-- V73: 添加仪表盘监控按钮级权限码
-- 对应PRD要求: dashboard.chart.realtime, dashboard.chart.history, dashboard.kpi.config
-- 注意: ID从600开始，避免与V62 (500-512) 冲突

-- 1. 仪表盘监控-实时图表权限
INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 600, 'dashboard.chart.realtime', '实时图表', 'dashboard', 'chart', 'realtime', 'ALL', '查看实时监控图表', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'dashboard.chart.realtime');

-- 2. 仪表盘监控-历史图表权限
INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 601, 'dashboard.chart.history', '历史图表', 'dashboard', 'chart', 'history', 'ALL', '查看历史数据图表', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'dashboard.chart.history');

-- 3. 仪表盘-KPI配置权限
INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 602, 'dashboard.kpi.config', 'KPI配置', 'dashboard', 'kpi', 'config', 'ALL', '配置KPI阈值和告警规则', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'dashboard.kpi.config');

-- 4. 风险拦截权限
INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 603, 'risk.block.execute', '执行拦截', 'risk', 'block', 'execute', 'ALL', '执行风险拦截操作', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'risk.block.execute');

-- 5. 风险解除拦截权限
INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 604, 'risk.block.release', '解除拦截', 'risk', 'block', 'release', 'ALL', '解除风险拦截', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'risk.block.release');

-- 6. 用户标签权限
INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 605, 'user.tag.add', '添加标签', 'user', 'tag', 'add', 'ALL', '为用户添加标签', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'user.tag.add');

-- 7. 用户标签查询权限
INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 606, 'user.tag.view', '查看标签', 'user', 'tag', 'view', 'ALL', '查看用户标签', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'user.tag.view');

-- 8. API Key创建权限
INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 607, 'system.api-key.create', '创建API Key', 'system', 'api-key', 'create', 'ALL', '创建新的API Key', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'system.api-key.create');

-- 9. API Key查看权限
INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 608, 'system.api-key.view', '查看API Key', 'system', 'api-key', 'view', 'ALL', '查看API Key列表', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'system.api-key.view');

-- 10. API Key启用权限
INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 609, 'system.api-key.enable', '启用API Key', 'system', 'api-key', 'enable', 'ALL', '启用API Key', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'system.api-key.enable');

-- 11. API Key禁用权限
INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 610, 'system.api-key.disable', '禁用API Key', 'system', 'api-key', 'disable', 'ALL', '禁用API Key', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'system.api-key.disable');

-- 12. API Key删除权限
INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 611, 'system.api-key.delete', '删除API Key', 'system', 'api-key', 'delete', 'ALL', '删除API Key', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'system.api-key.delete');

-- 13. API Key重置权限
INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
SELECT 612, 'system.api-key.reset', '重置API Key', 'system', 'api-key', 'reset', 'ALL', '重置API Key密钥', 'ENABLED', CURRENT_TIMESTAMP
WHERE NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'system.api-key.reset');

-- 为超级管理员角色添加新权限
INSERT INTO sys_role_permission (role_id, permission_id)
SELECT r.id, p.id
FROM sys_role r
CROSS JOIN sys_permission p
WHERE r.role_code = 'super_admin'
AND p.permission_code IN (
    'dashboard.chart.realtime',
    'dashboard.chart.history',
    'dashboard.kpi.config',
    'risk.block.execute',
    'risk.block.release',
    'user.tag.add',
    'user.tag.view',
    'system.api-key.create',
    'system.api-key.view',
    'system.api-key.enable',
    'system.api-key.disable',
    'system.api-key.delete',
    'system.api-key.reset'
)
AND NOT EXISTS (
    SELECT 1 FROM sys_role_permission rp
    WHERE rp.role_id = r.id AND rp.permission_id = p.id
);

-- 为系统管理员角色添加新权限
INSERT INTO sys_role_permission (role_id, permission_id)
SELECT r.id, p.id
FROM sys_role r
CROSS JOIN sys_permission p
WHERE r.role_code = 'system_admin'
AND p.permission_code IN (
    'dashboard.chart.realtime',
    'dashboard.chart.history',
    'dashboard.kpi.config',
    'risk.block.execute',
    'risk.block.release',
    'user.tag.add',
    'user.tag.view',
    'system.api-key.create',
    'system.api-key.view',
    'system.api-key.enable',
    'system.api-key.disable',
    'system.api-key.delete',
    'system.api-key.reset'
)
AND NOT EXISTS (
    SELECT 1 FROM sys_role_permission rp
    WHERE rp.role_id = r.id AND rp.permission_id = p.id
);
