#!/bin/sh
set -eu

if ! command -v docker >/dev/null 2>&1; then
    printf '%s\n' "Docker is required." >&2
    exit 1
fi

if ! docker compose ps --status running --services 2>/dev/null | grep -qx "eternityproject"; then
    printf '%s\n' "The eternityproject Docker service must be running." >&2
    exit 1
fi

printf '%s' "Enter new admin password (10+ characters): "
stty -echo
IFS= read -r password
stty echo
printf '\n'
trap 'stty echo 2>/dev/null || true; unset password' EXIT HUP INT TERM

if [ "${#password}" -lt 10 ]; then
    printf '%s\n' "The new password must have at least 10 characters." >&2
    exit 1
fi

printf '%s\n' "$password" | docker compose exec -T eternityproject python -c '
import sys
from werkzeug.security import generate_password_hash
from app import app, get_db

password = sys.stdin.readline().rstrip("\r\n")
if len(password) < 10:
    raise SystemExit("The new password must have at least 10 characters.")
with app.app_context():
    database = get_db()
    result = database.execute(
        "UPDATE users SET password_hash = ?, mfa_secret = NULL, mfa_enabled = 0 WHERE username = '\''admin'\'' AND role = '\''admin'\''",
        (generate_password_hash(password),),
    )
    database.commit()
    if result.rowcount != 1:
        raise SystemExit("The administrator account was not found.")
print("ADMIN_PASSWORD_ROTATED_MFA_RESET")
'