-- 修复当前海外环境平台管理员的安全投影。
-- 适用数据库：baiyue_iam、baiyue_lastleg；脚本可重复执行。
USE baiyue_lastleg;

-- 旧环境可能缺少角色或权限快照列；先保证两列都存在。
SET @ddl = (
  SELECT IF(COUNT(*) = 0,
    'ALTER TABLE ll_security_projection ADD COLUMN roles_json JSON NULL COMMENT ''IAM投影的当前角色快照'' AFTER permission_version',
    'SELECT 1')
  FROM information_schema.columns
  WHERE table_schema = DATABASE()
    AND table_name = 'll_security_projection'
    AND column_name = 'roles_json'
);
PREPARE security_projection_roles_ddl FROM @ddl;
EXECUTE security_projection_roles_ddl;
DEALLOCATE PREPARE security_projection_roles_ddl;

SET @ddl = (
  SELECT IF(COUNT(*) = 0,
    'ALTER TABLE ll_security_projection ADD COLUMN authorities_json JSON NULL AFTER roles_json',
    'SELECT 1')
  FROM information_schema.columns
  WHERE table_schema = DATABASE()
    AND table_name = 'll_security_projection'
    AND column_name = 'authorities_json'
);
PREPARE security_projection_ddl FROM @ddl;
EXECUTE security_projection_ddl;
DEALLOCATE PREPARE security_projection_ddl;

UPDATE ll_security_projection
SET roles_json = JSON_ARRAY()
WHERE roles_json IS NULL;

UPDATE ll_security_projection
SET authorities_json = JSON_ARRAY()
WHERE authorities_json IS NULL;

-- 9000000001 是本地平台自定义管理员账号；权限来源以 IAM 当前角色授权为准。
INSERT INTO ll_security_projection (
    aggregate_type, aggregate_id, tenant_id, security_status,
    permission_version, roles_json, authorities_json, aggregate_version,
    payload_hash, last_event_id, changed_at, updated_at
)
SELECT
    'AUTHORIZATION', '9000000001', 0, NULL,
    COALESCE((SELECT MAX(permission_version)
              FROM baiyue_iam.iam_security_subject_version
              WHERE auth_user_id = 9000000001), 0),
    (SELECT JSON_ARRAYAGG(role_code)
       FROM (
         SELECT DISTINCT r.role_code
         FROM baiyue_iam.iam_user u
         JOIN baiyue_iam.iam_membership m ON m.user_id = u.id
         JOIN baiyue_iam.iam_membership_role mr
           ON mr.membership_id = m.id AND mr.tenant_id = m.tenant_id
         JOIN baiyue_iam.iam_role r ON r.id = mr.role_id
         WHERE u.auth_user_id = 9000000001
           AND m.id = 9000000003 AND m.tenant_id = 0
           AND m.status = 'ACTIVE' AND m.deleted = 0
           AND r.app_code = 'PLATFORM'
           AND (r.tenant_id = 0 OR r.tenant_id = m.tenant_id)
           AND r.status = 'ACTIVE' AND r.deleted = 0
         ORDER BY r.role_code
       ) roles),
    (SELECT JSON_ARRAYAGG(permission_code)
       FROM (
         SELECT DISTINCT p.permission_code
         FROM baiyue_iam.iam_user u
         JOIN baiyue_iam.iam_membership m ON m.user_id = u.id
         JOIN baiyue_iam.iam_membership_role mr
           ON mr.membership_id = m.id AND mr.tenant_id = m.tenant_id
         JOIN baiyue_iam.iam_role r ON r.id = mr.role_id
         JOIN baiyue_iam.iam_role_permission rp
           ON rp.role_id = r.id AND rp.tenant_id = r.tenant_id
         JOIN baiyue_iam.iam_permission p
           ON p.id = rp.permission_id AND p.tenant_id = rp.tenant_id
         WHERE u.auth_user_id = 9000000001
           AND m.id = 9000000003 AND m.tenant_id = 0
           AND m.status = 'ACTIVE' AND m.deleted = 0
           AND r.app_code = 'PLATFORM'
           AND (r.tenant_id = 0 OR r.tenant_id = m.tenant_id)
           AND r.status = 'ACTIVE' AND r.deleted = 0
           AND p.app_code = 'PLATFORM'
           AND (p.tenant_id = 0 OR p.tenant_id = m.tenant_id)
           AND p.status = 'ACTIVE' AND p.deleted = 0
         ORDER BY p.permission_code
       ) permissions),
    COALESCE((SELECT MAX(permission_version)
              FROM baiyue_iam.iam_security_subject_version
              WHERE auth_user_id = 9000000001), 0),
    SHA2('local-repair:9000000001:authorization', 256),
    CONCAT('local-repair-9000000001-', DATE_FORMAT(NOW(3), '%Y%m%d%H%i%s%f')),
    NOW(3), NOW(3)
ON DUPLICATE KEY UPDATE
    tenant_id = VALUES(tenant_id),
    permission_version = VALUES(permission_version),
    roles_json = VALUES(roles_json),
    authorities_json = VALUES(authorities_json),
    aggregate_version = VALUES(aggregate_version),
    payload_hash = VALUES(payload_hash),
    last_event_id = VALUES(last_event_id),
    changed_at = VALUES(changed_at),
    updated_at = NOW(3);

-- 若未来 IAM 为该账号创建了版本记录，按当前版本同步投影版本号。
UPDATE ll_security_projection p
JOIN baiyue_iam.iam_security_subject_version v
  ON v.auth_user_id = CAST(p.aggregate_id AS UNSIGNED)
SET p.permission_version = v.permission_version,
    p.aggregate_version = v.permission_version,
    p.updated_at = NOW(3)
WHERE p.aggregate_type = 'AUTHORIZATION'
  AND p.aggregate_id = '9000000001';

SELECT aggregate_type, aggregate_id, tenant_id, permission_version,
       JSON_LENGTH(roles_json) AS role_count,
       JSON_LENGTH(authorities_json) AS authority_count,
       updated_at
FROM ll_security_projection
WHERE aggregate_type = 'AUTHORIZATION' AND aggregate_id = '9000000001';