"""
dingdingflow RBAC权限配置 — 企业类型: owner
CMS独立部署，dingdingflow路径保持/dingdingflow前缀

用法: cd ~/repos/cms && py3/bin/python dingdingflow/scripts/load_path.py
"""
import os, sys, subprocess

def find_app_root():
    script_dir = os.path.dirname(os.path.abspath(__file__))
    return os.path.dirname(os.path.dirname(script_dir))

app_root = find_app_root()
sage_root = None
for c in [os.path.expanduser("~/repos/sage"), os.path.expanduser("~/sage")]:
    if os.path.isdir(os.path.join(c, "py3", "bin")):
        sage_root = c
        break
if not sage_root:
    sage_root = app_root

py  = os.path.join(app_root, "py3", "bin", "python")
sp  = os.path.join(sage_root, "set_role_perm.py") if os.path.exists(os.path.join(sage_root, "set_role_perm.py")) else None
if not sp:
    print("ERROR: 找不到set_role_perm.py"); sys.exit(1)

def run(role, paths):
    for p in paths:
        print(f"  {role:30s} {p}")
        subprocess.run([py, sp, role, p], cwd=sage_root, capture_output=True)

any_paths = [
    "/dingdingflow/api/dingtalk_callback.dspy",
    "/dingdingflow/menu.ui",
]

webmaster_paths = [
    "/dingdingflow",
    "/dingdingflow/index.ui",
    "/dingdingflow/api/submit_approval.dspy",
    "/dingdingflow/dd_approvals", "/dingdingflow/dd_approvals/%",
    "/dingdingflow/api/dd_approvals_list.dspy",
]

reviewer_paths = [
    "/dingdingflow",
    "/dingdingflow/index.ui",
    "/dingdingflow/dd_approvals", "/dingdingflow/dd_approvals/%",
    "/dingdingflow/api/dd_approvals_list.dspy",
    "/dingdingflow/api/dd_approvals_update.dspy",
]

supervisor_paths = [
    "/dingdingflow",
    "/dingdingflow/index.ui",
    "/dingdingflow/dd_approvals", "/dingdingflow/dd_approvals/%",
    "/dingdingflow/dd_approval_configs", "/dingdingflow/dd_approval_configs/%",
    "/dingdingflow/api/dd_approvals_create.dspy",
    "/dingdingflow/api/dd_approvals_update.dspy",
    "/dingdingflow/api/dd_approvals_delete.dspy",
    "/dingdingflow/api/dd_approvals_list.dspy",
    "/dingdingflow/api/dd_approval_configs_create.dspy",
    "/dingdingflow/api/dd_approval_configs_update.dspy",
    "/dingdingflow/api/dd_approval_configs_delete.dspy",
    "/dingdingflow/api/dd_approval_configs_list.dspy",
    "/dingdingflow/api/submit_approval.dspy",
]

print("=== dingdingflow RBAC权限配置 ===")
run("any", any_paths)
run("owner.webmaster", webmaster_paths)
run("owner.reviewer", reviewer_paths)
run("owner.supervisor", supervisor_paths)
print("\n完成")