#!/usr/bin/env bash
# Crée (ou met à jour) le compte admin avec toutes les capacités. Génère un mot de passe si non fourni.
# Usage: ADMIN_PASS='monmotdepasse' scripts/40-create-admin.sh   (sinon mot de passe aléatoire)
source "$(dirname "$0")/lib.sh"

PASS="${ADMIN_PASS:-$(openssl rand -base64 18 | tr -d '/+=' | head -c 20)}"
log "Compte admin $ADMIN_EMAIL…"
dexi ark-backend env E="$ADMIN_EMAIL" P="$PASS" N="$ADMIN_DISPLAY_NAME" arkindex shell <<'PYEOF' 2>&1 | tail -2
import os
from django.contrib.auth import get_user_model
U = get_user_model()
email, pw, name = os.environ["E"], os.environ["P"], os.environ["N"]
u = U.objects.filter(email=email).first() or U.objects.create_superuser(email=email, display_name=name, password=pw)
u.set_password(pw); u.is_admin = True; u.verified_email = True
for f in ["can_upload_s3_image","can_create_iiif_image","can_ingest","can_manage_workers","can_create_worker_version","can_validate_images"]:
    setattr(u, f, True)
u.save()
print("admin OK:", u.email, "is_admin =", u.is_admin)
PYEOF
ok "Admin prêt."
echo "########################################"
echo "  Email    : $ADMIN_EMAIL"
echo "  Password : $PASS"
echo "  (à changer après la 1ère connexion)"
echo "########################################"