"""Ensure Superset users mo+bart exist, are active Admins, and (re)set their
password. Run inside the superset container:  docker exec superset python reset_users.py
Password is read from SUPERSET_USER_PASSWORD (no secret committed)."""
import os
from superset.app import create_app

PW = os.environ.get("SUPERSET_USER_PASSWORD", "change-me")
app = create_app()
with app.app_context():
    from superset import security_manager as sm
    from werkzeug.security import generate_password_hash, check_password_hash

    admin_role = sm.find_role("Admin")
    for uname, email in [("mo", "mo@lakehouse.local"), ("bart", "bart@lakehouse.local")]:
        u = sm.find_user(username=uname)
        if not u:
            u = sm.add_user(uname, uname.capitalize(), "User", email, admin_role, password=PW)
        u.active = True
        if admin_role not in u.roles:
            u.roles = list({*u.roles, admin_role})
        u.password = generate_password_hash(PW)
        sm.update_user(u)
        print(uname, "ok:", check_password_hash(u.password, PW))