package initialize

import (
	"errors"
	"fmt"

	"gorm.io/gorm"
	"wails-app/internal/dao"
	"wails-app/internal/global"
)

// EnsureOperationPermissions upgrades both new and existing databases with the
// API catalogue and Casbin policies required by the entry/exit operation page.
func EnsureOperationPermissions() error {
	db := global.GVA_DB
	if db == nil {
		return nil
	}

	apis := []dao.SysApi{
		{Path: "/vehicle/entry", Description: "车辆入场", ApiGroup: "进出场操作", Method: "POST"},
		{Path: "/vehicle/operation/context", Description: "查询车辆操作上下文", ApiGroup: "进出场操作", Method: "POST"},
		{Path: "/vehicle/passage", Description: "统一车辆通行", ApiGroup: "进出场操作", Method: "POST"},
		{Path: "/channel/events", Description: "查询通道事件", ApiGroup: "进出场操作", Method: "GET"},
		{Path: "/parking/gate/devices", Description: "查询道闸设备", ApiGroup: "进出场操作", Method: "GET"},
		{Path: "/parking/gate/open", Description: "人工开闸", ApiGroup: "进出场操作", Method: "POST"},
		{Path: "/parking/gate/close", Description: "人工关闸", ApiGroup: "进出场操作", Method: "POST"},
	}
	for _, api := range apis {
		var existing dao.SysApi
		err := db.Where("path = ? AND method = ?", api.Path, api.Method).First(&existing).Error
		if errors.Is(err, gorm.ErrRecordNotFound) {
			err = db.Create(&api).Error
		}
		if err != nil {
			return fmt.Errorf("初始化进出场API %s %s 失败: %w", api.Method, api.Path, err)
		}
	}

	if err := db.Exec(`CREATE TABLE IF NOT EXISTS casbin_rule (
		id INTEGER PRIMARY KEY AUTOINCREMENT,
		ptype TEXT, v0 TEXT, v1 TEXT, v2 TEXT, v3 TEXT, v4 TEXT, v5 TEXT
	)`).Error; err != nil {
		return fmt.Errorf("初始化Casbin规则表失败: %w", err)
	}

	for _, role := range []string{"618", "888", "9527"} {
		for _, rule := range [][2]string{
			{"/vehicle/entry", "POST"},
			{"/vehicle/operation/context", "POST"},
			{"/vehicle/passage", "POST"},
			{"/channel/events", "GET"},
			{"/parking/gate/devices", "GET"},
			{"/parking/gate/open", "POST"},
			{"/parking/gate/close", "POST"},
		} {
			if err := ensureCasbinRule(role, rule[0], rule[1]); err != nil {
				return fmt.Errorf("初始化角色%s进出场权限失败: %w", role, err)
			}
		}
	}
	return nil
}