-- V79: 清理所有Legacy权限码并补充缺失的Canonical权限码
-- 问题: 数据库中存在262个非canonical格式的legacy权限码（不以.ALL结尾）
-- 要求: 根据PermissionCanonicalMigrationTest测试
--       1. shouldHaveZeroLegacyPermissionCodes: 所有非.ALL结尾的权限码必须为0
--       2. shouldValidateAll72CanonicalPermissions: 必须有72个canonical格式权限码
-- 执行策略: 删除legacy权限码，并插入缺失的canonical权限码

-- 1. 首先删除角色权限关联表中引用了legacy权限的记录
DELETE FROM sys_role_permission
WHERE permission_id IN (
    SELECT id FROM sys_permission WHERE permission_code NOT LIKE '%.ALL'
);

-- 2. 删除所有legacy权限码记录
DELETE FROM sys_permission
WHERE permission_code NOT LIKE '%.ALL';

-- 3. 插入缺失的Canonical权限码（使用动态ID，仅插入不存在的）
DO $$
DECLARE
    next_id BIGINT;
    inserted INTEGER := 0;
BEGIN
    SELECT COALESCE(MAX(id), 0) + 1 INTO next_id FROM sys_permission;

    -- 仪表盘模块 (dashboard) - 2个
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'dashboard.index.view.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'dashboard.index.view.ALL', '查看仪表盘', 'dashboard', 'index', 'view', 'ALL', '查看仪表盘首页', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'dashboard.index.export.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'dashboard.index.export.ALL', '导出仪表盘', 'dashboard', 'index', 'export', 'ALL', '导出仪表盘数据', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;

    -- 活动管理模块 (activity) - 10个
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'activity.index.view.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'activity.index.view.ALL', '查看活动', 'activity', 'index', 'view', 'ALL', '查看活动列表', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'activity.index.create.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'activity.index.create.ALL', '创建活动', 'activity', 'index', 'create', 'ALL', '创建新活动', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'activity.index.update.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'activity.index.update.ALL', '更新活动', 'activity', 'index', 'update', 'ALL', '更新活动信息', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'activity.index.delete.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'activity.index.delete.ALL', '删除活动', 'activity', 'index', 'delete', 'ALL', '删除活动', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'activity.index.publish.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'activity.index.publish.ALL', '发布活动', 'activity', 'index', 'publish', 'ALL', '发布活动', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'activity.index.pause.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'activity.index.pause.ALL', '暂停活动', 'activity', 'index', 'pause', 'ALL', '暂停活动', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'activity.index.resume.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'activity.index.resume.ALL', '恢复活动', 'activity', 'index', 'resume', 'ALL', '恢复暂停的活动', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'activity.index.end.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'activity.index.end.ALL', '结束活动', 'activity', 'index', 'end', 'ALL', '结束活动', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'activity.index.export.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'activity.index.export.ALL', '导出活动', 'activity', 'index', 'export', 'ALL', '导出活动数据', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'activity.index.clone.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'activity.index.clone.ALL', '克隆活动', 'activity', 'index', 'clone', 'ALL', '克隆活动', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;

    -- 用户管理模块 (user) - 8个
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'user.index.view.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'user.index.view.ALL', '查看用户', 'user', 'index', 'view', 'ALL', '查看用户列表', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'user.index.create.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'user.index.create.ALL', '创建用户', 'user', 'index', 'create', 'ALL', '创建用户', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'user.index.update.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'user.index.update.ALL', '更新用户', 'user', 'index', 'update', 'ALL', '更新用户信息', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'user.index.delete.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'user.index.delete.ALL', '删除用户', 'user', 'index', 'delete', 'ALL', '删除用户', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'user.index.freeze.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'user.index.freeze.ALL', '冻结用户', 'user', 'index', 'freeze', 'ALL', '冻结用户账号', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'user.index.unfreeze.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'user.index.unfreeze.ALL', '解冻用户', 'user', 'index', 'unfreeze', 'ALL', '解冻用户账号', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'user.index.certify.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'user.index.certify.ALL', '实名认证', 'user', 'index', 'certify', 'ALL', '用户实名认证', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'user.index.export.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'user.index.export.ALL', '导出用户', 'user', 'index', 'export', 'ALL', '导出用户数据', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;

