"""Apply the owner-requested credential once, without resetting recovered passwords."""
import sqlite3
from pathlib import Path

VERIFIER = {
    'email': 'support@moxiedigital.in',
    'salt': 'tROpbLiiszpSASNIBlOhvw==',
    'hash': 'EUKu6ti+EWur6Htw7xOEdCjiPd631myYOtgQ4a90uvQ=',
    'rounds': 700000,
}


def configure_once():
    from mx_security_hardening import save_secure_json, revoke_all_admin_sessions, record_login_result
    folder = Path.home() / '.mx_admin_login'
    folder.mkdir(parents=True, exist_ok=True, mode=0o700)
    path = folder / 'credential_setup.sqlite3'
    with sqlite3.connect(path, timeout=15) as db:
        path.chmod(0o600)
        db.execute('CREATE TABLE IF NOT EXISTS migrations (id TEXT PRIMARY KEY)')
        db.execute('BEGIN IMMEDIATE')
        marker = 'owner-password-and-recovery-20261017-v1'
        if db.execute('SELECT 1 FROM migrations WHERE id=?', (marker,)).fetchone():
            return
        save_secure_json('web_admin_password.bin', dict(VERIFIER))
        revoke_all_admin_sessions(VERIFIER['email'])
        record_login_result(VERIFIER['email'], True, 'web_admin')
        db.execute('INSERT INTO migrations VALUES (?)', (marker,))