fix_passwords.py

"""
fix_passwords.py

Scans all users in the SQLite database and fixes any that have
broken/placeholder password hashes. A valid werkzeug hash starts
with 'pbkdf2:', 'scrypt:', or 'argon2'. Anything else is broken.

Usage (from project root):
    .venv\Scripts\python.exe fix_passwords.py

The script will:
  1. Show every user's email, username, and hash status.
  2. Replace broken hashes with generate_password_hash('password123').
  3. Print the result so you can verify.
"""

import sqlite3
import os
from werkzeug.security import generate_password_hash, check_password_hash

DB_PATH = os.path.join(os.path.dirname(os.path.abspath(__file__)), "instance", "loan_management.db")
FIXED_PASSWORD = "password123"


def is_valid_werkzeug_hash(h: str) -> bool:
    """Return True if the string looks like a real werkzeug password hash."""
    if not h:
        return False
    return h.startswith(("pbkdf2:", "scrypt:", "argon2"))


def main():
    if not os.path.exists(DB_PATH):
        print(f"ERROR: Database not found at {DB_PATH}")
        return

    conn = sqlite3.connect(DB_PATH)
    cur = conn.cursor()

    # Fetch all users
    cur.execute("SELECT id, username, email, password_hash FROM users")
    rows = cur.fetchall()

    if not rows:
        print("No users found in the database.")
        conn.close()
        return

    new_hash = generate_password_hash(FIXED_PASSWORD)

    print(f"{'ID':<6} {'Username':<25} {'Email':<35} {'Hash Status'}")
    print("-" * 90)

    fixed_count = 0
    for uid, username, email, pw_hash in rows:
        valid = is_valid_werkzeug_hash(pw_hash)
        status = "OK" if valid else "BROKEN"
        print(f"{uid:<6} {username:<25} {email:<35} {status}")

        if not valid:
            cur.execute(
                "UPDATE users SET password_hash = ? WHERE id = ?",
                (new_hash, uid),
            )
            fixed_count += 1

    conn.commit()

    print("-" * 90)
    print(f"Total users: {len(rows)}")
    print(f"Fixed:       {fixed_count}")
    print(f"Skipped:     {len(rows) - fixed_count}")

    if fixed_count > 0:
        print(f"\nAll fixed users can now log in with password: {FIXED_PASSWORD}")
        print("You should change these passwords after logging in.")

    # Verify the fixes
    print("\n--- Verification ---")
    cur.execute("SELECT id, username, email, password_hash FROM users")
    for uid, username, email, pw_hash in cur.fetchall():
        valid = is_valid_werkzeug_hash(pw_hash)
        test = check_password_hash(pw_hash, FIXED_PASSWORD) if valid else False
        print(f"  {username:<25} hash_valid={valid}  can_login_with_fixed_pw={test}")

    conn.close()
    print("\nDone.")


if __name__ == "__main__":
    main()