# R-713: claper's after_install no longer pastes the password into Elixir code; it decodes ${ADMIN_PASSWORD|base64}.
import sys, os
p = os.path.join(sys.argv[1], "templates", "claper", ".felhom.yml")
s = open(p).read()
old = """    - 'u = Claper.Accounts.get_user_by_email("admin@claper.co"); r = if u, do: Claper.Accounts.update_user_password(u, "claper", %{password: "${ADMIN_PASSWORD}", password_confirmation: "${ADMIN_PASSWORD}"}), else"""
new = """    - 'pw = Base.decode64!("${ADMIN_PASSWORD|base64}"); u = Claper.Accounts.get_user_by_email("admin@claper.co"); r = if u, do: Claper.Accounts.update_user_password(u, "claper", %{password: pw, password_confirmation: pw}), else"""
assert s.count(old) == 1
s = s.replace(old, new)
old_c = "# Measured on 9202 2026-09-28: afterwards `admin@claper.co / claper` no longer authenticates.\n"
assert s.count(old_c) == 1
s = s.replace(old_c, old_c + "# R-713 (controller >= 0.281.0): the password reaches the Elixir code base64-encoded (${ADMIN_PASSWORD|base64}) and is\n# decoded there — a quote or #{ in a household-typed password can no longer end the string or run code.\n")
open(p, "w").write(s)
print("claper patched")