/** Creates the owner account from OWNER_EMAIL / OWNER_INITIAL_PASSWORD (first run only). The password must be changed at first login. */
import "./_env";
import { eq } from "drizzle-orm";
import { db, schema, closeDb } from "../src/db";
import { hashPassword, passwordPolicy } from "../src/lib/auth/password";
const email = process.env.OWNER_EMAIL?.toLowerCase().trim(); const pw = process.env.OWNER_INITIAL_PASSWORD;
if (!email || !pw) { console.error("OWNER_EMAIL and OWNER_INITIAL_PASSWORD required"); process.exit(1); }
const policy = passwordPolicy(pw); if (policy) { console.error(`OWNER_INITIAL_PASSWORD rejected: ${policy}`); process.exit(1); }
const [existing] = await db.select({ id: schema.users.id }).from(schema.users).where(eq(schema.users.email, email));
if (existing) console.log(`owner ${email} already exists — nothing to do`);
else { await db.insert(schema.users).values({ email, displayName: "Owner", passwordHash: await hashPassword(pw), role: "owner", mustChangePassword: true }); console.log(`owner ${email} created (must change password at first login)`); }
await closeDb();