# -*- coding:utf-8 -*-
"""RAG Server RBAC 权限初始化"""
import sys, os
sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), 'pkgs', 'rag-pipeline'))

from ahserver.serverenv import ServerEnv
from appPublic.jsonConfig import getConfig
from sqlor.dbpools import DBPools
import asyncio

config = getConfig('.')
DBPools(config.databases)

from rbac.userperm import UserPerm

PUBLIC_PATHS = [
    '/api/status',
    '/api/engines',
    '/api/kb/list',
    '/',
    '/index.ui',
]

LOGINED_PATHS = [
    '/api/search',
    '/api/ingest',
    '/knowledge_bases_list/',
    '/documents_list/',
    '/engine_configs_list/',
    '/subscriptions_list/',
]


async def init_perms():
    sor = await DBPools().get_sor_context('rag')
    up = UserPerm()
    await up.init(sor)

    # Create 'any' role for public access
    recs = await sor.sqlExe("SELECT id FROM role WHERE id='any'", {})
    if not recs:
        await sor.sqlExe(
            "INSERT INTO role (id, rolename, orgtypeid, roletype, del_flg) "
            "VALUES ('any', 'any', '', 'any', '0')", {}
        )

    # Create 'logined' role
    recs = await sor.sqlExe("SELECT id FROM role WHERE id='logined'", {})
    if not recs:
        await sor.sqlExe(
            "INSERT INTO role (id, rolename, orgtypeid, roletype, del_flg) "
            "VALUES ('logined', 'logined', '', 'logined', '0')", {}
        )

    # Register public paths
    for path in PUBLIC_PATHS:
        perm_id = f"perm_{path.replace('/', '_')}"
        await sor.sqlExe(
            f"INSERT IGNORE INTO permission (id, path, name) VALUES ('{perm_id}', '{path}', 'RAG {path}')",
            {}
        )
        await sor.sqlExe(
            f"INSERT IGNORE INTO rolepermission (role_id, permission_id) VALUES ('any', '{perm_id}')",
            {}
        )

    # Register logined paths
    for path in LOGINED_PATHS:
        perm_id = f"perm_{path.replace('/', '_')}"
        await sor.sqlExe(
            f"INSERT IGNORE INTO permission (id, path, name) VALUES ('{perm_id}', '{path}', 'RAG {path}')",
            {}
        )
        await sor.sqlExe(
            f"INSERT IGNORE INTO rolepermission (role_id, permission_id) VALUES ('logined', '{perm_id}')",
            {}
        )

    print(f"RBAC initialized: {len(PUBLIC_PATHS)} public + {len(LOGINED_PATHS)} logined paths")


if __name__ == '__main__':
    asyncio.run(init_perms())