package initialize

import (
	"errors"
	"fmt"

	"gorm.io/gorm"
	"wails-app/internal/dao"
	"wails-app/internal/global"
)

// EnsureIncidentPermissions upgrades both new and existing databases with the
// API catalogue and Casbin policies required by the incident handling module.
// 查看/上报对 618/888/9527 开放；处置（状态流转）仅 888/9527。
func EnsureIncidentPermissions() error {
	db := global.GVA_DB
	if db == nil {
		return nil
	}

	apis := []dao.SysApi{
		{Path: "/incident/list", Description: "异常记录列表", ApiGroup: "异常处置", Method: "GET"},
		{Path: "/incident/stats", Description: "异常统计", ApiGroup: "异常处置", Method: "GET"},
		{Path: "/incident/:id", Description: "异常记录详情", ApiGroup: "异常处置", Method: "GET"},
		{Path: "/incident", Description: "上报异常", ApiGroup: "异常处置", Method: "POST"},
		{Path: "/incident/:id/transition", Description: "异常状态流转与处置", ApiGroup: "异常处置", Method: "POST"},
	}
	for _, api := range apis {
		var existing dao.SysApi
		err := db.Where("path = ? AND method = ?", api.Path, api.Method).First(&existing).Error
		if errors.Is(err, gorm.ErrRecordNotFound) {
			err = db.Create(&api).Error
		}
		if err != nil {
			return fmt.Errorf("初始化异常处置API %s %s 失败: %w", api.Method, api.Path, err)
		}
	}

	// 查看与上报：全部角色
	for _, role := range []string{"618", "888", "9527"} {
		for _, rule := range [][2]string{
			{"/incident/list", "GET"},
			{"/incident/stats", "GET"},
			{"/incident/:id", "GET"},
			{"/incident", "POST"},
		} {
			if err := ensureCasbinRule(role, rule[0], rule[1]); err != nil {
				return fmt.Errorf("初始化角色%s异常查看权限失败: %w", role, err)
			}
		}
	}

	// 处置：仅管理员与超级管理员（资金类处置另有业务层校验）
	for _, role := range []string{"888", "9527"} {
		if err := ensureCasbinRule(role, "/incident/:id/transition", "POST"); err != nil {
			return fmt.Errorf("初始化角色%s异常处置权限失败: %w", role, err)
		}
	}
	return nil
}