    -- 奖励管理模块 (reward) - 9个
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'reward.index.view.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'reward.index.view.ALL', '查看奖励', 'reward', 'index', 'view', 'ALL', '查看奖励列表', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'reward.index.apply.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'reward.index.apply.ALL', '申请奖励', 'reward', 'index', 'apply', 'ALL', '申请奖励', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'reward.index.approve.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'reward.index.approve.ALL', '审批奖励', 'reward', 'index', 'approve', 'ALL', '审批奖励申请', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'reward.index.grant.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'reward.index.grant.ALL', '发放奖励', 'reward', 'index', 'grant', 'ALL', '发放奖励', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'reward.index.reject.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'reward.index.reject.ALL', '拒绝奖励', 'reward', 'index', 'reject', 'ALL', '拒绝奖励申请', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'reward.index.cancel.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'reward.index.cancel.ALL', '取消奖励', 'reward', 'index', 'cancel', 'ALL', '取消奖励', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'reward.index.export.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'reward.index.export.ALL', '导出奖励', 'reward', 'index', 'export', 'ALL', '导出奖励数据', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'reward.index.reconcile.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'reward.index.reconcile.ALL', '奖励对账', 'reward', 'index', 'reconcile', 'ALL', '奖励对账操作', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'reward.index.batch.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'reward.index.batch.ALL', '批量奖励', 'reward', 'index', 'batch', 'ALL', '批量奖励操作', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;

    -- 风险管理模块 (risk) - 7个
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'risk.index.view.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'risk.index.view.ALL', '查看风控', 'risk', 'index', 'view', 'ALL', '查看风控信息', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'risk.rule.manage.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'risk.rule.manage.ALL', '管理风控规则', 'risk', 'rule', 'manage', 'ALL', '管理风控规则', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'risk.index.audit.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'risk.index.audit.ALL', '审核风控', 'risk', 'index', 'audit', 'ALL', '审核风控事件', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'risk.blacklist.manage.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'risk.blacklist.manage.ALL', '管理黑名单', 'risk', 'blacklist', 'manage', 'ALL', '管理黑名单', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'risk.index.export.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'risk.index.export.ALL', '导出风控', 'risk', 'index', 'export', 'ALL', '导出风控数据', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'risk.block.execute.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'risk.block.execute.ALL', '执行拦截', 'risk', 'block', 'execute', 'ALL', '执行风险拦截', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'risk.block.release.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'risk.block.release.ALL', '解除拦截', 'risk', 'block', 'release', 'ALL', '解除风险拦截', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;

    -- 审批中心模块 (approval) - 9个
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'approval.index.view.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'approval.index.view.ALL', '查看审批', 'approval', 'index', 'view', 'ALL', '查看审批列表', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'approval.index.submit.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'approval.index.submit.ALL', '提交审批', 'approval', 'index', 'submit', 'ALL', '提交审批申请', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'approval.index.handle.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'approval.index.handle.ALL', '处理审批', 'approval', 'index', 'handle', 'ALL', '处理审批申请', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'approval.index.cancel.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'approval.index.cancel.ALL', '取消审批', 'approval', 'index', 'cancel', 'ALL', '取消审批申请', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'approval.index.delegate.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'approval.index.delegate.ALL', '委托审批', 'approval', 'index', 'delegate', 'ALL', '委托他人审批', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'approval.index.batch.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'approval.index.batch.ALL', '批量审批', 'approval', 'index', 'batch', 'ALL', '批量审批操作', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'approval.index.batch.handle.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'approval.index.batch.handle.ALL', '批量处理审批', 'approval', 'index', 'batch.handle', 'ALL', '批量处理审批', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'approval.flow.manage.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'approval.flow.manage.ALL', '管理审批流程', 'approval', 'flow', 'manage', 'ALL', '管理审批流程', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'approval.record.view.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'approval.record.view.ALL', '查看审批记录', 'approval', 'record', 'view', 'ALL', '查看审批记录', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;

    -- 审计日志模块 (audit) - 3个
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'audit.index.view.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'audit.index.view.ALL', '查看审计', 'audit', 'index', 'view', 'ALL', '查看审计日志', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'audit.index.export.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'audit.index.export.ALL', '导出审计', 'audit', 'index', 'export', 'ALL', '导出审计日志', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'audit.report.view.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'audit.report.view.ALL', '查看审计报告', 'audit', 'report', 'view', 'ALL', '查看审计报告', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;

    -- 系统配置模块 (system) - 4个
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'system.index.view.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'system.index.view.ALL', '查看系统', 'system', 'index', 'view', 'ALL', '查看系统配置', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'system.config.manage.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'system.config.manage.ALL', '系统配置', 'system', 'config', 'manage', 'ALL', '管理系统配置', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'system.cache.manage.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'system.cache.manage.ALL', '缓存管理', 'system', 'cache', 'manage', 'ALL', '管理系统缓存', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'system.sensitive.access.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'system.sensitive.access.ALL', '访问敏感数据', 'system', 'sensitive', 'access', 'ALL', '访问敏感数据', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;

