-- 三期整柜报关权限资源；在一期平台 RBAC 初始化后执行，可重复部署。
-- Client 退税资料复用 merchant:order:view/edit；买单无客户入口，不新增客户报关权限。
USE baiyue_iam;
SET NAMES utf8mb4;

DROP PROCEDURE IF EXISTS guard_phase3_container_customs_permission_ids;
DELIMITER $$
CREATE PROCEDURE guard_phase3_container_customs_permission_ids()
BEGIN
  IF EXISTS (
    SELECT 1
      FROM iam_permission
     WHERE (id = 5102170 AND permission_code <> 'platform:firstleg:customs:list')
        OR (id = 5102172 AND permission_code <> 'platform:firstleg:customs:manage')
        OR (permission_code = 'platform:firstleg:customs:list' AND id <> 5102170)
        OR (permission_code = 'platform:firstleg:customs:manage' AND id <> 5102172)
  ) THEN
    SIGNAL SQLSTATE '45000'
      SET MESSAGE_TEXT = '整柜报关权限固定 ID 或权限码已被其他语义占用';
  END IF;
END$$
DELIMITER ;
CALL guard_phase3_container_customs_permission_ids();
DROP PROCEDURE IF EXISTS guard_phase3_container_customs_permission_ids;

-- 当前未上线，旧 cases 动作和装柜清单导出权限直接删除，不保留别名或双权限。
DELETE role_permission
  FROM iam_role_permission role_permission
 JOIN iam_permission permission
    ON permission.id = role_permission.permission_id
   AND permission.tenant_id = role_permission.tenant_id
 WHERE permission.tenant_id = 0
   AND permission.app_code = 'PLATFORM'
   AND permission.permission_code IN (
   'platform:firstleg:customs:view',
   'platform:firstleg:customs:review',
   'platform:firstleg:customs:submit',
   'platform:firstleg:customs:receipt',
   'platform:firstleg:loading-list:export'
 );

DELETE FROM iam_permission
 WHERE tenant_id = 0
   AND app_code = 'PLATFORM'
   AND permission_code IN (
   'platform:firstleg:customs:view',
   'platform:firstleg:customs:review',
   'platform:firstleg:customs:submit',
   'platform:firstleg:customs:receipt',
   'platform:firstleg:loading-list:export'
 );

INSERT INTO iam_permission
  (id, tenant_id, app_code, permission_type, parent_id, permission_code,
   permission_name, route_path, http_method, sort_no, status, built_in, deleted)
VALUES
  (5102170, 0, 'PLATFORM', 'MENU', 5102000,
   'platform:firstleg:customs:list', '整柜报关', '/first-leg/customs', 'GET',
   100, 'ACTIVE', 1, 0),
  (5102172, 0, 'PLATFORM', 'BUTTON', 5102170,
   'platform:firstleg:customs:manage', '维护整柜报关', NULL, 'POST',
   20, 'ACTIVE', 1, 0)
ON DUPLICATE KEY UPDATE
  tenant_id = 0,
  app_code = 'PLATFORM',
  permission_type = VALUES(permission_type),
  parent_id = VALUES(parent_id),
  permission_name = VALUES(permission_name),
  route_path = VALUES(route_path),
  http_method = VALUES(http_method),
  sort_no = VALUES(sort_no),
  status = 'ACTIVE',
  built_in = 1,
  deleted = 0;

INSERT IGNORE INTO iam_role_permission (role_id, permission_id, tenant_id)
SELECT role.id, permission.id, 0
  FROM iam_role role
  JOIN iam_permission permission
    ON permission.tenant_id = 0
   AND permission.app_code = 'PLATFORM'
   AND permission.permission_code IN (
     'platform:firstleg:customs:list',
     'platform:firstleg:customs:manage'
   )
 WHERE role.tenant_id = 0
   AND role.app_code = 'PLATFORM'
   AND role.role_code IN ('PLATFORM_ADMIN', 'ORDER_OPERATOR')
   AND role.status = 'ACTIVE'
   AND role.deleted = 0;

DROP PROCEDURE IF EXISTS assert_phase3_container_customs_permissions;
DELIMITER $$
CREATE PROCEDURE assert_phase3_container_customs_permissions()
BEGIN
  IF (
    SELECT COUNT(*)
      FROM iam_permission
     WHERE tenant_id = 0
       AND app_code = 'PLATFORM'
       AND status = 'ACTIVE'
       AND deleted = 0
       AND permission_code IN (
         'platform:firstleg:customs:list',
         'platform:firstleg:customs:manage'
       )
  ) <> 2 THEN
    SIGNAL SQLSTATE '45000'
      SET MESSAGE_TEXT = '整柜报关正式权限资源初始化不完整';
  END IF;

  IF EXISTS (
    SELECT 1
      FROM iam_permission
     WHERE tenant_id = 0
       AND app_code = 'PLATFORM'
       AND permission_code IN (
       'platform:firstleg:customs:view',
       'platform:firstleg:customs:review',
       'platform:firstleg:customs:submit',
       'platform:firstleg:customs:receipt',
       'platform:firstleg:loading-list:export'
     )
  ) THEN
    SIGNAL SQLSTATE '45000'
      SET MESSAGE_TEXT = '整柜报关旧权限或装柜清单导出权限未清除';
  END IF;

  IF (
    SELECT COUNT(*)
      FROM iam_role_permission role_permission
      JOIN iam_role role
        ON role.id = role_permission.role_id
       AND role.tenant_id = role_permission.tenant_id
      JOIN iam_permission permission
        ON permission.id = role_permission.permission_id
       AND permission.tenant_id = role_permission.tenant_id
     WHERE role.tenant_id = 0
       AND role.app_code = 'PLATFORM'
       AND role.role_code IN ('PLATFORM_ADMIN', 'ORDER_OPERATOR')
       AND permission.permission_code IN (
         'platform:firstleg:customs:list',
         'platform:firstleg:customs:manage'
       )
  ) <> 4 THEN
    SIGNAL SQLSTATE '45000'
      SET MESSAGE_TEXT = '平台管理员或订单运营整柜报关权限授权不完整';
  END IF;
END$$
DELIMITER ;
CALL assert_phase3_container_customs_permissions();
DROP PROCEDURE IF EXISTS assert_phase3_container_customs_permissions;