<?php

namespace Database\Seeders;

use App\Models\Role;
use App\Models\User;
use Illuminate\Database\Seeder;
use Illuminate\Support\Facades\Hash;

/**
 * Development staff accounts (PRD 87).
 *
 * These credentials exist so the platform can be walked through immediately
 * after install. They must never survive into production - the deployment
 * checklist replaces them with real accounts.
 */
class UserSeeder extends Seeder
{
    public function run(): void
    {
        $accounts = [
            ['Super Administrator', 'admin@example.test', Role::SUPER_ADMIN],
            ['Admissions Manager', 'manager@example.test', Role::ADMISSIONS_MANAGER],
            ['Admissions Officer', 'officer@example.test', Role::ADMISSIONS_OFFICER],
            ['Finance Officer', 'finance@example.test', Role::FINANCE_OFFICER],
            ['Programme Administrator', 'programmes@example.test', Role::PROGRAMME_ADMIN],
            ['Content Editor', 'editor@example.test', Role::CONTENT_EDITOR],
        ];

        foreach ($accounts as [$name, $email, $roleSlug]) {
            $user = User::updateOrCreate(['email' => $email], [
                'name' => $name,
                'password' => Hash::make('password'),
            ]);

            // email_verified_at is guarded against mass assignment, so it is
            // set explicitly rather than passed through updateOrCreate.
            $user->forceFill(['status' => 'active', 'email_verified_at' => now()])->save();

            $role = Role::where('slug', $roleSlug)->first();

            if ($role) {
                $user->roles()->sync([$role->id]);
            }
        }

        $this->command?->info('Seeded '.count($accounts).' staff accounts (password: "password").');
        $this->command?->warn('Replace these accounts before going to production.');
    }
}
