/**
 * OPS125 — bootstrap the synthetic staging test account.
 *
 * Creates/updates the `campaignUser` used for manual testing at
 * `https://staging.jorgesolla1313.com.br` (the mandatory `work-issue`
 * post-deploy verification that used it was removed in OPS128; the
 * infrastructure stays). Runs ONLY against the `teqo_staging` database on the
 * homeserver, guarded by `assertStagingTestAccountTarget` (see
 * `scripts/lib/staging-test-account.mjs`).
 *
 * The password comes from `STAGING_TEST_ACCOUNT_PASSWORD` (never in code, never
 * committed) — read from `~/stack/teqo-staging.env` on the homeserver:
 *
 *   ssh homeserver
 *   cd ~/teqo-deploy && pnpm install
 *   set -a; source ~/stack/teqo-staging.env; set +a
 *   export DATABASE_URL="${DATABASE_URL/@postgres:5432/@127.0.0.1:5434}"
 *   STAGING_TEST_ACCOUNT_CONFIRM=1 pnpm campaign:staging:test-account
 *
 * Re-run after recreating the staging DB (e.g. a fresh copy of production).
 * Runbook: docs/ops/teqo-1313-deploy.md §Staging.
 *
 * Whoever consumes the credential (agent or human) NEVER runs this script and
 * never receives `DATABASE_URL` — login happens only in the application.
 */

import { getPayload } from 'payload'

import { dieWithLabel, loadCliEnv } from './lib/cli.mjs'
import {
  assertStagingTestAccountPassword,
  assertStagingTestAccountTarget,
  STAGING_DATABASE_NAME,
  STAGING_TEST_ACCOUNT,
  STAGING_TEST_ACCOUNT_PASSWORD_ENV,
  upsertStagingTestAccount,
} from './lib/staging-test-account.mjs'

loadCliEnv()

const die = dieWithLabel('staging:test-account')

const run = async () => {
  const password = process.env[STAGING_TEST_ACCOUNT_PASSWORD_ENV]
  try {
    assertStagingTestAccountPassword(password)
    assertStagingTestAccountTarget()
  } catch (error) {
    die(error instanceof Error ? error.message : String(error))
  }

  const config = (await import('../src/payload.config.ts')).default
  const payload = await getPayload({ config })
  const result = await upsertStagingTestAccount(payload, { password })

  // Never log the password — only the identity and the target.
  console.log(
    `[staging:test-account] ${result.operation} ${STAGING_TEST_ACCOUNT.email} ` +
      `(role ${STAGING_TEST_ACCOUNT.role}, id ${result.id}) on ${STAGING_DATABASE_NAME}`,
  )
  process.exit(0)
}

run().catch((error) => die(error?.message || String(error)))