$securePassword = Read-Host "Enter new admin password (10+ characters)" -AsSecureString
$pointer = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($securePassword)

try {
    $password = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($pointer)
    if ($password.Length -lt 10) {
        throw "The new password must have at least 10 characters."
    }

    $password | docker compose exec -T eternityproject python -c @'
import sys
from werkzeug.security import generate_password_hash
from app import app, get_db

password = sys.stdin.readline().rstrip("\r\n")
if len(password) < 10:
    raise SystemExit("The new password must have at least 10 characters.")
with app.app_context():
    database = get_db()
    result = database.execute(
        "UPDATE users SET password_hash = ?, mfa_secret = NULL, mfa_enabled = 0 WHERE username = 'admin' AND role = 'admin'",
        (generate_password_hash(password),),
    )
    database.commit()
    if result.rowcount != 1:
        raise SystemExit("The administrator account was not found.")
print("ADMIN_PASSWORD_ROTATED_MFA_RESET")
'@
    if ($LASTEXITCODE -ne 0) {
        exit $LASTEXITCODE
    }
}
finally {
    if ($pointer -ne [IntPtr]::Zero) {
        [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($pointer)
    }
}