"""Create private bootstrap account hashes without storing a password."""

import argparse
import getpass
import json
import sys
from pathlib import Path

sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
from pigway_frame_flow.core.accounts import password_hash  # noqa: E402

parser = argparse.ArgumentParser()
parser.add_argument("--username", required=True)
parser.add_argument("--config-dir", type=Path, default=Path("config"))
args = parser.parse_args()
password = getpass.getpass("Password (minimum 8 characters): ")
if len(password) < 8 or password != getpass.getpass("Confirm password: "):
    sys.exit("Password too short or confirmation mismatch")
args.config_dir.mkdir(parents=True, exist_ok=True)
path = args.config_dir / "accounts.json"
users = json.loads(path.read_text()).get("users", []) if path.exists() else []
if users:
    sys.exit("Single-user account already exists. Change the password in Settings.")
users.append({"username": args.username, "password_hash": password_hash(password)})
path.write_text(json.dumps({"users": users}) + "\n")
path.chmod(0o600)
print("Bootstrap hash saved. Restart the service to seed the account.")