import { eq, sql } from "drizzle-orm";
import { closeDb, getDb, platformAdministrators, user } from "@album/database";

// Promote an existing verified account, never create credentials or bypass email verification.
const userId = process.argv[2];
if (!userId) throw new Error("Usage: bun packages/database/src/bootstrap-admin.ts <verified-user-id>");
try {
  await getDb().transaction(async tx => {
    await tx.execute(sql`LOCK TABLE platform_administrators IN EXCLUSIVE MODE`);
    if ((await tx.select({id:platformAdministrators.id}).from(platformAdministrators).limit(1)).length) throw new Error("An administrator already exists; use the admin UI instead");
    const [existing] = await tx.select({id:user.id,verified:user.emailVerified}).from(user).where(eq(user.id,userId));
    if (!existing?.verified) throw new Error("Account must exist and have verified email");
    await tx.insert(platformAdministrators).values({userId,role:"super_admin"});
  });
  console.info("Initial administrator promoted");
} finally { await closeDb(); }