${TEN31_ADMIN_NAME:-Admin}"
  ADMIN_EMAIL="${TEN31_ADMIN_EMAIL:-admin@ten31.com}"
  ADMIN_PASSWORD="${TEN31_ADMIN_PASSWORD:-changeme}"

  python3 -m ten31portal.cli create-user \
    --name "$ADMIN_NAME" \
    --email "$ADMIN_EMAIL" \
    --role approver \
    --password "$ADMIN_PASSWORD" || true

  touch /data/.initialized
  echo "Default approver created: $ADMIN_EMAIL"
fi

# Serve frontend static files from the backend
exec uvicorn ten31portal.main:app \
  --host 0.0.0.0 \
  --port 8000 \
  --log-level info