package onboarding

import (
	"context"
	"errors"
)

// ProvisionLocalDemoPhone links only the checked-in synthetic owner fixture.
// It has no HTTP route and never replaces an existing password.
func (s *Service) ProvisionLocalDemoPhone(ctx context.Context, password string) error {
	if !s.options.AllowLocalHTTP || !validNewPassword(password) {
		return errors.New("local demo provisioning requires local HTTP and a valid password")
	}
	var issuer, subject string
	err := s.pool.QueryRow(ctx, `SELECT oidc_issuer,oidc_subject FROM user_account WHERE id='10000000-0000-0000-0000-000000000101' AND oidc_issuer='http://localhost:58180/realms/voice-local' AND oidc_subject='00000000-0000-0000-0000-000000000101' AND account_kind='customer' AND platform_role='customer' AND status='active'`).Scan(&issuer, &subject)
	if err != nil {
		return err
	}
	encoded, err := hashPassword(ctx, password)
	if err != nil {
		return err
	}
	_, err = s.pool.Exec(ctx, `INSERT INTO customer_phone_credential(phone_digest,phone_masked,issuer,subject,password_hash) VALUES($1,'+86138****0000',$2,$3,$4) ON CONFLICT DO NOTHING`, domainMAC(s.crypt.hashKey, "PHONE1\n+8613800000000"), issuer, subject, encoded)
	return err
}