"""
Create a default superuser from environment variables, idempotently.

Reads (from the server's .env, which settings loads into the environment):
    DJANGO_SUPERUSER_USERNAME   (required)
    DJANGO_SUPERUSER_PASSWORD   (required)
    DJANGO_SUPERUSER_EMAIL      (optional)

- Does nothing if the username/password aren't set (safe to always run).
- Does nothing if a user with that username already exists (safe to run every deploy).
- Otherwise creates a superuser bound to the seeded built-in "Manager" Role
  (accounts.models.Role — see accounts/migrations/0004_seed_roles_and_permissions.py).
  Role is looked up by name at runtime rather than hardcoded, since roles are a
  configurable database model, not a fixed enum.
"""
import os

from django.contrib.auth import get_user_model
from django.core.management.base import BaseCommand


class Command(BaseCommand):
    help = "Create a default superuser from DJANGO_SUPERUSER_* env vars if it doesn't exist."

    def handle(self, *args, **options):
        User = get_user_model()

        username = os.environ.get("DJANGO_SUPERUSER_USERNAME")
        password = os.environ.get("DJANGO_SUPERUSER_PASSWORD")
        email = os.environ.get("DJANGO_SUPERUSER_EMAIL", "")

        if not username or not password:
            self.stdout.write(
                "DJANGO_SUPERUSER_USERNAME / DJANGO_SUPERUSER_PASSWORD not set — "
                "skipping default admin creation."
            )
            return

        if User.objects.filter(username=username).exists():
            self.stdout.write(f"Admin '{username}' already exists — skipping.")
            return

        extra = {}
        Role = User._meta.get_field("role").related_model
        manager_role = Role.objects.filter(is_system=True, name="Manager").first()
        if manager_role is not None:
            extra["role"] = manager_role
        else:
            self.stdout.write(self.style.WARNING(
                "No seeded 'Manager' role found — creating admin with no role. "
                "Run migrations (accounts 0004) first."
            ))

        User.objects.create_superuser(
            username=username, email=email, password=password, **extra
        )
        self.stdout.write(self.style.SUCCESS(f"Created default admin '{username}'."))