#!/usr/bin/env python3
"""FOMS_APP RBAC permission registration（纯伞层）。

URL 布局（见 conf/config.json website.paths）：
  · foms 核心      → 根路径 ""（/api/...、/clusters_list、/nodes_list ...）
  · dbbackup      → /dbbackup/...
  · filesync      → /filesync/...
  · hostwatch     → /hostwatch/...
"""
import os, sys

# Find Sage root for set_role_perm.py
sage_root = None
for c in [os.path.expanduser("~/repos/sage"), os.path.expanduser("~/test/sage")]:
    if os.path.isdir(os.path.join(c, "py3", "bin")):
        sage_root = c
        break
if not sage_root:
    print("ERROR: Sage root not found")
    sys.exit(1)

sys.path.insert(0, os.path.join(sage_root, "py3", "bin"))

from set_role_perm import set_path_perm

# Paths accessible without login
PATHS_ANY = [
    "/",
    "/index.ui",
    "/api/login.dspy",
]

# Paths requiring authentication
PATHS_LOGINED = [
    # ── foms 核心（根路径）──
    "/api/clusters_create.dspy",
    "/api/clusters_update.dspy",
    "/api/clusters_delete.dspy",
    "/api/nodes_create.dspy",
    "/api/nodes_update.dspy",
    "/api/nodes_delete.dspy",
    "/api/trigger_switchover.dspy",
    "/api/trigger_switchback.dspy",
    "/api/dashboard_stats.dspy",
    "/api/exec_remote_command.dspy",
    "/clusters_list",
    "/clusters_list/index.ui",
    "/nodes_list",
    "/nodes_list/index.ui",
    # ── dbbackup ──
    "/dbbackup/dbbackup_replications_list",
    "/dbbackup/dbbackup_replications_list/index.ui",
    "/dbbackup/dbbackup_jobs_list",
    "/dbbackup/dbbackup_jobs_list/index.ui",
    "/dbbackup/dbbackup_records_list",
    "/dbbackup/dbbackup_records_list/index.ui",
    "/dbbackup/api/run_backup.dspy",
    "/dbbackup/api/cleanup_expired_backups.dspy",
    # ── filesync ──
    "/filesync/filesync_directories_list",
    "/filesync/filesync_directories_list/index.ui",
    # ── hostwatch ──
    "/hostwatch/hostwatch_logs_list",
    "/hostwatch/hostwatch_logs_list/index.ui",
    "/hostwatch/hostwatch_rules_list",
    "/hostwatch/hostwatch_rules_list/index.ui",
    "/hostwatch/hostwatch_events_list",
    "/hostwatch/hostwatch_events_list/index.ui",
    "/hostwatch/api/node_logs.dspy",
    "/hostwatch/api/node_metrics_history.dspy",
    "/hostwatch/api/analyze_logs.dspy",
    "/hostwatch/api/acknowledge_event.dspy",
]

# Agent 端点：无登录鉴权（Agent 用 token），any
PATHS_ANY += [
    "/api/agent_heartbeat.dspy",
    "/api/agent_poll_commands.dspy",
    "/api/agent_report_command_result.dspy",
    "/dbbackup/api/agent_report_db_health.dspy",
    "/filesync/api/agent_report_dir_health.dspy",
    "/hostwatch/api/agent_report_metrics.dspy",
    "/hostwatch/api/agent_push_logs.dspy",
]

if __name__ == '__main__':
    for p in PATHS_ANY:
        set_path_perm("any", p)
        print(f"  any    {p}")
    for p in PATHS_LOGINED:
        set_path_perm("logined", p)
        print(f"  logined {p}")
    print("Done. Restart FOMS_APP to apply.")