// 自动化运维写操作权限 — 脚本库 / 定时任务 // Logan.Li
package middleware

import (
	"net/http"
	"strings"

	"ezops/model"

	"github.com/gin-gonic/gin"
	"gorm.io/gorm"
)

// AutomationWrite 创建/修改/删除/执行脚本与定时任务需具备自动化运维权限 // Logan.Li
func AutomationWrite(db *gorm.DB) gin.HandlerFunc {
	return func(c *gin.Context) {
		if isAdmin, _ := c.Get("isAdmin"); isAdmin == true {
			c.Next()
			return
		}
		userID, ok := c.Get("userID")
		if !ok {
			c.JSON(http.StatusUnauthorized, model.Response{Code: 401, Message: "未认证"})
			c.Abort()
			return
		}
		codes := collectPermissionCodes(db, userID.(uint))
		for _, code := range codes {
			if code == "*" || strings.HasPrefix(code, "auto:") {
				c.Next()
				return
			}
		}
		c.JSON(http.StatusForbidden, model.Response{
			Code:    403,
			Message: "需要自动化运维权限（auto:script 或 auto:cron），请联系管理员分配角色",
		})
		c.Abort()
	}
}

// collectPermissionCodes 查询用户有效权限码 // Logan.Li
func collectPermissionCodes(db *gorm.DB, userID uint) []string {
	var rows []struct{ Code string }
	db.Raw(`
		SELECT DISTINCT p.code AS code
		FROM iam_user_roles ur
		JOIN iam_roles r ON r.id = ur.role_id AND r.status = 1
		JOIN role_permissions rp ON rp.role_id = r.id
		JOIN iam_permissions p ON p.id = rp.permission_id AND p.status = 1
		WHERE ur.user_id = ?
	`, userID).Scan(&rows)
	codes := make([]string, 0, len(rows))
	for _, r := range rows {
		if r.Code != "" {
			codes = append(codes, r.Code)
		}
	}
	return codes
}