-- 海外费用查询菜单；编辑与审核沿用独立财务按钮权限，只读授权不包含写操作。
USE baiyue_iam;
SET NAMES utf8mb4;
DROP PROCEDURE IF EXISTS check_overseas_fee_permission_identity;
DELIMITER $$
CREATE PROCEDURE check_overseas_fee_permission_identity()
BEGIN
  -- 先恢复既有财务写按钮和管理员授权，再部署菜单；列表权限不代表可创建或审核。
  -- 缺失时先执行 deploy/sql/overseas-fee-canonical-write-permissions-repair.sql。
  IF (SELECT COUNT(*) FROM iam_role WHERE id=4000001 AND tenant_id=0 AND app_code='PLATFORM'
      AND role_code='PLATFORM_ADMIN' AND role_type='SYSTEM' AND status='ACTIVE' AND deleted=0)<>1
      OR EXISTS(SELECT 1 FROM iam_role WHERE role_code='PLATFORM_ADMIN' AND id<>4000001)
      OR (SELECT COUNT(*) FROM iam_permission p JOIN iam_role_permission rp ON rp.permission_id=p.id
          WHERE rp.role_id=4000001 AND rp.tenant_id=0 AND p.tenant_id=0 AND p.app_code='PLATFORM'
          AND p.permission_type='BUTTON' AND p.status='ACTIVE' AND p.deleted=0
          AND ((p.id=5105024 AND p.permission_code='platform:finance:fee-source:review')
            OR (p.id=5105025 AND p.permission_code='platform:finance:fee-source:edit')))<>2 THEN
    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='Run overseas-fee-canonical-write-permissions-repair.sql first; fee write grants missing';
  END IF;
  IF EXISTS(SELECT 1 FROM iam_permission WHERE
      (id=5117200 AND (permission_code<>'platform:overseas-fee:list' OR tenant_id<>0 OR app_code<>'PLATFORM' OR permission_type<>'MENU'))
      OR (permission_code='platform:overseas-fee:list' AND (id<>5117200 OR tenant_id<>0 OR app_code<>'PLATFORM'))) THEN
    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='Overseas fee permission identity conflict';
  END IF;
END$$
DELIMITER ;
CALL check_overseas_fee_permission_identity();
DROP PROCEDURE check_overseas_fee_permission_identity;

START TRANSACTION;
INSERT INTO iam_permission
  (id,tenant_id,app_code,permission_type,parent_id,permission_code,permission_name,route_path,http_method,sort_no,status,built_in,deleted)
VALUES (5117200,0,'PLATFORM','MENU',5105000,'platform:overseas-fee:list','海外费用明细','/overseas-business/fees','GET',60,'ACTIVE',1,0)
ON DUPLICATE KEY UPDATE permission_name=VALUES(permission_name),route_path=VALUES(route_path),parent_id=5105000,sort_no=60,status='ACTIVE',deleted=0;

INSERT IGNORE INTO iam_role_permission(tenant_id,role_id,permission_id,created_at)
SELECT 0,r.id,5117200,CURRENT_TIMESTAMP(3) FROM iam_role r
WHERE r.tenant_id=0 AND r.app_code='PLATFORM' AND r.role_code='PLATFORM_ADMIN' AND r.status='ACTIVE' AND r.deleted=0;

-- 默认管理员获得菜单后，同事务推进授权版本，已有会话及时读取新权限。
INSERT INTO iam_security_subject_version(auth_user_id,permission_version)
SELECT DISTINCT u.auth_user_id,1 FROM iam_user u
JOIN iam_membership m ON m.user_id=u.id
JOIN iam_membership_role mr ON mr.membership_id=m.id AND mr.tenant_id=m.tenant_id
JOIN iam_role r ON r.id=mr.role_id
WHERE u.auth_user_id IS NOT NULL AND u.status='ACTIVE' AND u.deleted=0
  AND m.status='ACTIVE' AND m.deleted=0 AND r.tenant_id=0 AND r.app_code='PLATFORM'
  AND r.role_code='PLATFORM_ADMIN' AND r.status='ACTIVE' AND r.deleted=0
ON DUPLICATE KEY UPDATE permission_version=permission_version+1;
COMMIT;