"""
Local Terminal Recovery Script — Reset Master Password.

Security Invariant:
  • Executes ONLY on the local host via terminal/CLI.
  • Directly modifies the local SQLite app.db — never exposed over HTTP/network.
"""

from __future__ import annotations

import argparse
import getpass
import sqlite3
import sys
from datetime import UTC, datetime
from pathlib import Path

import bcrypt

ROOT_DIR = Path(__file__).resolve().parents[1]
APP_DB = ROOT_DIR / "app.db"


def reset_password(new_password: str) -> None:
    if len(new_password) < 8:
        print("Error: Password must be at least 8 characters.", file=sys.stderr)
        sys.exit(1)

    APP_DB.parent.mkdir(parents=True, exist_ok=True)
    conn = sqlite3.connect(str(APP_DB))
    cur = conn.cursor()
    cur.execute(
        """CREATE TABLE IF NOT EXISTS auth_config (
            key        TEXT PRIMARY KEY,
            value      TEXT NOT NULL,
            updated_at TEXT NOT NULL
        )"""
    )

    pw_bytes = new_password.encode("utf-8")[:72]
    pw_hash = bcrypt.hashpw(pw_bytes, bcrypt.gensalt()).decode("utf-8")
    now = datetime.now(UTC).isoformat()
    cur.execute(
        """INSERT INTO auth_config(key, value, updated_at) VALUES (?,?,?)
           ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at""",
        ("master_password_hash", pw_hash, now),
    )
    conn.commit()
    conn.close()
    print("[OK] Master password reset successfully in app.db.")


if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="Reset PA/POS master password locally from the server console.")
    parser.add_argument("--password", type=str, help="New master password (optional; prompted securely if omitted)")
    args = parser.parse_args()

    password = args.password
    if not password:
        password = getpass.getpass("Enter new master password (min 8 chars): ")
        confirm = getpass.getpass("Confirm new master password: ")
        if password != confirm:
            print("Error: Passwords do not match.", file=sys.stderr)
            sys.exit(1)

    reset_password(password)