-- Finance G1/G2 permissions exposed by FinancePhase1OperationController.
-- These resources are assignable to custom platform roles; this migration does not grant them by default.
USE baiyue_iam;
SET NAMES utf8mb4;

DELETE rp FROM iam_role_permission rp
JOIN iam_permission p ON p.id=rp.permission_id AND p.tenant_id=rp.tenant_id
WHERE p.tenant_id=0 AND p.app_code='PLATFORM'
  AND p.permission_code IN ('platform:finance:fee-source:settlement','platform:finance:bill:create','platform:finance:bill:issue');
DELETE FROM iam_permission
WHERE tenant_id=0 AND app_code='PLATFORM'
  AND permission_code IN ('platform:finance:fee-source:settlement','platform:finance:bill:create','platform:finance:bill:issue');

DROP PROCEDURE IF EXISTS migrate_finance_g1_g2_permissions;
DELIMITER $$
CREATE PROCEDURE migrate_finance_g1_g2_permissions()
BEGIN
  IF EXISTS (
    SELECT 1
    FROM iam_permission
    WHERE (id = 5105000 AND permission_code <> 'platform:finance')
       OR (id = 5105024 AND permission_code <> 'platform:finance:fee-source:review')
       OR (id = 5105025 AND permission_code <> 'platform:finance:fee-source:edit')
       OR (permission_code = 'platform:finance' AND id <> 5105000)
       OR (permission_code = 'platform:finance:fee-source:review' AND id <> 5105024)
       OR (permission_code = 'platform:finance:fee-source:edit' AND id <> 5105025)
       OR (id IN (5105000, 5105024, 5105025)
           AND (tenant_id <> 0 OR app_code <> 'PLATFORM'))
  ) THEN
    SIGNAL SQLSTATE '45000'
      SET MESSAGE_TEXT = 'finance G1/G2 permission id/code conflict';
  END IF;

  INSERT INTO iam_permission
    (id, tenant_id, app_code, permission_type, parent_id, permission_code,
     permission_name, route_path, http_method, sort_no, status, built_in, deleted)
  VALUES
    (5105000, 0, 'PLATFORM', 'MENU', 0, 'platform:finance',
     '财务管理', '/finance', NULL, 60, 'ACTIVE', 1, 0),
    (5105024, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:fee-source:review',
     '审核财务费用来源', NULL, 'POST', 150, 'ACTIVE', 1, 0),
    (5105025, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:fee-source:edit',
     '编辑财务费用来源', NULL, 'PUT', 160, 'ACTIVE', 1, 0)
  ON DUPLICATE KEY UPDATE
    permission_type = VALUES(permission_type), parent_id = VALUES(parent_id),
    permission_name = VALUES(permission_name), route_path = VALUES(route_path),
    http_method = VALUES(http_method), sort_no = VALUES(sort_no),
    status = 'ACTIVE', built_in = 1, deleted = 0;

  DELETE rp FROM iam_role_permission rp JOIN iam_permission p ON p.id=rp.permission_id AND p.tenant_id=rp.tenant_id
   WHERE p.tenant_id=0 AND p.app_code='PLATFORM' AND p.permission_code IN ('platform:finance:account:view','platform:finance:fee-source:view');
  UPDATE iam_permission SET status='INACTIVE', deleted=1
   WHERE tenant_id=0 AND app_code='PLATFORM' AND permission_code IN ('platform:finance:account:view','platform:finance:fee-source:view');

  IF (SELECT COUNT(*)
      FROM iam_permission
      WHERE tenant_id = 0
        AND app_code = 'PLATFORM'
        AND permission_type = 'BUTTON'
        AND parent_id = 5105000
        AND status = 'ACTIVE'
        AND built_in = 1
        AND deleted = 0
        AND permission_code IN (
          'platform:finance:fee-source:review',
          'platform:finance:fee-source:edit')) <> 2 THEN
    SIGNAL SQLSTATE '45000'
      SET MESSAGE_TEXT = 'finance G1/G2 permission catalog is incomplete';
  END IF;

  IF (SELECT COUNT(*)
      FROM iam_permission
      WHERE id = 5105000
        AND tenant_id = 0
        AND app_code = 'PLATFORM'
        AND permission_type = 'MENU'
        AND parent_id = 0
        AND permission_code = 'platform:finance'
        AND status = 'ACTIVE'
        AND built_in = 1
        AND deleted = 0) <> 1 THEN
    SIGNAL SQLSTATE '45000'
      SET MESSAGE_TEXT = 'finance permission parent is invalid';
  END IF;
END$$
DELIMITER ;

CALL migrate_finance_g1_g2_permissions();
DROP PROCEDURE IF EXISTS migrate_finance_g1_g2_permissions;