#!/usr/bin/env python3
"""pipeline_llm module RBAC permission registration.

Run from app root:  py3/bin/python pkgs/pipeline-llm/scripts/load_path.py
Requires app-root wrapper set_role_perm.py.

v1 推理端点（/pipeline-llm/api/v1/*）授权给 any：运行环境/外部客户端用短期
Bearer token 鉴权，没有登录会话。端点文件内含 verify_llm_token（security_check
AUTH_PATTERNS 认可）。其余管理页/CRUD 全部 logined。
"""
import subprocess

MOD = "pipeline-llm"

PATHS_ANY = [
    # 推理 API：Bearer 短期 token 鉴权，无登录会话
    f"/{MOD}/api/v1/chat/completions",
    f"/{MOD}/api/v1/models",
]

PATHS_LOGINED = [
    f"/{MOD}/",
    f"/{MOD}/index.ui",
]

# api/（管理）与生成的 CRUD 目录用通配符一次覆盖
PATHS_WILDCARD_LOGINED = [
    f"/{MOD}/**",
]


def register_paths():
    for path in PATHS_ANY:
        subprocess.run(["py3/bin/python", "set_role_perm.py", "any", path])
        print(f"  any: {path}")
    for path in PATHS_LOGINED + PATHS_WILDCARD_LOGINED:
        subprocess.run(["py3/bin/python", "set_role_perm.py", "logined", path])
        print(f"  logined: {path}")


if __name__ == "__main__":
    print(f"=== {MOD} (pipeline_llm) RBAC registration ===")
    register_paths()
    print("Done.")