-- V62: 添加PRD按钮级权限码
-- 用途: 补齐PRD中缺失的按钮级权限码，满足验收标准
-- 对应评审报告P0任务: 补齐PRD缺失权限码

-- 1. 审批执行权限 (approval.execute.*)
INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 500, 'approval.execute.approve.ALL', '审批通过', 'approval', 'execute', 'approve', 'ALL', '审批通过操作', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'approval.execute.approve.ALL');

INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 501, 'approval.execute.reject.ALL', '审批拒绝', 'approval', 'execute', 'reject', 'ALL', '审批拒绝操作', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'approval.execute.reject.ALL');

INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 502, 'approval.execute.transfer.ALL', '审批转交', 'approval', 'execute', 'transfer', 'ALL', '审批转交操作', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'approval.execute.transfer.ALL');

-- 2. 用户权限管理 (permission.user.*)
INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 503, 'permission.user.assign.ALL', '分配用户权限', 'permission', 'user', 'assign', 'ALL', '为用户分配权限', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'permission.user.assign.ALL');

INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 504, 'permission.user.revoke.ALL', '撤销用户权限', 'permission', 'user', 'revoke', 'ALL', '撤销用户权限', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'permission.user.revoke.ALL');

-- 3. 数据权限配置 (permission.data.*)
INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 505, 'permission.data.config.ALL', '配置数据权限', 'permission', 'data', 'config', 'ALL', '配置用户数据权限范围', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'permission.data.config.ALL');

-- 4. 风控规则按钮级权限 (risk.rule.*)
INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 506, 'risk.rule.create.ALL', '创建风控规则', 'risk', 'rule', 'create', 'ALL', '创建风控规则', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'risk.rule.create.ALL');

INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 507, 'risk.rule.edit.ALL', '编辑风控规则', 'risk', 'rule', 'edit', 'ALL', '编辑风控规则', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'risk.rule.edit.ALL');

INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 508, 'risk.rule.delete.ALL', '删除风控规则', 'risk', 'rule', 'delete', 'ALL', '删除风控规则', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'risk.rule.delete.ALL');

INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 509, 'risk.rule.enable.ALL', '启用风控规则', 'risk', 'rule', 'enable', 'ALL', '启用/停用风控规则', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'risk.rule.enable.ALL');

-- 5. 仪表盘监控权限 (dashboard.monitor.*)
INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 510, 'dashboard.monitor.view.ALL', '查看监控面板', 'dashboard', 'monitor', 'view', 'ALL', '查看系统监控面板', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'dashboard.monitor.view.ALL');

-- 6. 活动模板和配置权限 (activity.*)
INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 511, 'activity.template.view.ALL', '查看活动模板', 'activity', 'template', 'view', 'ALL', '查看活动模板列表', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'activity.template.view.ALL');

INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 512, 'activity.config.edit.ALL', '编辑活动配置', 'activity', 'config', 'edit', 'ALL', '编辑活动规则配置', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'activity.config.edit.ALL');

-- 为超级管理员分配新增权限
INSERT INTO sys_role_permission (role_id, permission_id)
SELECT 1, id FROM sys_permission WHERE permission_code IN (
    'approval.execute.approve.ALL', 'approval.execute.reject.ALL', 'approval.execute.transfer.ALL',
    'permission.user.assign.ALL', 'permission.user.revoke.ALL', 'permission.data.config.ALL',
    'risk.rule.create.ALL', 'risk.rule.edit.ALL', 'risk.rule.delete.ALL', 'risk.rule.enable.ALL',
    'dashboard.monitor.view.ALL', 'activity.template.view.ALL', 'activity.config.edit.ALL'
) AND NOT EXISTS (
    SELECT 1 FROM sys_role_permission WHERE role_id = 1 AND permission_id = sys_permission.id
);

-- 为系统管理员分配新增权限
INSERT INTO sys_role_permission (role_id, permission_id)
SELECT 2, id FROM sys_permission WHERE permission_code IN (
    'approval.execute.approve.ALL', 'approval.execute.reject.ALL', 'approval.execute.transfer.ALL',
    'permission.user.assign.ALL', 'permission.user.revoke.ALL', 'permission.data.config.ALL',
    'risk.rule.create.ALL', 'risk.rule.edit.ALL', 'risk.rule.delete.ALL', 'risk.rule.enable.ALL',
    'dashboard.monitor.view.ALL', 'activity.template.view.ALL', 'activity.config.edit.ALL'
) AND NOT EXISTS (
    SELECT 1 FROM sys_role_permission WHERE role_id = 2 AND permission_id = sys_permission.id
);

-- 为风控经理分配风控规则权限
INSERT INTO sys_role_permission (role_id, permission_id)
SELECT 8, id FROM sys_permission WHERE permission_code IN (
    'risk.rule.create.ALL', 'risk.rule.edit.ALL', 'risk.rule.delete.ALL', 'risk.rule.enable.ALL'
) AND NOT EXISTS (
    SELECT 1 FROM sys_role_permission WHERE role_id = 8 AND permission_id = sys_permission.id
);

-- 为风控专员分配风控规则只读权限
INSERT INTO sys_role_permission (role_id, permission_id)
SELECT 12, id FROM sys_permission WHERE permission_code = 'risk.index.view.ALL'
AND NOT EXISTS (
    SELECT 1 FROM sys_role_permission WHERE role_id = 12 AND permission_id = sys_permission.id
);
