#!/usr/bin/env python3
"""RAG Server RBAC 权限初始化 — 直接 SQL"""
import sys, os, asyncio

sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), '..'))

from sqlor.dbpools import DBPools
from appPublic.jsonConfig import getConfig

config = getConfig('.')
DBPools(config.databases)

PUBLIC = ['/api/status', '/api/engines', '/api/kb/list', '/', '/index.ui', '/bricks/**',
          '/rbac/user/login.ui', '/rbac/user/register.ui',
          '/rbac/user/login.dspy', '/rbac/user/register.dspy', '/rbac/user/logout.dspy',
          '/rbac/**']
LOGINED = ['/api/search', '/api/ingest',
           '/knowledge_bases_list/', '/documents_list/',
           '/engine_configs_list/', '/subscriptions_list/']


async def main():
    db = DBPools()
    async with db.sqlorContext('rag') as sor:
        for rid, rname in [('any', 'any'), ('logined', 'logined')]:
            await sor.sqlExe(
                f"INSERT IGNORE INTO role (id, orgtypeid, name) VALUES ('{rid}', '', '{rname}')", {})

        for paths, role in [(PUBLIC, 'any'), (LOGINED, 'logined')]:
            for path in paths:
                pid = f"perm_{path.replace('/', '_')}"
                await sor.sqlExe(
                    f"INSERT IGNORE INTO permission (id, path, name) VALUES ('{pid}', '{path}', 'RAG')", {})
                await sor.sqlExe(
                    f"INSERT IGNORE INTO rolepermission (id, roleid, permid) VALUES ('rp_{pid}', '{role}', '{pid}')", {})

    print(f"OK: {len(PUBLIC)} public + {len(LOGINED)} logined paths")


if __name__ == '__main__':
    asyncio.run(main())