"""
dingdingflow RBAC权限配置
用法: cd ~/repos/sage && ./py3/bin/python ~/repos/cms/dingdingflow/scripts/load_path.py
"""
import os
import sys
import subprocess

def find_sage_root():
    for candidate in [
        os.path.expanduser("~/repos/sage"),
        os.path.expanduser("~/sage"),
    ]:
        if os.path.isdir(os.path.join(candidate, "wwwroot")) and \
           os.path.isdir(os.path.join(candidate, "py3")):
            return candidate
    return None

sage_root = find_sage_root()
if not sage_root:
    print("ERROR: Cannot find Sage root directory")
    sys.exit(1)

python = os.path.join(sage_root, "py3", "bin", "python")
set_perm = os.path.join(sage_root, "set_role_perm.py")

paths_any = [
    # 钉钉回调是公开endpoint
    "/dingdingflow/api/dingtalk_callback.dspy",
    "/dingdingflow/menu.ui",
]

paths_logined = [
    "/dingdingflow",
    "/dingdingflow/index.ui",
    "/dingdingflow/dd_approvals",
    "/dingdingflow/dd_approvals/%",
    "/dingdingflow/dd_approval_configs",
    "/dingdingflow/dd_approval_configs/%",
    "/dingdingflow/api/dd_approvals_create.dspy",
    "/dingdingflow/api/dd_approvals_update.dspy",
    "/dingdingflow/api/dd_approvals_delete.dspy",
    "/dingdingflow/api/dd_approvals_list.dspy",
    "/dingdingflow/api/dd_approval_configs_create.dspy",
    "/dingdingflow/api/dd_approval_configs_update.dspy",
    "/dingdingflow/api/dd_approval_configs_delete.dspy",
    "/dingdingflow/api/dd_approval_configs_list.dspy",
    "/dingdingflow/api/submit_approval.dspy",
]

def set_perms(role, paths):
    for path in paths:
        cmd = [python, set_perm, role, path]
        print(f"  {role:20s} {path}")
        subprocess.run(cmd, cwd=sage_root, capture_output=True)

print("=== dingdingflow RBAC权限配置 ===")
set_perms("any", paths_any)
set_perms("logined", paths_logined)
print("完成")