/**
 * Provisions the real Supabase test user for scripts/e2e-camera.sh and prints
 * one JSON object: { id, email, password, accessToken }.
 *
 * The output carries a password and a live access token, so the caller must
 * capture it into a variable and never echo it. The account is reused rather
 * than piling up one per run: `.invalid` is reserved by RFC 2606, so the
 * address can never belong to a real person, and its password is reset every
 * time to a fresh random one that exists only for this run.
 *
 * Environment: SUPABASE_URL, SUPABASE_SECRET_KEY, SUPABASE_PUBLISHABLE_KEY.
 */
const url = process.env.SUPABASE_URL!;
const secret = process.env.SUPABASE_SECRET_KEY!;
const publishable = process.env.SUPABASE_PUBLISHABLE_KEY!;
const email = "continuum-e2e@example.invalid";
const password = `e2e-${crypto.randomUUID()}`;
const admin = { apikey: secret, Authorization: `Bearer ${secret}`, "Content-Type": "application/json" };

const die = (message: string): never => {
  console.error(`e2e-supabase-user: ${message}`);
  process.exit(1);
};

let id: string | undefined;
const made = await fetch(`${url}/auth/v1/admin/users`, {
  method: "POST",
  headers: admin,
  body: JSON.stringify({ email, password, email_confirm: true }),
});
if (made.ok) {
  id = ((await made.json()) as { id?: string }).id;
} else {
  const list = (await fetch(`${url}/auth/v1/admin/users?per_page=200`, { headers: admin }).then((r) => r.json())) as {
    users?: { id: string; email: string }[];
  };
  id = list.users?.find((u) => u.email === email)?.id;
  if (!id) die(`could not create or find the test user (HTTP ${made.status})`);
  const reset = await fetch(`${url}/auth/v1/admin/users/${id}`, {
    method: "PUT",
    headers: admin,
    body: JSON.stringify({ password, email_confirm: true }),
  });
  if (!reset.ok) die(`could not reset the test user's password (HTTP ${reset.status})`);
}

const session = (await fetch(`${url}/auth/v1/token?grant_type=password`, {
  method: "POST",
  headers: { apikey: publishable, "Content-Type": "application/json" },
  body: JSON.stringify({ email, password }),
}).then((r) => r.json())) as { access_token?: string };
if (!session.access_token || !id) die("the test user could not sign in");

console.log(JSON.stringify({ id, email, password, accessToken: session.access_token }));