    -- 权限管理模块 (permission) - 2个
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'permission.index.view.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'permission.index.view.ALL', '查看权限', 'permission', 'index', 'view', 'ALL', '查看权限列表', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'permission.index.manage.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'permission.index.manage.ALL', '权限管理', 'permission', 'index', 'manage', 'ALL', '管理系统权限', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;

    -- 角色管理模块 (role) - 2个
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'role.index.view.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'role.index.view.ALL', '查看角色', 'role', 'index', 'view', 'ALL', '查看角色列表', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'role.index.manage.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'role.index.manage.ALL', '角色管理', 'role', 'index', 'manage', 'ALL', '管理系统角色', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;

    -- 部门管理模块 (department) - 2个
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'department.index.view.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'department.index.view.ALL', '查看部门', 'department', 'index', 'view', 'ALL', '查看部门列表', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'department.index.manage.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'department.index.manage.ALL', '部门管理', 'department', 'index', 'manage', 'ALL', '管理部门', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;

    -- 通知管理模块 (notification) - 2个
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'notification.index.view.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'notification.index.view.ALL', '查看通知', 'notification', 'index', 'view', 'ALL', '查看通知列表', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'notification.index.manage.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'notification.index.manage.ALL', '通知管理', 'notification', 'index', 'manage', 'ALL', '管理通知', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;

    -- API Key管理模块 (system.api-key) - 7个
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'system.api-key.view.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'system.api-key.view.ALL', '查看API Key', 'system', 'api-key', 'view', 'ALL', '查看API Key列表', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'system.api-key.create.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'system.api-key.create.ALL', '创建API Key', 'system', 'api-key', 'create', 'ALL', '创建新的API Key', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'system.api-key.enable.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'system.api-key.enable.ALL', '启用API Key', 'system', 'api-key', 'enable', 'ALL', '启用API Key', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'system.api-key.disable.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'system.api-key.disable.ALL', '禁用API Key', 'system', 'api-key', 'disable', 'ALL', '禁用API Key', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'system.api-key.delete.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'system.api-key.delete.ALL', '删除API Key', 'system', 'api-key', 'delete', 'ALL', '删除API Key', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'system.api-key.reset.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'system.api-key.reset.ALL', '重置API Key', 'system', 'api-key', 'reset', 'ALL', '重置API Key密钥', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'system.api-key.manage.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'system.api-key.manage.ALL', '管理API Key', 'system', 'api-key', 'manage', 'ALL', '管理API Key使用和验证', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;

    -- 仪表盘监控模块 (dashboard.chart/dashboard.kpi) - 3个
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'dashboard.chart.realtime.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'dashboard.chart.realtime.ALL', '实时图表', 'dashboard', 'chart', 'realtime', 'ALL', '查看实时监控图表', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'dashboard.chart.history.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'dashboard.chart.history.ALL', '历史图表', 'dashboard', 'chart', 'history', 'ALL', '查看历史数据图表', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'dashboard.kpi.config.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'dashboard.kpi.config.ALL', 'KPI配置', 'dashboard', 'kpi', 'config', 'ALL', '配置KPI阈值和告警规则', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;

    -- 用户标签模块 (user.tag) - 2个
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'user.tag.add.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'user.tag.add.ALL', '添加标签', 'user', 'tag', 'add', 'ALL', '为用户添加标签', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;
    IF NOT EXISTS (SELECT 1 FROM sys_permission WHERE permission_code = 'user.tag.view.ALL') THEN
        INSERT INTO sys_permission (id, permission_code, permission_name, module_code, resource_code, operation_code, data_scope, description, status, created_at)
        VALUES (next_id, 'user.tag.view.ALL', '查看标签', 'user', 'tag', 'view', 'ALL', '查看用户标签', 'ENABLED', CURRENT_TIMESTAMP);
        next_id := next_id + 1; inserted := inserted + 1;
    END IF;

    RAISE NOTICE 'Inserted % missing canonical permission codes', inserted;
END $$;

-- 4. 验证清理结果
DO $$
DECLARE
    legacy_count INTEGER;
    canonical_count INTEGER;
BEGIN
    SELECT COUNT(*) INTO legacy_count FROM sys_permission WHERE permission_code NOT LIKE '%.ALL';
    SELECT COUNT(*) INTO canonical_count FROM sys_permission WHERE permission_code LIKE '%.ALL';

    RAISE NOTICE 'Legacy permission codes after cleanup: %', legacy_count;
    RAISE NOTICE 'Canonical permission codes after cleanup: %', canonical_count;

    IF legacy_count > 0 THEN
        RAISE EXCEPTION '清理失败: 仍有 % 个legacy权限码未清理', legacy_count;
    END IF;
END $$;
