package config

import (
	"fmt"
	"strings"
)

// ValidateBootstrapPassword applies only when creating the initial admin.
// Existing accounts are never reset by a template or an application update.
func ValidateBootstrapPassword(password string) error {
	if len(password) < 12 || len(password) > 72 {
		return fmt.Errorf("password admin awal harus 12–72 byte; jalankan npm run setup:env untuk instalasi baru")
	}
	lower := strings.ToLower(password)
	if lower == "superadmin123" || lower == "password1234" || strings.HasPrefix(lower, "changeme") || strings.HasPrefix(lower, "change-me") || strings.Contains(lower, "{{") {
		return fmt.Errorf("password admin awal masih berupa nilai bawaan; gunakan password unik")
	}
	return nil
}