#!/usr/bin/env bash
set -euo pipefail

SILVER_TENANT_ID=""
MEITU_TENANT_ID=""
DRY_RUN=false
CONFIRMED=false

usage() {
  echo "Usage: $0 --silver-tenant-id ID --meitu-tenant-id ID [--dry-run | --confirm]" >&2
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    --silver-tenant-id) SILVER_TENANT_ID="${2:-}"; shift 2 ;;
    --meitu-tenant-id) MEITU_TENANT_ID="${2:-}"; shift 2 ;;
    --dry-run) DRY_RUN=true; shift ;;
    --confirm) CONFIRMED=true; shift ;;
    -h|--help) usage; exit 0 ;;
    *) usage; exit 2 ;;
  esac
done

valid_tenant_id() {
  [[ "$1" =~ ^[A-Za-z0-9_-]{1,20}$ ]]
}

if ! valid_tenant_id "$SILVER_TENANT_ID" || ! valid_tenant_id "$MEITU_TENANT_ID"; then
  usage
  exit 2
fi
if [[ "$SILVER_TENANT_ID" == "$MEITU_TENANT_ID" ]]; then
  echo "银城和美途必须使用不同租户 ID" >&2
  exit 2
fi

print_plan() {
  echo "[SPACE] tenant=$SILVER_TENANT_ID code=yc_public_policy name=公共制度 type=PUBLIC sensitivity=INTERNAL status=ACTIVE"
  echo "[SPACE] tenant=$SILVER_TENANT_ID code=yc_property_sop name=物业业务SOP type=BUSINESS sensitivity=INTERNAL status=ACTIVE"
  echo "[SPACE] tenant=$SILVER_TENANT_ID code=yc_management_ops name=管理运营 type=MANAGEMENT sensitivity=CONFIDENTIAL status=ACTIVE"
  echo "[SPACE] tenant=$MEITU_TENANT_ID code=mt_customer_service name=美途客户咨询 type=EXTERNAL sensitivity=PUBLIC status=ACTIVE"
  echo "[APP] tenant=$SILVER_TENANT_ID code=yc_admin auth=SESSION client=pc status=ACTIVE"
  echo "[APP] tenant=$SILVER_TENANT_ID code=yc_mobile auth=SESSION client=app status=ACTIVE"
  echo "[APP] tenant=$MEITU_TENANT_ID code=mt_card_miniapp auth=API_TOKEN status=DISABLED"
  echo "[BINDING] yc_admin -> yc_public_policy,yc_property_sop,yc_management_ops"
  echo "[BINDING] yc_mobile -> yc_public_policy,yc_property_sop,yc_management_ops"
  echo "[BINDING] mt_card_miniapp -> mt_customer_service"
  echo "[GRANT] employee READ yc_public_policy,yc_property_sop"
  echo "[GRANT] supervisor READ yc_public_policy,yc_property_sop,yc_management_ops"
  echo "[GRANT] superadmin,hr_operator MANAGE 银城三个空间"
}

if [[ "$DRY_RUN" == true ]]; then
  print_plan
  exit 0
fi

if [[ "$CONFIRMED" != true ]]; then
  echo "实际写入前必须查询 sys_tenant 确认公司名称，并显式传 --confirm" >&2
  exit 2
fi

MYSQL_DATABASE="${AIHR_DB_NAME:-ry-vue}"
MYSQL_CONTAINER="${AIHR_MYSQL_CONTAINER:-wygj-mysql}"
MYSQL_USER="${AIHR_DB_USER:-root}"
MYSQL_PASSWORD="${AIHR_DB_PASSWORD:-root}"

mysql_exec() {
  if [[ -n "${AIHR_DB_HOST:-}" ]]; then
    MYSQL_PWD="$MYSQL_PASSWORD" mysql -h "$AIHR_DB_HOST" -P "${AIHR_DB_PORT:-3306}" -u "$MYSQL_USER" \
      --default-character-set=utf8mb4 "$MYSQL_DATABASE" "$@"
  else
    docker exec -i -e MYSQL_PWD="$MYSQL_PASSWORD" "$MYSQL_CONTAINER" mysql -u "$MYSQL_USER" \
      --default-character-set=utf8mb4 "$MYSQL_DATABASE" "$@"
  fi
}

tenant_row() {
  mysql_exec -Nse "select concat(tenant_id, ':', company_name) from sys_tenant where tenant_id = '$1' and del_flag = '0' limit 1"
}

SILVER_ROW="$(tenant_row "$SILVER_TENANT_ID")"
MEITU_ROW="$(tenant_row "$MEITU_TENANT_ID")"
if [[ -z "$SILVER_ROW" || -z "$MEITU_ROW" ]]; then
  echo "sys_tenant 中未找到两个有效租户，请先确认租户 ID" >&2
  exit 3
fi
echo "已确认租户：$SILVER_ROW"
echo "已确认租户：$MEITU_ROW"

for app_code in yc_admin yc_mobile mt_card_miniapp; do
  other_tenant="$(mysql_exec -Nse "select tenant_id from aihr_knowledge_app where app_code = '$app_code' and tenant_id not in ('$SILVER_TENANT_ID', '$MEITU_TENANT_ID') limit 1")"
  if [[ -n "$other_tenant" ]]; then
    echo "应用编码 $app_code 已被其他租户占用，停止初始化" >&2
    exit 4
  fi
done

mysql_exec <<SQL
START TRANSACTION;

