-- 通用 IAM 权限点独立初始化入口（MySQL 8.0）。
-- 国内与海外业务的 Admin/Client 权限主数据均在 baiyue_iam 统一管理。
-- 只允许写入 baiyue_iam 的权限资源和角色授权；
-- 不建表、不创建账号/客户/仓库，不写业务测试数据。
-- 前置：IAM 基础表、相关父菜单及系统角色已由全量基线创建。
USE baiyue_iam;
SET NAMES utf8mb4;

DROP PROCEDURE IF EXISTS apply_permission_points;
DELIMITER $$
CREATE PROCEDURE apply_permission_points()
BEGIN
  IF NOT EXISTS (SELECT 1 FROM iam_permission WHERE id = 5102010 AND tenant_id = 0
      AND permission_code = 'platform:order:list' AND permission_type = 'MENU') THEN
    SIGNAL SQLSTATE '45000'
      SET MESSAGE_TEXT = '权限初始化失败：订单列表父菜单不存在，请先执行全量基线';
  END IF;
  IF (SELECT COUNT(*) FROM iam_role WHERE id IN (4000001, 4000003) AND tenant_id = 0
      AND app_code = 'PLATFORM' AND status = 'ACTIVE' AND deleted = 0) <> 2 THEN
    SIGNAL SQLSTATE '45000'
      SET MESSAGE_TEXT = '权限初始化失败：平台管理员或订单运营角色不存在';
  END IF;
  IF EXISTS (SELECT 1 FROM iam_permission WHERE id = 5102027
      AND permission_code <> 'platform:order:declaration:edit')
     OR EXISTS (SELECT 1 FROM iam_permission
      WHERE permission_code = 'platform:order:declaration:edit' AND id <> 5102027) THEN
    SIGNAL SQLSTATE '45000'
      SET MESSAGE_TEXT = '权限初始化失败：5102027 或权限码已被其他语义占用';
  END IF;

  START TRANSACTION;
  INSERT INTO iam_permission
    (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name,
     route_path, http_method, sort_no, status, deleted)
  VALUES
    (5102027, 0, 'PLATFORM', 'BUTTON', 5102010, 'platform:order:declaration:edit',
     '修改订单申报与运营预估', NULL, NULL, 130, 'ACTIVE', 0)
  ON DUPLICATE KEY UPDATE
    permission_name = VALUES(permission_name), parent_id = VALUES(parent_id),
    permission_type = VALUES(permission_type), app_code = VALUES(app_code),
    sort_no = VALUES(sort_no), status = 'ACTIVE', deleted = 0;

  INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
  SELECT role_id, 5102027, 0
  FROM (SELECT 4000001 AS role_id UNION ALL SELECT 4000003 AS role_id) roles
  ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);

  IF (SELECT COUNT(*) FROM iam_permission WHERE id = 5102027 AND tenant_id = 0
       AND app_code = 'PLATFORM' AND permission_type = 'BUTTON' AND parent_id = 5102010
       AND permission_code = 'platform:order:declaration:edit'
       AND status = 'ACTIVE' AND deleted = 0) <> 1
     OR (SELECT COUNT(DISTINCT role_id) FROM iam_role_permission
         WHERE tenant_id = 0 AND permission_id = 5102027
           AND role_id IN (4000001, 4000003)) <> 2 THEN
    ROLLBACK;
    SIGNAL SQLSTATE '45000'
      SET MESSAGE_TEXT = '权限初始化失败：订单申报与运营预估权限未完整写入';
  END IF;
  COMMIT;
END$$
DELIMITER ;

CALL apply_permission_points();
DROP PROCEDURE IF EXISTS apply_permission_points;

SELECT 'PASS' AS permission_initialization_status;