/**
 * Read-only: print primary admin role.
 * Usage: npx tsx --env-file=.env scripts/verify-super-admin.ts
 */
import { connectDb, disconnectDb } from "../src/db/mongoose";
import { User } from "../src/db/models";
import { PRIMARY_SUPER_ADMIN_EMAIL } from "../src/services/adminMigration";

async function main() {
  await connectDb();
  const primary = await User.findOne({ email: PRIMARY_SUPER_ADMIN_EMAIL })
    .select("email role status fullName")
    .lean();
  const legacyAdmins = await User.countDocuments({ role: "ADMIN", deletedAt: null });
  const supers = await User.countDocuments({ role: "SUPER_ADMIN", deletedAt: null });
  console.log({ primary, legacyAdmins, supers });
  await disconnectDb();
  if (!primary) {
    console.error("Primary admin not found");
    process.exit(1);
  }
  if (primary.role !== "SUPER_ADMIN") {
    console.error(`Primary role is ${primary.role}, expected SUPER_ADMIN — restart backend or run migrate-admin-roles.ts`);
    process.exit(2);
  }
  console.log(`OK: ${PRIMARY_SUPER_ADMIN_EMAIL} → SUPER_ADMIN`);
}

main().catch(async (err) => {
  console.error(err);
  await disconnectDb().catch(() => undefined);
  process.exit(1);
});