const MODULE = 'phase3-warehouse-rbac'
const OPTIONS = { scenario: 'warehouse-role-boundary', deploymentBlocker: true }

function id(value) { return value == null ? '' : String(value) }

export async function run(context) {
  const permissionsResponse = await context.request('GET', '/api/platform/v1/iam/permissions')
  const permissions = context.apiSuccess(MODULE, '查询平台权限资源', permissionsResponse, '', OPTIONS)
  const permissionById = new Map((Array.isArray(permissions) ? permissions : [])
    .map((item) => [id(item.id), item.permissionCode]))

  const controllerCodes = ['platform:firstleg:pda:view', 'platform:firstleg:pda:assign',
    'platform:firstleg:pda:work', 'platform:firstleg:pda:review',
    'platform:firstleg:inbound:loading:view', 'platform:firstleg:inbound:loading:edit',
    'platform:firstleg:inbound:loading:complete']
  const controllerPermissions = (Array.isArray(permissions) ? permissions : [])
    .filter((item) => controllerCodes.includes(item.permissionCode))
  context.assert(MODULE, 'PDA和装柜证据Controller权限资源完整', permissionsResponse,
    controllerPermissions.length === controllerCodes.length
      && controllerPermissions.every((item) => item.builtIn === true && item.status === 'ACTIVE'),
    `matched=${controllerPermissions.length}/${controllerCodes.length}`, OPTIONS)

  const rolesResponse = await context.request('GET', '/api/platform/v1/iam/roles')
  const roles = context.apiSuccess(MODULE, '查询三期仓库内置角色', rolesResponse, '', OPTIONS)
  const warehouseRoles = new Map((Array.isArray(roles) ? roles : [])
    .filter((item) => ['WAREHOUSE_OPERATOR', 'WAREHOUSE_PICKER', 'WAREHOUSE_TALLY'].includes(item.roleCode))
    .map((item) => [item.roleCode, item]))
  context.assert(MODULE, '操作员、拣货员、理货员三个系统角色已启用', rolesResponse,
    warehouseRoles.size === 3 && [...warehouseRoles.values()]
      .every((role) => role.roleType === 'SYSTEM' && role.status === 'ACTIVE'),
    `roles=${[...warehouseRoles.keys()].join(',')}`, OPTIONS)

  const roleCodes = (roleCode) => new Set((warehouseRoles.get(roleCode)?.permissionIds || [])
    .map((permissionId) => permissionById.get(id(permissionId))).filter(Boolean))
  const pickerCodes = roleCodes('WAREHOUSE_PICKER')
  context.assert(MODULE, '拣货员只具备PDA查询、作业和现场拍照权限', rolesResponse,
    pickerCodes.size === 2
      && pickerCodes.has('platform:firstleg:pda:view')
      && pickerCodes.has('platform:firstleg:pda:work'),
    `permissions=${[...pickerCodes].sort().join(',')}`, OPTIONS)

  const operatorCodes = roleCodes('WAREHOUSE_OPERATOR')
  context.assert(MODULE, '操作员仅具备入仓查看和后台证据维护权限', rolesResponse,
    operatorCodes.has('platform:firstleg:inbound:loading:view')
      && operatorCodes.has('platform:firstleg:inbound:loading:edit')
      && operatorCodes.size === 5
      && !operatorCodes.has('platform:firstleg:inbound:loading:complete')
      && !operatorCodes.has('platform:firstleg:pda:assign')
      && !operatorCodes.has('platform:firstleg:outbound-dispatch:confirm')
      && !operatorCodes.has('platform:firstleg:outbound-dispatch:reverse'),
    `permissionCount=${operatorCodes.size}`, OPTIONS)

  const tallyCodes = roleCodes('WAREHOUSE_TALLY')
  context.assert(MODULE, '理货员可后台维护证据和复核但不能完成装柜', rolesResponse,
    tallyCodes.has('platform:firstleg:inbound:loading:view')
      && tallyCodes.has('platform:firstleg:inbound:loading:edit')
      && tallyCodes.has('platform:firstleg:pda:review')
      && !tallyCodes.has('platform:firstleg:inbound:loading:complete')
      && !tallyCodes.has('platform:firstleg:outbound-dispatch:confirm'),
    `permissionCount=${tallyCodes.size}`, OPTIONS)

  context.assert(MODULE, '仓库系统角色不包含任何客户侧权限', rolesResponse,
    [...operatorCodes, ...pickerCodes, ...tallyCodes].every((code) => code.startsWith('platform:')),
    'all warehouse role permissions must use platform scope', OPTIONS)

  const unauthorized = await context.request('GET',
    '/api/platform/v1/first-leg/pda-loading/tasks?cabinetNo=UNAUTHORIZED&warehouseId=1', undefined, '')
  context.addStep(MODULE, '未登录访问仓库PDA任务被拒绝', unauthorized,
    [401, 403].includes(unauthorized.http)
      || (unauthorized.http === 200 && ['A0401', 'A0403', '401', '403'].includes(String(unauthorized.body?.code))),
    `HTTP=${unauthorized.http}, code=${unauthorized.body?.code ?? 'missing'}`, OPTIONS)
}