#!/usr/bin/env python3
"""pipeline_llm module RBAC permission registration.

Run from app root:  py3/bin/python pkgs/pipeline-llm/scripts/load_path.py
Requires app-root wrapper set_role_perm.py.

v1 推理端点（/pipeline-llm/api/v1/*）授权给 any：运行环境/外部客户端用短期
Bearer token 鉴权，没有登录会话。端点文件内含 verify_llm_token（security_check
AUTH_PATTERNS 认可）。其余管理页/CRUD 全部 logined。
"""
import subprocess

MOD = "pipeline-llm"

PATHS_ANY = [
    # 推理 API：Bearer 短期 token 鉴权，无登录会话
    f"/{MOD}/api/v1/chat/completions",
    f"/{MOD}/api/v1/models",
    # API 文档端点：公开文档（照 sage /bricks/docs any 先例），外部开发者调 API 前可查；
    # index.ui 按 _lang 分发四语言 md，md 由 ApiDoc 组件拉取——都需匿名可读
    f"/{MOD}/api/v1/docs",
    f"/{MOD}/api/v1/docs/",
    f"/{MOD}/api/v1/docs/**",
]

PATHS_LOGINED = [
    f"/{MOD}/",
    f"/{MOD}/index.ui",
]

# api/（管理）与生成的 CRUD 目录用通配符一次覆盖
# （含 llm_call_trace 生成页、llm_project_cost/index.ui、api/*.dspy——
#  rbac check_roles_path 支持 ** 后缀前缀匹配，新页面无需逐条注册）
PATHS_WILDCARD_LOGINED = [
    f"/{MOD}/**",
]


def register_paths():
    for path in PATHS_ANY:
        subprocess.run(["py3/bin/python", "set_role_perm.py", "any", path])
        print(f"  any: {path}")
    for path in PATHS_LOGINED + PATHS_WILDCARD_LOGINED:
        subprocess.run(["py3/bin/python", "set_role_perm.py", "logined", path])
        print(f"  logined: {path}")


if __name__ == "__main__":
    print(f"=== {MOD} (pipeline_llm) RBAC registration ===")
    register_paths()
    print("Done.")