"""Create the default portal superuser during deploy (idempotent, env-driven).

Credentials come from environment variables so no secret is committed:
    DJANGO_SUPERUSER_USERNAME  (default: "admin")
    DJANGO_SUPERUSER_EMAIL     (optional)
    DJANGO_SUPERUSER_PASSWORD  (required to actually create the account)

Behaviour:
  * If any superuser already exists → do nothing.
  * Else if a password is provided → create the superuser.
  * Else → print guidance and exit 0 (never break the release pipeline).
"""

import os

from django.contrib.auth import get_user_model
from django.core.management.base import BaseCommand


class Command(BaseCommand):
    help = "Create the default admin/superuser if none exists (idempotent)."

    def handle(self, *args, **options):
        User = get_user_model()

        if User.objects.filter(is_superuser=True).exists():
            self.stdout.write("A superuser already exists; nothing to do.")
            return

        username = (os.getenv("DJANGO_SUPERUSER_USERNAME") or "admin").strip()
        email = (os.getenv("DJANGO_SUPERUSER_EMAIL") or "").strip()
        password = os.getenv("DJANGO_SUPERUSER_PASSWORD") or ""

        if not password:
            self.stdout.write(self.style.WARNING(
                "No superuser exists and DJANGO_SUPERUSER_PASSWORD is not set — "
                "skipping. Set DJANGO_SUPERUSER_USERNAME/EMAIL/PASSWORD in the "
                "server environment, or run `python manage.py createsuperuser`."
            ))
            return

        if User.objects.filter(username=username).exists():
            # Promote an existing account rather than failing on a unique clash.
            user = User.objects.get(username=username)
            user.is_staff = True
            user.is_superuser = True
            user.save(update_fields=["is_staff", "is_superuser"])
            self.stdout.write(self.style.SUCCESS(f"Promoted existing user '{username}' to superuser."))
            return

        User.objects.create_superuser(username=username, email=email or "", password=password)
        self.stdout.write(self.style.SUCCESS(f"Created superuser '{username}'."))