/**
 * Promote legacy ADMIN → SUPER_ADMIN and lock primary inbox.
 * Usage: npx tsx --env-file=.env scripts/migrate-admin-roles.ts
 */
import { connectDb, disconnectDb } from "../src/db/mongoose";
import { User } from "../src/db/models";
import { migrateAdminRoles, PRIMARY_SUPER_ADMIN_EMAIL } from "../src/services/adminMigration";

async function main() {
  await connectDb();
  const result = await migrateAdminRoles();
  const primary = await User.findOne({ email: PRIMARY_SUPER_ADMIN_EMAIL })
    .select("email role status fullName")
    .lean();
  console.log("migration:", result);
  console.log("primary admin verification:", primary);
  if (!primary || primary.role !== "SUPER_ADMIN") {
    console.error("FAILED: primary admin is not SUPER_ADMIN");
    process.exit(1);
  }
  console.log(`OK: ${PRIMARY_SUPER_ADMIN_EMAIL} is SUPER_ADMIN`);
  await disconnectDb();
}

main().catch(async (err) => {
  console.error(err);
  await disconnectDb().catch(() => undefined);
  process.exit(1);
});