-- A 卡运维平台角色权限矩阵初始化 V0.1
-- 目标库：model_platform
-- 说明：
-- 1. 本脚本只新增/恢复运维权限和业务团队角色，不删除既有权限。
-- 2. 重复执行幂等；已有软删除权限/关联会被恢复。
-- 3. admin、developer 使用现有角色；developer 对应模型团队。
-- 4. 业务账号不会在本脚本中被批量改角色，需确认用户名后再分配 business_team。

USE model_platform;
SET NAMES utf8mb4;

START TRANSACTION;

-- 业务团队角色：不存在时创建，存在时恢复并更新展示信息。
INSERT INTO roles (
    role_id, role_code, role_name, role_scope, is_builtin,
    description, is_deleted, deleted_at
) VALUES (
    '0000000000VKFJ85E90FABHPGT',
    'business_team',
    '业务团队',
    'platform',
    1,
    'A 卡运维平台业务团队角色',
    0,
    NULL
) AS incoming_role
ON DUPLICATE KEY UPDATE
    role_name = incoming_role.role_name,
    role_scope = incoming_role.role_scope,
    is_builtin = incoming_role.is_builtin,
    description = incoming_role.description,
    is_deleted = 0,
    deleted_at = NULL;

-- 运维页面和操作权限。
INSERT INTO permissions (
    permission_id, permission_code, permission_name, module_code,
    description, is_deleted, deleted_at
) VALUES
    ('10000000000000000000000001', 'operations:workbench:view', '查看运维工作台', 'operations', '查看运维工作台、KPI、待办和关注', 0, NULL),
    ('10000000000000000000000002', 'operations:usage:view', '查看平台使用统计', 'operations', '查看平台使用统计', 0, NULL),
    ('10000000000000000000000003', 'operations:model-overview:view', '查看模型大类概览', 'operations', '查看模型大类概览', 0, NULL),
    ('10000000000000000000000004', 'operations:bank-overview:view', '查看细分银行概览', 'operations', '查看细分银行概览', 0, NULL),
    ('10000000000000000000000005', 'operations:deployed-models:view', '查看已上线模型详情', 'operations', '查看已上线模型详情', 0, NULL),
    ('10000000000000000000000006', 'operations:monitoring-overview:view', '查看模型监控概览', 'operations', '查看模型监控概览和监控明细', 0, NULL),
    ('10000000000000000000000007', 'operations:monitoring-detail:view', '查看模型监控详情', 'operations', '查看模型监控详情和指标分布', 0, NULL),
    ('10000000000000000000000008', 'operations:monitoring-detail:model-review', '模型团队初审监控结果', 'operations', '模型团队处理监控结果并提交初审', 0, NULL),
    ('10000000000000000000000009', 'operations:monitoring-detail:business-review', '业务团队终审监控结果', 'operations', '业务团队确认监控处理结果', 0, NULL),
    ('1000000000000000000000000A', 'operations:report:view', '查看监控诊断报告', 'operations', '查看监控诊断报告', 0, NULL),
    ('1000000000000000000000000B', 'operations:report:edit', '编辑监控诊断报告', 'operations', '编辑监控诊断报告内容', 0, NULL),
    ('1000000000000000000000000D', 'operations:report:export', '导出监控诊断报告', 'operations', '导出监控诊断报告', 0, NULL),
    ('1000000000000000000000000E', 'operations:report:send', '发送监控诊断报告', 'operations', '发送监控诊断报告', 0, NULL),
    ('1000000000000000000000000F', 'operations:report-summary:view', '查看历史报告汇总', 'operations', '查看历史报告汇总', 0, NULL),
    ('10000000000000000000000010', 'operations:workflow:view', '查看全流程进度', 'operations', '查看全流程进度', 0, NULL),
    ('10000000000000000000000011', 'operations:workflow:create', '发起模型需求', 'operations', '业务团队发起模型开发或迭代需求', 0, NULL),
    ('10000000000000000000000012', 'operations:workflow:feedback', '流程反馈', 'operations', '业务团队填写方案设计等反馈', 0, NULL),
    ('10000000000000000000000013', 'operations:workflow:confirm', '流程确认', 'operations', '业务团队确认流程材料和结果', 0, NULL),
    ('10000000000000000000000014', 'operations:workflow:submit-material', '提交流程材料', 'operations', '模型团队提交流程材料', 0, NULL),
    ('10000000000000000000000015', 'operations:workflow:advance', '推进流程', 'operations', '模型团队推进流程环节', 0, NULL),
    ('10000000000000000000000016', 'operations:workflow:online', '模型上线', 'operations', '模型团队提交模型上线信息', 0, NULL),
    ('10000000000000000000000017', 'operations:knowledge:view', '查看文档知识库', 'operations', '按模型、名称和环节查看文档知识库', 0, NULL),
    ('10000000000000000000000018', 'operations:rules:view', '查看监控等级规则', 'operations', '查看监控等级规则', 0, NULL),
    ('10000000000000000000000019', 'operations:rules:publish', '发布监控等级规则', 'operations', '发布监控等级规则版本', 0, NULL),
    ('1000000000000000000000001A', 'operations:rules:rollback', '回滚监控等级规则', 'operations', '回滚监控等级规则版本', 0, NULL),
    ('1000000000000000000000001B', 'operations:rules:simulate', '测算监控等级规则', 'operations', '测算阈值变化影响', 0, NULL),
    ('1000000000000000000000001C', 'operations:prompt:view', '查看报告 Prompt', 'operations', '查看报告 Prompt 管理页面', 0, NULL),
    ('1000000000000000000000001D', 'operations:prompt:edit', '编辑报告 Prompt', 'operations', '编辑报告 Prompt', 0, NULL),
    ('1000000000000000000000001E', 'operations:prompt:regression', '提交 Prompt 回归', 'operations', '提交 Prompt 回归测试', 0, NULL),
    ('1000000000000000000000001F', 'operations:settings:view', '查看系统配置', 'operations', '查看和维护运维系统配置', 0, NULL) AS incoming_permission
ON DUPLICATE KEY UPDATE
    permission_name = incoming_permission.permission_name,
    module_code = incoming_permission.module_code,
    description = incoming_permission.description,
    is_deleted = 0,
    deleted_at = NULL;

