#!/usr/bin/env node
// Run from tablet-checkin/ dir: DATABASE_URL=... node seed-app.js
import pg from 'pg'

const { Pool } = pg
const pool = new Pool({ connectionString: process.env.DATABASE_URL })

await pool.query(`
  INSERT INTO apps (slug, name, description, base_path, icon, theme_color, category, internal_host, internal_port)
  VALUES ('tablet-checkin', 'Tablet Check-In', 'Staff-push guest check-in tablet — contact details, car reg, marketing opt-in, T&Cs and signature capture', '/tablet-checkin', 'UserCheck', '#be123c', 'Hotel', '10.10.10.132', 3080)
  ON CONFLICT (slug) DO UPDATE SET
    name          = EXCLUDED.name,
    description   = EXCLUDED.description,
    base_path     = EXCLUDED.base_path,
    icon          = EXCLUDED.icon,
    theme_color   = EXCLUDED.theme_color,
    category      = EXCLUDED.category,
    internal_host = EXCLUDED.internal_host,
    internal_port = EXCLUDED.internal_port
`)

// Cap slugs are plain, not dotted/app-prefixed — scoped per-app via app_id
// already (confirmed convention, see plant/seed-app.js). 'checkin' (the
// tablet kiosk's own internal JWT cap, see backend/src/routes/devices.js) is
// deliberately NOT seeded here — it must never be assignable to a human
// staff role via the portal, only minted by this app's own kiosk login route.
await pool.query(`
  INSERT INTO app_capabilities (app_id, slug, name, description, sort_order)
  SELECT a.id, c.slug, c.name, c.description, c.sort_order
  FROM apps a, (VALUES
    ('push',     'Push to Tablet', 'Push a booking to a check-in tablet (staff push trigger + manual test-push)', 1),
    ('admin',    'Admin',          'View check-in audit history, manage devices, terminals and marketing config', 2),
    ('settings', 'Settings',       'Configure tablet-checkin app settings',                                       3)
  ) AS c(slug, name, description, sort_order)
  WHERE a.slug = 'tablet-checkin'
  ON CONFLICT (app_id, slug) DO UPDATE SET
    name        = EXCLUDED.name,
    description = EXCLUDED.description,
    sort_order  = EXCLUDED.sort_order
`)

// No default Staff grants — this app writes guest PII to NewBook and holds
// signed regcards, access is admin-assigned per role via the portal (same
// convention as hvac/plant/wages/utilities).

console.log('tablet-checkin app seeded.')
await pool.end()