#!/usr/bin/env python3
"""Setup script for initial admin creation.
Called by install.sh with arguments via sys.argv (avoids heredoc injection)."""
import sys
import os

if len(sys.argv) < 5:
    print("Usage: setup_admin.py <install_dir> <admin_user> <admin_pass> <hostname>")
    sys.exit(1)

install_dir = sys.argv[1]
admin_user = sys.argv[2]
admin_pass = sys.argv[3]
hostname = sys.argv[4]

sys.path.insert(0, install_dir)

from app import create_app
from database import db
from models import Admin
from werkzeug.security import generate_password_hash

app = create_app({"DISABLE_SCHEDULER": True})
with app.app_context():
    admin = Admin.query.first()
    if admin:
        admin.username = admin_user
        admin.password = generate_password_hash(admin_pass)
    else:
        db.session.add(Admin(username=admin_user, password=generate_password_hash(admin_pass)))

    from models import CertificateAuthority
    ca = CertificateAuthority.query.filter_by(name="Limristem Primary CA").first()
    if not ca:
        primary_ca_crt = os.path.join(install_dir, 'instance', 'primary_ca.crt')
        primary_ca_key = os.path.join(install_dir, 'instance', 'primary_ca.key')
        if os.path.exists(primary_ca_crt) and os.path.exists(primary_ca_key):
            db.session.add(CertificateAuthority(
                name="Limristem Primary CA",
                cert_path=primary_ca_crt,
                key_path=primary_ca_key,
                is_panel_root=True
            ))

    db.session.commit()