#!/usr/bin/env python3
"""RBAC path registration for dingdingflow module.

宿主根目录执行：py3/bin/python pkgs/dingdingflow/scripts/load_path.py
（pipeline-app 的 load_path.sh 会自动扫描 pkgs/*/scripts/load_path.py）
"""
import subprocess

MOD = "dingdingflow"

# 钉钉服务器回调：外部 POST 无登录态，必须 any
# ⚠️ 安全：回调处理内部靠 processInstanceId 匹配本地记录，无匹配即拒绝
PATHS_ANY = [
    f"/{MOD}/api/dingtalk_callback.dspy",
]

PATHS_LOGINED = [
    f"/{MOD}",
    f"/{MOD}/api/dd_approval_configs_create.dspy",
    f"/{MOD}/api/dd_approval_configs_delete.dspy",
    f"/{MOD}/api/dd_approval_configs_list.dspy",
    f"/{MOD}/api/dd_approval_configs_update.dspy",
    f"/{MOD}/api/dd_approvals_create.dspy",
    f"/{MOD}/api/dd_approvals_delete.dspy",
    f"/{MOD}/api/dd_approvals_list.dspy",
    f"/{MOD}/api/dd_approvals_update.dspy",
    # 审批节点配置 / 审批记录 管理页（xls2ui 生成）
    f"/{MOD}/dda_approval_configs/index.ui",
    f"/{MOD}/dda_approval_configs/get_dda_approval_configs.dspy",
    f"/{MOD}/dda_approval_configs/add_dda_approval_configs.dspy",
    f"/{MOD}/dda_approval_configs/update_dda_approval_configs.dspy",
    f"/{MOD}/dda_approval_configs/delete_dda_approval_configs.dspy",
    f"/{MOD}/dda_approvals/index.ui",
    f"/{MOD}/dda_approvals/get_dda_approvals.dspy",
    f"/{MOD}/dda_approvals/add_dda_approvals.dspy",
    f"/{MOD}/dda_approvals/update_dda_approvals.dspy",
    f"/{MOD}/dda_approvals/delete_dda_approvals.dspy",
]


def register_paths():
    for path in PATHS_ANY:
        subprocess.run(["py3/bin/python", "set_role_perm.py", "any", path])
        print(f"  any: {path}")
    for path in PATHS_LOGINED:
        subprocess.run(["py3/bin/python", "set_role_perm.py", "logined", path])
        print(f"  logined: {path}")


if __name__ == "__main__":
    print(f"=== {MOD} RBAC registration ===")
    register_paths()
    print(f"Done. any={len(PATHS_ANY)} logined={len(PATHS_LOGINED)}")