<?php
/** Explicit account selection; never promotes every legacy administrator. */
if(PHP_SAPI!=='cli'){http_response_code(404);exit;}
require_once __DIR__.'/../classes/Base.php';
$db=(new Base())->connect();
$columns=$db->query('SHOW COLUMNS FROM club_memberships')->fetchAll(PDO::FETCH_COLUMN);
if(!in_array('membership_role',$columns,true))$db->exec("ALTER TABLE club_memberships ADD COLUMN membership_role ENUM('member','administrator') NOT NULL DEFAULT 'member'");
// Club display names are tenant-local, not a global account lookup key.
$index=$db->query("SHOW INDEX FROM clubs WHERE Key_name='club_name'")->fetch();
if($index && !(int)$index['Non_unique'])$db->exec('ALTER TABLE clubs DROP INDEX club_name, ADD INDEX club_name (club_name)');
foreach(explode(';',file_get_contents(__DIR__.'/../migrations/004_tenants.sql')) as $sql)if(trim($sql))$db->exec($sql);
$email=getenv('HCR_SUPER_ADMIN_EMAIL')?:'';
if($email!==''){
 if(!filter_var($email,FILTER_VALIDATE_EMAIL))throw new RuntimeException('Use a valid existing Super System Administrator email.');
 $db->beginTransaction();
 try{
  $stmt=$db->prepare("SELECT user_serial,user_role FROM users WHERE user_email=? AND user_status='active' FOR UPDATE");$stmt->execute([$email]);$user=$stmt->fetch();
  if(!$user)throw new RuntimeException('The selected active account does not exist. No account was promoted.');
  if($user['user_role']!==TenantAccess::SUPER){
   $stmt=$db->prepare('UPDATE users SET user_role=?,user_auth_version=user_auth_version+1 WHERE user_serial=?');$stmt->execute([TenantAccess::SUPER,$user['user_serial']]);
   foreach(['password_resets','email_verifications'] as $table){$stmt=$db->prepare('DELETE FROM '.$table.' WHERE user_serial=?');$stmt->execute([$user['user_serial']]);}
   Audit::required($db,(int)$user['user_serial'],'designated Super System Administrator by CLI migration');
  }
  $db->commit();
 }catch(Throwable $e){if($db->inTransaction())$db->rollBack();throw $e;}
}
echo "Tenant schema is ready. Existing clubs require explicit administrator assignments; no memberships were guessed.\n";