INSERT INTO aihr_knowledge_info
  (tenant_id, name, code, description, space_type, sensitivity_level, status, \`separator\`, overlap_char,
   retrieve_limit, similarity_threshold, text_block_size, enable_hybrid, hybrid_alpha, system_prompt, create_time, update_time, remark)
VALUES
  ('$SILVER_TENANT_ID', '公共制度', 'yc_public_policy', '员工应知制度、行政通知和公开流程', 'PUBLIC', 'INTERNAL', 'ACTIVE', '\n\n', 120, 5, 0.5, 800, 1, 1.0, '只基于公共制度空间的引用回答。', NOW(), NOW(), 'provision:v1'),
  ('$SILVER_TENANT_ID', '物业业务 SOP', 'yc_property_sop', '物业岗位流程、标准与话术', 'BUSINESS', 'INTERNAL', 'ACTIVE', '\n\n', 120, 5, 0.5, 800, 1, 1.0, '只基于物业业务 SOP 空间的引用回答。', NOW(), NOW(), 'provision:v1'),
  ('$SILVER_TENANT_ID', '管理运营', 'yc_management_ops', '项目管理、巡检、培训、品质和团队复盘', 'MANAGEMENT', 'CONFIDENTIAL', 'ACTIVE', '\n\n', 120, 5, 0.5, 800, 1, 1.0, '只基于管理运营空间的引用回答。', NOW(), NOW(), 'provision:v1'),
  ('$MEITU_TENANT_ID', '美途客户咨询', 'mt_customer_service', '可对外发布的服务介绍、常见问题和客户话术', 'EXTERNAL', 'PUBLIC', 'ACTIVE', '\n\n', 120, 5, 0.5, 800, 1, 1.0, '只回答已发布的美途客户咨询内容，不输出内部资料。', NOW(), NOW(), 'provision:v1')
ON DUPLICATE KEY UPDATE
  name = VALUES(name), description = VALUES(description), space_type = VALUES(space_type),
  sensitivity_level = VALUES(sensitivity_level), status = VALUES(status), system_prompt = VALUES(system_prompt),
  update_time = NOW(), remark = 'provision:v1';

INSERT INTO aihr_knowledge_app
  (tenant_id, app_code, app_name, auth_type, internal_client_key, token_hash, status, rate_limit_per_minute, create_time, update_time)
VALUES
  ('$SILVER_TENANT_ID', 'yc_admin', '帮道管理端', 'SESSION', 'pc', NULL, 'ACTIVE', 120, NOW(), NOW()),
  ('$SILVER_TENANT_ID', 'yc_mobile', '帮道员工主管端', 'SESSION', 'app', NULL, 'ACTIVE', 120, NOW(), NOW()),
  ('$MEITU_TENANT_ID', 'mt_card_miniapp', '美途名片小程序', 'API_TOKEN', NULL, NULL, 'DISABLED', 60, NOW(), NOW())
ON DUPLICATE KEY UPDATE
  app_name = VALUES(app_name), internal_client_key = VALUES(internal_client_key),
  status = IF(app_code = 'mt_card_miniapp' AND token_hash IS NULL, 'DISABLED', status),
  rate_limit_per_minute = VALUES(rate_limit_per_minute), update_time = NOW();

INSERT INTO aihr_knowledge_app_space (tenant_id, app_id, knowledge_id, create_time)
SELECT a.tenant_id, a.id, k.id, NOW()
  FROM aihr_knowledge_app a JOIN aihr_knowledge_info k ON k.tenant_id = a.tenant_id
 WHERE (a.tenant_id = '$SILVER_TENANT_ID' AND a.app_code IN ('yc_admin','yc_mobile')
        AND k.code IN ('yc_public_policy','yc_property_sop','yc_management_ops'))
    OR (a.tenant_id = '$MEITU_TENANT_ID' AND a.app_code = 'mt_card_miniapp' AND k.code = 'mt_customer_service')
ON DUPLICATE KEY UPDATE create_time = aihr_knowledge_app_space.create_time;

INSERT INTO aihr_knowledge_space_grant
  (tenant_id, knowledge_id, principal_type, principal_value, permission, status, create_time, update_time)
SELECT k.tenant_id, k.id, 'ROLE', g.role_key, g.permission, 'ACTIVE', NOW(), NOW()
  FROM aihr_knowledge_info k
  JOIN (
    SELECT 'employee' role_key, 'READ' permission, 'yc_public_policy' code UNION ALL
    SELECT 'employee', 'READ', 'yc_property_sop' UNION ALL
    SELECT 'supervisor', 'READ', 'yc_public_policy' UNION ALL
    SELECT 'supervisor', 'READ', 'yc_property_sop' UNION ALL
    SELECT 'supervisor', 'READ', 'yc_management_ops' UNION ALL
    SELECT 'superadmin', 'MANAGE', 'yc_public_policy' UNION ALL
    SELECT 'superadmin', 'MANAGE', 'yc_property_sop' UNION ALL
    SELECT 'superadmin', 'MANAGE', 'yc_management_ops' UNION ALL
    SELECT 'hr_operator', 'MANAGE', 'yc_public_policy' UNION ALL
    SELECT 'hr_operator', 'MANAGE', 'yc_property_sop' UNION ALL
    SELECT 'hr_operator', 'MANAGE', 'yc_management_ops'
  ) g ON g.code = k.code
 WHERE k.tenant_id = '$SILVER_TENANT_ID'
ON DUPLICATE KEY UPDATE status = 'ACTIVE', update_time = NOW();

COMMIT;
SQL

print_plan
echo "初始化完成；未生成任何 API_TOKEN。请在管理端轮换令牌后再启用美途应用。"