#!/usr/bin/env python3
"""RBAC path registration for app_audit module.

审计 API 仅 owner.audit 角色（审计独立性：superuser 也不给）。
"""
import os, sys, subprocess

MOD = "app_audit"

# 审计日志界面 + API：仅 owner.audit 角色
PATHS_AUDIT = [
    f"/{MOD}",
    f"/{MOD}/index.ui",
    f"/{MOD}/api/audit.dspy",
]


def find_app_root():
    # 从 scripts/ 向上逐层查找 set_role_perm.py（位于宿主 app 根目录）
    d = os.path.dirname(os.path.abspath(__file__))
    for _ in range(6):
        if os.path.isfile(os.path.join(d, "set_role_perm.py")):
            return d
        parent = os.path.dirname(d)
        if parent == d:
            break
        d = parent
    return None


def main():
    root = find_app_root()
    if not root:
        print("ERROR: app root not found")
        sys.exit(1)
    set_perm = os.path.join(root, "set_role_perm.py")
    py = sys.executable
    count = 0
    for role, paths in [("owner.audit", PATHS_AUDIT)]:
        for path in paths:
            cmd = [py, set_perm, role, path]
            r = subprocess.run(cmd, capture_output=True, text=True, cwd=root)
            if r.returncode == 0:
                count += 1
            else:
                print(f"  WARN: {path} -> {r.stderr.strip()[-80:]}")
    print(f"Registered {count}/{len(PATHS_AUDIT)} paths for {MOD}")


if __name__ == "__main__":
    main()