"""First-run seeding. Creates the default ``admin`` / ``admin`` account when
``radadmin_admins`` is empty, forcing a password change on first login.
Idempotent: once any admin exists this does nothing.
"""

import logging

from sqlalchemy import func, select

from . import auth
from .database import SessionLocal
from .models import Admin

log = logging.getLogger("uvicorn.error")

DEFAULT_USERNAME = "admin"
DEFAULT_PASSWORD = "admin"


def seed_default_admin() -> None:
    db = SessionLocal()
    try:
        count = db.execute(select(func.count()).select_from(Admin)).scalar_one()
        if count:
            return
        db.add(
            Admin(
                username=DEFAULT_USERNAME,
                password_hash=auth.hash_password(DEFAULT_PASSWORD),
                is_admin=True,
                must_change_password=True,
            )
        )
        db.commit()
        log.warning(
            "Seeded default admin account '%s' / '%s' — change this password on first login.",
            DEFAULT_USERNAME,
            DEFAULT_PASSWORD,
        )
    except Exception as exc:  # never block startup on a seeding hiccup
        db.rollback()
        log.error("Could not seed default admin: %s", exc)
    finally:
        db.close()