"""Create ceo + cfo users (role: Uprava) with generated 8-char passwords."""
import secrets
import bcrypt
from sqlalchemy import text
from backend.models.database import SessionLocal

ROLE = "Uprava"
USERS = [
    ("ceo", "CEO"),
    ("cfo", "CFO"),
]
ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz23456789"

db = SessionLocal()
try:
    print(f"Creating Uprava users — role enforced as '{ROLE}'\n")
    for username, display in USERS:
        password = "".join(secrets.choice(ALPHABET) for _ in range(8))
        pw_hash = bcrypt.hashpw(password.encode("utf-8"), bcrypt.gensalt()).decode("utf-8")

        existing = db.execute(
            text("SELECT id FROM users WHERE username = :u"), {"u": username},
        ).scalar()
        if existing:
            db.execute(text("""
                UPDATE users SET password_hash = :ph, display_name = :dn,
                                  role = :r, active = TRUE
                 WHERE username = :u
            """), {"ph": pw_hash, "dn": display, "r": ROLE, "u": username})
            action = "UPDATED"
        else:
            db.execute(text("""
                INSERT INTO users (username, display_name, password_hash, role, active)
                VALUES (:u, :dn, :ph, :r, TRUE)
            """), {"u": username, "dn": display, "ph": pw_hash, "r": ROLE})
            action = "CREATED"
        db.commit()
        print(f"{action}: {username:<8s}  role={ROLE}  password={password}")
finally:
    db.close()