#!/usr/bin/env python3
"""RBAC path registration for dingdingflow module.

宿主根目录执行：py3/bin/python pkgs/dingdingflow/scripts/load_path.py
（pipeline-app 的 load_path.sh 会自动扫描 pkgs/*/scripts/load_path.py）
"""
import subprocess

MOD = "dingdingflow"

# 钉钉服务器回调：外部 POST 无登录态，必须 any
# ⚠️ 安全：回调处理内部靠 processInstanceId 匹配本地记录，无匹配即拒绝
PATHS_ANY = [
    f"/{MOD}/api/dingtalk_callback.dspy",
]

PATHS_LOGINED = [
    f"/{MOD}",
    f"/{MOD}/api/dd_approval_configs_create.dspy",
    f"/{MOD}/api/dd_approval_configs_delete.dspy",
    f"/{MOD}/api/dd_approval_configs_list.dspy",
    f"/{MOD}/api/dd_approval_configs_update.dspy",
    f"/{MOD}/api/dd_approvals_create.dspy",
    f"/{MOD}/api/dd_approvals_delete.dspy",
    f"/{MOD}/api/dd_approvals_list.dspy",
    f"/{MOD}/api/dd_approvals_update.dspy",
]


def register_paths():
    for path in PATHS_ANY:
        subprocess.run(["py3/bin/python", "set_role_perm.py", "any", path])
        print(f"  any: {path}")
    for path in PATHS_LOGINED:
        subprocess.run(["py3/bin/python", "set_role_perm.py", "logined", path])
        print(f"  logined: {path}")


if __name__ == "__main__":
    print(f"=== {MOD} RBAC registration ===")
    register_paths()
    print(f"Done. any={len(PATHS_ANY)} logined={len(PATHS_LOGINED)}")