-- 业务团队：我的工作台、上线/监控/报告/流程的业务侧能力。
INSERT INTO role_permissions (role_id, permission_id)
SELECT r.role_id, p.permission_id
FROM roles AS r
JOIN permissions AS p
  ON p.permission_code IN (
    'operations:workbench:view',
    'operations:model-overview:view',
    'operations:bank-overview:view',
    'operations:monitoring-overview:view',
    'operations:monitoring-detail:view',
    'operations:monitoring-detail:business-review',
    'operations:report:view',
    'operations:report:export',
    'operations:report-summary:view',
    'operations:workflow:view',
    'operations:workflow:create',
    'operations:workflow:feedback',
    'operations:workflow:confirm'
  )
WHERE r.role_code = 'business_team'
  AND r.is_deleted = 0
  AND p.is_deleted = 0
ON DUPLICATE KEY UPDATE
    is_deleted = 0,
    deleted_at = NULL;

-- 矩阵修正：业务团队只进入运维工作台，不允许进入开发工作台。
UPDATE role_permissions AS rp
JOIN roles AS r ON r.role_id = rp.role_id
JOIN permissions AS p ON p.permission_id = rp.permission_id
SET rp.is_deleted = 1,
    rp.deleted_at = CURRENT_TIMESTAMP(3)
WHERE r.role_code = 'business_team'
  AND p.permission_code = 'dashboard:view'
  AND rp.is_deleted = 0;

-- 模型团队：developer 角色对应模型团队。
INSERT INTO role_permissions (role_id, permission_id)
SELECT r.role_id, p.permission_id
FROM roles AS r
JOIN permissions AS p
  ON p.permission_code IN (
    'dashboard:view',
    'operations:workbench:view',
    'operations:model-overview:view',
    'operations:bank-overview:view',
    'operations:deployed-models:view',
    'operations:monitoring-overview:view',
    'operations:monitoring-detail:view',
    'operations:monitoring-detail:model-review',
    'operations:report:view',
    'operations:report:edit',
    'operations:report:export',
    'operations:report:send',
    'operations:report-summary:view',
    'operations:workflow:view',
    'operations:workflow:submit-material',
    'operations:workflow:advance',
    'operations:workflow:online',
    'operations:knowledge:view',
    'operations:rules:view',
    'operations:prompt:view',
    'operations:prompt:edit',
    'operations:prompt:regression'
  )
WHERE r.role_code = 'developer'
  AND r.is_deleted = 0
  AND p.is_deleted = 0
ON DUPLICATE KEY UPDATE
    is_deleted = 0,
    deleted_at = NULL;

-- 管理员：拥有全部运维页面和操作权限；既有系统权限不受影响。
INSERT INTO role_permissions (role_id, permission_id)
SELECT r.role_id, p.permission_id
FROM roles AS r
JOIN permissions AS p
  ON p.module_code = 'operations'
 AND p.is_deleted = 0
WHERE r.role_code = 'admin'
  AND r.is_deleted = 0
ON DUPLICATE KEY UPDATE
    is_deleted = 0,
    deleted_at = NULL;

COMMIT;

-- 执行后核验：应看到 admin、developer、business_team 三个角色的运维权限。
SELECT
    r.role_code,
    r.role_name,
    COUNT(p.permission_id) AS operations_permission_count
FROM roles AS r
LEFT JOIN role_permissions AS rp
  ON rp.role_id = r.role_id
 AND rp.is_deleted = 0
LEFT JOIN permissions AS p
  ON p.permission_id = rp.permission_id
 AND p.module_code = 'operations'
 AND p.is_deleted = 0
WHERE r.role_code IN ('admin', 'developer', 'business_team')
GROUP BY r.role_code, r.role_name
ORDER BY FIELD(r.role_code, 'admin', 'developer', 'business_team');

-- 如需给某个业务账号分配业务团队角色，请先确认用户名，再单独执行：
-- UPDATE users
-- SET platform_role_id = (SELECT role_id FROM roles WHERE role_code = 'business_team'),
--     updated_at = CURRENT_TIMESTAMP(3)
-- WHERE username = '<确认后的业务账号>'
--   AND is_deleted = 0;