#!/usr/bin/env python3
"""Provision and verify the demo account without replacing an existing password."""
import json
import sys
import urllib.error
import urllib.request
from bootstrap_auth import AUTH_DIR, read_env


def request(url, key, method='GET', payload=None):
    headers = {'apikey': key, 'Authorization': f'Bearer {key}', 'Content-Type': 'application/json'}
    body = json.dumps(payload).encode() if payload is not None else None
    with urllib.request.urlopen(urllib.request.Request(url, data=body, headers=headers, method=method), timeout=15) as response:
        return json.load(response)


def main():
    values = read_env(AUTH_DIR / '.env')
    url = f"http://127.0.0.1:{values['SUPABASE_PORT']}/auth/v1"
    credentials = {'email': values['DEMO_EMAIL'], 'password': values['DEMO_PASSWORD']}
    existing = None
    page = 1
    while True:
        users = request(f'{url}/admin/users?page={page}&per_page=100', values['SUPABASE_SERVICE_KEY']).get('users', [])
        existing = next((user for user in users if user.get('email') == credentials['email']), None)
        if existing or len(users) < 100:
            break
        page += 1
    if not existing:
        request(f'{url}/admin/users', values['SUPABASE_SERVICE_KEY'], 'POST', {
            **credentials, 'email_confirm': True, 'user_metadata': {'name': 'Demo user'},
        })
        print('Created demo account.')
    session = request(f'{url}/token?grant_type=password', values['SUPABASE_ANON_KEY'], 'POST', credentials)
    if not session.get('access_token') or not session.get('user', {}).get('email') == credentials['email']:
        raise RuntimeError('Demo login verification failed')
    print('Demo password login verified. Credentials are stored in deploy/supabase/.env.')


if __name__ == '__main__':
    try:
        main()
    except urllib.error.HTTPError as error:
        print(f'Demo account setup failed (HTTP {error.code}).', file=sys.stderr)
        sys.exit(1)